Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects sign-in attempts where the OAuth Client ID (AppId) does not have a corresponding display name (AppDisplayName) in the logs, and the same Client ID is observed across multiple different Azure tenants. This pattern often indicates an adversary using a malicious or spoofed OAuth application to perform multi-tenant abuse, consent phishing, or unauthorized access across different organizational boundaries.
Detects the creation of Azure Container Registry (ACR) scoped access tokens or scope maps. Adversaries may use these features to establish persistent, least-privileged access to registry resources, often bypassing standard authentication monitoring.
Detects the deployment of an Azure Container Instance (ACI) where the image source or container name matches identified indicators of a potentially compromised registry or unauthorized deployment pattern.
Detects successful execution of the 'List Credentials' action on an Azure Container Registry. This action returns the administrative credentials (username and password) for the registry, which may indicate unauthorized credential access or preparation for exfiltration or lateral movement.
Detects the creation or modification of tokens for an Azure Container Registry (ACR). This activity may indicate an administrator managing registry access, or an adversary creating long-lived credentials for persistence within the container environment.
This rule monitors for successful Azure Container Registry task write, run, or action operations that involve references to identity configurations, Azure KeyVault (vault.azure.net), or ACR task YAML files. These keywords are often associated with the configuration of managed identities or secret retrieval within the build process, which may indicate unauthorized task creation or manipulation to escalate privileges or exfiltrate secrets.
Detects Microsoft Entra ID sign-in events where the AppId (OAuth client_id) is a
syntactically valid UUIDv4 but no corresponding AppDisplayName is populated,
indicating the client ID does not correspond to any registered enterprise
application in the tenant. This pattern is consistent with randomly generated,
valid-format spoofed client IDs used in ROPC-based username/password
enumeration.
syntactically valid UUIDv4 but no corresponding AppDisplayName is populated,
indicating the client ID does not correspond to any registered enterprise
application in the tenant. This pattern is consistent with randomly generated,
valid-format spoofed client IDs used in ROPC-based username/password
enumeration.
Detects the modification of an existing IAM role's trust policy to include new trusted principals (external AWS accounts, root principals, or wildcards). This technique is used for persistence and privilege escalation by modifying existing roles to allow access by an attacker-controlled principal, effectively bypassing detections focused on the creation of new roles.
Detects potentially malicious use of the device code authentication flow in Entra ID sign-in logs. The rule correlates device code usage with indicators of suspicious activity, such as rare User-Agent strings (e.g., 'python-requests') often used in phishing/relay toolkits, or sign-ins flagged by Azure AD Identity Protection as risky. It includes exclusions for known first-party Azure CLI and PowerShell clients to minimize noise from legitimate administrative activity.
Detects Azure CLI operations creating or modifying an Azure Container Registry (ACR) Task with an attached managed identity, where the task definition references Key Vault secrets. This pattern is used to abuse ACR Task automation and its managed identity to exfiltrate Key Vault secrets.
Detects short-window spikes in Entra sign-in/token-request event volume (exceeding roughly 100,000-250,000 events within a single day per tenant), consistent with automated client-ID-spoofed ROPC enumeration campaigns that exhibit a multi-day burst-then-quiet cadence.
Correlates a Microsoft 365 OAuth device-code authentication event with subsequent impact actions on the same identity (device registration/PRT setup, inbox rule creation, or PRT/sign-in activity after a password reset) within a 1-hour window. Severity escalates as more distinct impact phases co-occur on the same actor, consistent with ARToken/EvilTokens post-device-code-phishing persistence chains.
Detects the execution of an Azure Container Registry (ACR) task utilizing a specifically named 'secret-task.yaml' file, which is often associated with adversary attempts to leverage cloud automation for malicious container deployment or secret exfiltration.
Detects modifications to enable the admin account for an Azure Container Registry (ACR), or queries to check the status of this setting. Enabling the admin account provides a static username/password combination that can be used for authentication, which may represent an security risk or account manipulation if not authorized.
Detects an authentication event using the OAuth 2.0 Device Code grant flow, immediately followed by rapid access to multiple high-value cloud resources. This pattern is characteristic of consent phishing or device code phishing, where an adversary tricks a user into authorizing a malicious application, subsequently using that application's access token to programmatically enumerate or exfiltrate data from various services.
Detects potentially unauthorized data exfiltration or bulk extraction activities within Google Cloud BigQuery. The rule monitors for large-scale data queries (SELECT * or queries without filters), data exports to external Google Cloud Storage buckets, and queries executed by automated scripts or tools, which are common indicators of staged data theft following cloud environment compromise.
Detects modifications to Google Cloud IAM policies where permissions are granted that allow service account impersonation or key management (e.g., serviceAccountTokenCreator, serviceAccountKeyAdmin, workloadIdentityUser, serviceAccountUser). These roles are frequently abused by attackers to gain durable, persistent access or escalate privileges by generating tokens as highly-privileged service accounts without requiring an existing service account key.
Detects Entra ID users with active medium-to-high identity risk events who perform Microsoft Copilot actions in cloud applications while simultaneously exhibiting impossible travel indicators — successful sign-ins from multiple geographic locations using unmanaged (non-registered) devices within a one-hour window. This triple-signal correlation (identity risk + impossible travel on unmanaged device + Copilot usage) is a strong indicator of account compromise where an adversary has taken over a legitimate identity and is leveraging AI-powered tools to accelerate reconnaissance, data access, or exfiltration against Microsoft 365 resources.
Detects Microsoft Graph API requests that query directory role assignments specifically looking for highly privileged roles such as Global Administrator, Exchange Administrator, or Security Administrator. This activity may indicate an adversary is enumerating privileged roles to identify potential targets for privilege escalation or lateral movement within an Azure/Microsoft 365 environment.
Detects the usage of the Google Cloud IAM Credentials API to generate OAuth access tokens, OIDC ID tokens, sign JWTs, or sign blobs as a service account. This behavior indicates an identity assuming a service account's permissions, a common technique for privilege escalation or lateral movement in GCP environments.
Detects authorization, token grants, or consent events for two specific Google Workspace application ClientIDs, which may be indicative of OAuth application consent abuse or malicious integration.
Page 75 of 135