Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects an unusually high volume of successful operations related to Azure App Services originating from a single caller within a one-hour window. This could indicate automated activity, reconnaissance, or a misconfigured application.
This rule detects when a single caller performs five or more successful 'Create or Update Network Security Group' operations within a one-hour window in Azure Activity logs. This could indicate an attacker attempting to modify network access controls to facilitate lateral movement, C2, or data exfiltration, or a misconfigured automated process.
This rule detects repeated successful operations related to public access or firewall configuration changes within Azure Activity Logs. A high count (3 or more) of such operations by the same caller within an hour could indicate malicious activity, such as an attacker attempting to open up network access to compromised resources or exfiltrate data.
This rule detects potential post-compromise mailbox reconnaissance by correlating suspicious sign-in events (non-interactive or unmanaged device usage, often associated with AiTM token replay) with subsequent mailbox or compliance search operations targeting payroll and HR-related keywords within a 60-minute window.
This rule detects potential unauthorized access to Azure Storage Blobs following the retrieval of storage account access keys. It correlates 'ListKeys' API events with subsequent blob access activities from either unrecognized IP addresses or via Shared Access Signature (SAS) tokens, indicating potential credential misuse.
Detects instances where a user or service principal is assigned to high-privilege roles (e.g., Global Administrator, Owner) without utilizing the Microsoft Entra Privileged Identity Management (PIM) service. This is indicated by the absence of 'PIM' in the LoggedByService field for a successful 'Add member to role' operation, which could signify an attempt to bypass established access controls and gain unauthorized elevated persistence.
Detects AzureHound or roadtx bulk enumeration of Microsoft Graph API endpoints using tokens obtained via CVE-2025-0309 CA policy bypass, characterized by high-frequency GET requests to /v1.0/users, /v1.0/groups, /v1.0/devices, /v1.0/servicePrincipals from Edge client IDs (f44b1140-bc5e-48c6-8dc0-5cf5a53c0e34 or 22098786-6e16-43cc-a27d-191a01a1e3b5) with password-only amr claim and no MFA.
Detects the successful deletion of diagnostic settings in Azure, which may be an attempt by an adversary to impair logging and hide malicious activity.
Detects Azure Privileged Identity Management (PIM) role activations that occur outside of standard business hours (before 07:00 or after 19:00 UTC, or on weekends) or involve high-privilege roles (e.g., Global Administrator, Privileged Role Administrator, Security Administrator).
Detects high-frequency enumeration of privileged roles or role assignments within Azure AD (Entra ID) by a single user or IP address within a short time window. This activity often precedes more targeted attacks aimed at compromising highly privileged identities.
Detects OAuth application consent grants or modifications where the application is granted sensitive permissions including Mail.Read, Directory.Read.All, or User.Read.All. These permissions can be abused by attackers to exfiltrate email data or map the organization's directory.
Detects bulk enumeration of Microsoft Graph API endpoints (users, groups, devices, service principals) characteristic of tools like AzureHound or roadtx. The detection focuses on high-frequency GET requests originating from known Edge browser client IDs associated with CA policy bypass (CVE-2025-0309) where tokens lack MFA claims, indicating unauthorized reconnaissance in an Azure/Entra ID environment.
This rule detects the addition of new certificates or client secrets to Azure App Registrations or Service Principals by a user who is not recorded as an owner of that application in the last 90 days. This behavior is a common persistence and privilege escalation technique used by attackers to maintain access to cloud environments.
Detects the modification of an Azure Storage account's encryption settings to use a Key Vault for Customer-Managed Keys (CMK). This activity can be indicative of ransomware attacks where adversaries switch to an attacker-controlled key and then delete it, rendering all data in the storage account inaccessible.
Detects high frequency administrative modifications, such as user creation/deletion, password resets, or group membership changes, performed by service accounts associated with Azure AD Connect or Microsoft Entra Connect. This behavior may indicate account compromise where a service principal is being abused to perform bulk identity management operations.
Detects the creation of Kubernetes pods with dangerous security settings that could lead to container escape or privilege escalation. This includes pods configured with hostNetwork enabled, allowing privilege escalation, running as root (UID 0), or abusing capabilities.
This rule detects suspicious application consent activity in Azure AD. It identifies instances where a user successfully grants consent to three or more applications within a one-hour window. This behavior can indicate an adversary attempting to gain access to resources by tricking users into consenting to malicious applications.
Detects modifications to Azure AD/Entra ID application configurations, specifically updating the 'RedirectUri' or 'ReplyUrls' to point to potentially external or unauthorized domains. This technique is often used in OAuth-based application-consent phishing campaigns to redirect authorization codes to adversary-controlled servers.
This rule detects suspicious activity within Microsoft Graph API where an account is querying mailbox contents for sensitive payroll and HR-related keywords. This pattern is often observed following an Adversary-in-the-Middle (AiTM) session compromise, where threat actors (such as those associated with the Payroll Pirate campaign) leverage stolen session tokens to exfiltrate sensitive employee information by searching for specific financial and payroll keywords across multiple mailboxes.
Detects Microsoft 365 sign-in activity consistent with the Payroll Pirate campaign. This rule monitors for successful sign-ins originating from known residential proxy ASN providers (IPRoyal, Bright Data, Oxylabs) or instances where a successful sign-in occurs with a suspicious browser fingerprint (Firefox 131.0/142.0) during a Microsoft Graph OAuth2 token request, indicating session-token replay.
This rule detects suspicious activity related to GitHub Actions workflows, including the creation or modification of workflow configuration files, the placement of suspicious JavaScript files in the repository's .github directory, the execution of the 'Bun' runtime within an Actions runner environment, and cloud-based events indicating workflow modification containing 'Run Copilot' strings. These patterns are often associated with CI/CD pipeline compromise, malicious automation, or unauthorized code execution within build environments.
Page 80 of 135