Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects the malicious GitHub Actions workflow that targets self-hosted runners to run identity-reconnaissance commands (whoami) from the known malicious branch and workflow path.
Detects suspicious modifications or deletions of Outlook calendar events using the Microsoft Graph API, potentially indicating the use of calendar infrastructure as a command-and-control (C2) heartbeat or exfiltration channel. The rule monitors for specific pattern-based event updates or deletions following calendar enumeration, which is a technique used to maintain persistent communication or exfiltrate small amounts of data.
Detects successful authentication events using the OAuth device code flow. This flow is often abused by adversaries to perform OAuth phishing, where a user is tricked into authorizing a malicious application, granting it access tokens to cloud resources.
Detects GET requests to the Microsoft Graph API 'organization' endpoint, often used by malicious tools to validate a tenant environment or gather metadata before initiating C2 communication or secondary stages of an attack.
Detects Microsoft Graph API requests targeting user mailboxes within a tenant or organization structure likely associated with Israeli legal entities, identified by .co.il domain patterns in the Request URI.
Detects Microsoft 365 Outlook calendar events with highly anomalous future dates (specifically the year 2050) or specific subject patterns, which are indicative of a command-and-control (C2) communication channel established via calendar item properties.
Detects Microsoft 365 Outlook calendar events being updated via Graph API where the subject is changed to a suspicious C2-like string (e.g., 'Boss Report ID:' or 'Boss update ID:'). This behavior is consistent with attackers using Outlook calendar events as a covert communication channel or for command and control signaling.
Detects Microsoft Graph API requests targeting user mailboxes within a tenant or organization structure likely associated with Israeli legal entities, identified by .co.il domain patterns in the Request URI.
Detects suspicious modifications or deletions of Outlook calendar events using the Microsoft Graph API, potentially indicating the use of calendar infrastructure as a command-and-control (C2) heartbeat or exfiltration channel. The rule monitors for specific pattern-based event updates or deletions following calendar enumeration, which is a technique used to maintain persistent communication or exfiltrate small amounts of data.
Detects Microsoft 365 Outlook calendar events being updated via Graph API where the subject is changed to a suspicious C2-like string (e.g., 'Boss Report ID:' or 'Boss update ID:'). This behavior is consistent with attackers using Outlook calendar events as a covert communication channel or for command and control signaling.
Detects potential username enumeration attempts against Microsoft Entra ID (Azure AD) by monitoring for the 'AADSTS50034' error code, which occurs when a sign-in attempt is made with a username that does not exist in the directory. This behavior is often associated with adversary reconnaissance to identify valid user accounts.
Detects when the administrative user is enabled for an Azure Container Registry (ACR). Enabling this account provides a static username and password, which may bypass more secure authentication methods like Azure Active Directory-based access and increase the risk of credential exposure.
Detects the execution of tasks within Azure Container Registry that involve sensitive strings or potential credential-related patterns in the task configuration, such as 'secret-task', 'acb_step_0', or specific flag references, which may indicate testing or exploitation of container build pipelines.
Detects anomalous discovery behavior in Azure where a principal performs multiple 'read' operations against both Container Registry and Role Assignments within a short timeframe. This pattern is consistent with an adversary attempting to map the cloud environment, identify accessible resources, and understand permission structures.
This rule monitors the Microsoft 365 AuditLogs to retrieve and investigate all actions taken by or against a specific user account. It expands the TargetResources field to extract the TargetUPN and filters for a specific account, providing a timeline of operations, the actor who initiated the action, and the result of the operation.
This rule detects potential OAuth Device Code Flow phishing attacks where users are directed to malicious lure pages on romnor[.]ca to enter a Microsoft device code. It also alerts on authentication activity associated with a specific malicious OAuth client ID (d3590ed6-52b3-4102-aeff-aad2292ab01c) known to be used by a phishing backend to poll and claim OAuth tokens.
This rule monitors container logs for attempts to access the Azure Instance Metadata Service (IMDS) via the 169.254.169.254 endpoint to request OAuth tokens or access Azure Key Vault secrets. Such activity within a containerized environment is often indicative of credential theft or discovery attempts by an adversary attempting to escalate privileges using the container's managed identity.
This rule monitors for processes making requests to cloud instance metadata services (GCP) or accessing sensitive secrets and parameters via AWS CloudTrail. Such activity may indicate an attacker attempting to enumerate instance identities, retrieve temporary security credentials, or access managed configuration secrets.
Detects GET requests to the Microsoft Graph API 'organization' endpoint, often used by malicious tools to validate a tenant environment or gather metadata before initiating C2 communication or secondary stages of an attack.
Detects anomalous access to Outlook calendar attachments via the Microsoft Graph API, specifically targeting a file named 'file0.txt'. This activity may indicate a technique where attackers use calendar events as a covert channel for data exfiltration or delivery of malicious payloads.
Detects Microsoft 365 Outlook calendar events with highly anomalous future dates (specifically the year 2050) or specific subject patterns, which are indicative of a command-and-control (C2) communication channel established via calendar item properties.
Page 73 of 135