Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects modifications to AWS GuardDuty configurations, including disabling the detector, deleting publishing destinations, or altering threat intelligence sets and trusted IP lists. These actions could indicate an attempt to blind security monitoring or evade detection.
Detects high severity (>= 9.0) AWS GuardDuty findings indicating that an EC2 instance or ECS cluster has been compromised, typically suggesting active exploitation or control by a malicious actor.
Detects the creation or update of Azure Network Security Group (NSG) rules that allow inbound traffic from the entire internet (0.0.0.0/0 or *) to management ports (RDP 3389 or SSH 22). This behavior often indicates an attempt to expose administrative services to the public internet.
Detects high frequency administrative modifications, such as user creation/deletion, password resets, or group membership changes, performed by service accounts associated with Azure AD Connect or Microsoft Entra Connect. This behavior may indicate account compromise where a service principal is being abused to perform bulk identity management operations.
This rule detects when a user or administrator grants consent to an Azure AD or Office 365 application for permissions that provide significant access to mail, files, contacts, or directory data. This activity is a common vector for illicit OAuth consent attacks, where adversaries gain persistent access to sensitive data without requiring direct user credentials.
This rule detects anomalous Azure AD sign-in behavior where a single user account authenticates from two or more distinct subnets (class C) within a 10-minute window. It specifically focuses on non-interactive logins or token issuance (e.g., refresh tokens) that are successful (resultType 0) and ignores service principal activity, which may indicate account compromise, session hijacking, or automated credential misuse.
This rule detects potential reconnaissance activity in Microsoft 365 environments by monitoring Graph API requests. It specifically looks for large-scale user enumeration patterns or queries containing keywords associated with HR, payroll, or sensitive financial information, often indicative of an adversary attempting to identify high-value targets. The detection focuses on both standard 'List' operations and specific URI patterns used for bulk data extraction.
Detects when an application or service principal is assigned an app role containing sensitive permissions in Azure AD/Microsoft Entra ID. Such assignments can grant an application elevated access to mail, directory, or user management, which is a common tactic for persistence and privilege escalation in cloud environments.
Detects potential Server-Side Template Injection (SSTI) attacks targeting the Flocci API Gateway using Velocity Template Language (VTL). The rule monitors for malicious VTL patterns in network traffic, subsequent OS command execution, anomalous file creation indicating RCE, and IAM scope bypass patterns in cloud environment logs.
This rule detects when sharing inheritance settings are modified in SharePoint. This could indicate an attempt to broaden access to sensitive information, a misconfiguration, or an attacker attempting to maintain access or exfiltrate data.
Detects anomalous credential access behavior in Azure Key Vault where a single identity performs more than 20 secret, key, or certificate read/list operations within a 5-minute window. This behavior is indicative of potential unauthorized reconnaissance or exfiltration of secrets stored in Key Vaults, excluding known automation service principals.
Detects Azure Privileged Identity Management (PIM) role activations that occur outside of standard business hours (before 07:00 or after 19:00 UTC, or on weekends) or involve high-privilege roles (e.g., Global Administrator, Privileged Role Administrator, Security Administrator).
This rule detects potentially malicious reconnaissance or enumeration activity by identifying a high volume of Microsoft Graph API requests (GET requests) to sensitive directory endpoints (users, groups, directoryRoles, servicePrincipals) from a single application identity (AppId) and IP address within a short time window.
Detects successful OAuth application consent grants or service principal role assignments involving sensitive permissions, such as read access to mail, contacts, files, or directory information. This activity is a common indicator of OAuth-based phishing or unauthorized persistent access to cloud resources.
This rule detects when a user grants an OAuth application permissions within an Azure AD or Office 365 environment, specifically monitoring for highly sensitive permissions such as 'Mail.Read', 'Files.ReadWrite', 'User.Read.All', or 'offline_access'. The rule cross-references the application ID against a known list to filter out pre-authorized applications and assigns a risk score based on the combination of granted permissions, flagging suspicious, unrecognized applications.
Detects instances where a user grants an OAuth application permissions for high-privilege scopes such as 'mail.read', 'files.readwrite', or 'offline_access'. This behavior is frequently indicative of OAuth consent phishing campaigns targeting Microsoft Entra ID environments to gain unauthorized access to user data and maintain persistence via stolen access tokens.
Detects automated enumeration patterns via the Microsoft Graph API, specifically targeting bulk directory pulls (requests with $top=999) and keyword-based searches for sensitive organizational data (payroll, HR, finance). This rule aggregates activity by user session to identify suspicious volumes and diversity of requests.
This rule monitors Microsoft Entra ID (Azure AD) sign-ins for indicators associated with the 'Payroll Pirate' campaign. It identifies non-interactive OAuth/token-based authentication requests originating from residential Internet Service Provider (ISP) ASNs using devices marked as unmanaged. It further elevates risk by detecting impossible travel (same user accessing from multiple IPs in a short window) and the use of specific browser User-Agent strings (Firefox or Axios) characteristic of the threat actor's tooling.
Detects high-volume, suspicious enumeration of HR and Payroll related information via Microsoft Graph API. The rule identifies anomalous behavior such as rapid bulk pagination, usage of suspicious user agents, and specific targeting of sensitive fields (e.g., department, job title) or keywords commonly associated with HR and financial data, likely indicating the use of a stolen OAuth token.
Detects anomalous activities targeting SaaS CRM applications (Salesforce, Microsoft Dynamics 365, HubSpot), including high-volume bulk exports, off-hours access, mass API queries for sensitive objects, and suspicious OAuth token grants.
Detects high-frequency S3 PutObject requests that utilize Customer-Provided Encryption Keys (SSE-C). A high count of such operations within a short window can be indicative of ransomware activity, where an adversary encrypts data within the victim's cloud storage using their own keys to prevent access by the owner.
Page 78 of 135