Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects when the administrative user account for an Azure Container Registry (ACR) is enabled. Enabling the admin user creates a static username and password for registry access, which may bypass modern identity-based access controls like Microsoft Entra ID (formerly Azure AD) and increase the risk of credential-based attacks.
Detects anomalous, automated data exfiltration cycles in Microsoft 365 environments consistent with the Helix threat group. The rule identifies a pattern of successful sign-ins followed within 6 hours by new MFA registration, suspicious SharePoint enumeration, and a high-frequency, non-human-paced burst of file downloads.
Detects the successful creation or update of an Azure Container Instance labeled with 'fortress' that utilizes a MongoDB image from a specific internal container registry.
This rule detects authentication attempts to the 'Device Registration Service' in Entra ID where the User-Agent string contains 'python'. This is often indicative of automated scripts, such as those using libraries like msal, being used to interact with device management APIs, which may be associated with legitimate automation or adversary activity.
Detects new device registrations in Microsoft Entra ID where the device display name is prefixed with 'Forg365-', a pattern used by the Forg365 PhaaS (Phishing-as-a-Service) platform. This activity is indicative of an adversary establishing persistent, unmanaged device access to compromised Microsoft 365 accounts.
Detects suspicious modifications or deletions of Outlook calendar events using the Microsoft Graph API, potentially indicating the use of calendar infrastructure as a command-and-control (C2) heartbeat or exfiltration channel. The rule monitors for specific pattern-based event updates or deletions following calendar enumeration, which is a technique used to maintain persistent communication or exfiltrate small amounts of data.
Detects anomalous access to Outlook calendar attachments via the Microsoft Graph API, specifically targeting a file named 'file0.txt'. This activity may indicate a technique where attackers use calendar events as a covert channel for data exfiltration or delivery of malicious payloads.
Detects anomalous access to Outlook calendar attachments via the Microsoft Graph API, specifically targeting a file named 'file0.txt'. This activity may indicate a technique where attackers use calendar events as a covert channel for data exfiltration or delivery of malicious payloads.
Detects Microsoft 365 Outlook calendar events being updated via Graph API where the subject is changed to a suspicious C2-like string (e.g., 'Boss Report ID:' or 'Boss update ID:'). This behavior is consistent with attackers using Outlook calendar events as a covert communication channel or for command and control signaling.
This rule detects scenarios where a user's session originates from the 'Microsoft Authentication Broker' and another application (like 'OfficeHome' or 'One Outlook Web') within a short window (15 minutes), but from different source IP addresses. This indicates potential session hijacking or the use of stolen session cookies by an external actor.
Detects successful read operations of Azure role assignments where the response or properties involve the 'Contributor' role, potentially indicating reconnaissance of highly privileged access within the subscription.
Detects the restart action performed on a specific Azure container group named 'fr33m3' within the 'bialystok-rg' resource group. This monitors for lifecycle management activities that could be indicative of service manipulation or persistence resets.
Detects anomalous, high-volume enumeration of Azure OAuth application IDs from a single IP address, indicative of an adversary attempting to map or verify OAuth applications, potentially leveraging spoofed client IDs for discovery or bypass attempts.
Detects a near-simultaneous correlation between a user registering a new FIDO2 authentication method and a login session from an unmanaged or non-compliant device. This behavioral pattern is often associated with adversary-in-the-middle or vishing attacks where an attacker tricks a user into registering an attacker-controlled security key to maintain persistent MFA access.
Detects use of 'az acr show' or 'az acr repository list' commands to enumerate Azure Container Registry security settings such as adminUserEnabled, anonymousPullEnabled, or networkRuleBypassOptions, indicating reconnaissance for misconfigurations.
Detects Microsoft Entra ID (formerly Azure AD) device registration, ownership assignment, or user assignment operations where the device display name matches a suspicious naming pattern, specifically 'GraphSpy-Device'. This naming convention is often associated with the GraphSpy tool, which is used by adversaries to enumerate and manipulate Entra ID resources, including registering rogue devices to bypass conditional access or MFA.
Detects instances where an Azure Container Group is restarted within 30 minutes of a successful container image push to an Azure Container Registry in the same subscription. This pattern may indicate an automated or manual deployment process following a code update, which could be misused if unauthorized image pushes are occurring.
Detects potential misuse of an Azure Managed Identity token on a Linux host, where 'curl' is used to interact with the Azure Key Vault API (vault.azure.net/secrets) while presenting an Authorization bearer token. This pattern can indicate an adversary who has obtained a Managed Identity token (e.g., via the Instance Metadata Service) and is attempting to exfiltrate or access sensitive secrets stored in Azure Key Vault.
Detects push operations to an Azure Container Registry. This activity is a common administrative task but can also indicate an adversary pushing a malicious, backdoored, or unauthorized container image into an environment, potentially for persistence or supply chain attack purposes.
This rule detects potential user enumeration attacks targeting Entra ID tenants by monitoring for failed sign-in attempts (ResultType 50034) involving common, predictable username patterns across multiple tenants within a 24-hour window. This behavior often indicates an adversary attempting to map valid usernames by exploiting error code differences or identity discovery patterns.
This rule detects authentication attempts in Azure AD Sign-in Logs where the User Agent identifies the request as originating from the Python Requests library (version 2.32.3). This pattern is often indicative of Resource Owner Password Credentials (ROPC) flows, which are frequently abused by threat actors to perform credential stuffing or automated authentication bypassing multi-factor authentication (MFA) requirements in cloud environments.
Page 74 of 135