Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects the execution of AWS Security Token Service (STS) CLI commands (such as get-caller-identity) initiated by development-related processes like VS Code (Code.exe), Code Helper, or Node.js. This behavior may indicate an attacker leveraging developer environments to perform cloud infrastructure discovery or enumerate AWS permissions.
This rule detects Nested App Authentication (NAA) broker abuse, specifically when the Azure Portal silently acquires Microsoft Graph tokens for privileged first-party nested applications. It correlates these silent token acquisitions with a preceding interactive Azure Portal sign-in from the same user and IP address within a 30-minute window, indicating a potential AiTM (Adversary-in-the-Middle) kill chain indicator. The rule identifies known vulnerable nested application IDs and looks for 'refreshToken' or 'broker' as the incoming token type during the Graph token acquisition.
This rule detects Nested App Authentication (NAA) broker abuse, specifically when the Azure Portal silently acquires Microsoft Graph tokens for privileged first-party nested applications. It correlates these silent token acquisitions with a preceding interactive Azure Portal sign-in from the same user and IP address within a 30-minute window, indicating a potential AiTM (Adversary-in-the-Middle) kill chain indicator. The rule identifies known vulnerable nested application IDs and looks for 'refreshToken' or 'broker' as the incoming token type during the Graph token acquisition.
Detects a successful Key Vault access policy or role change that grants secret-reading capability to a user or service principal. This could indicate an adversary attempting to gain access to sensitive credentials stored in Azure Key Vault.
Detects successful retrieval of storage account access keys by a user identity rather than an established deployment or backup service. This activity can indicate an attacker attempting to gain access to sensitive data stored in Azure Storage Accounts.
This rule monitors Cisco SD-WAN logs (vManage, auth, and syslog) for suspicious administrative activity including credential manipulation, unauthorized password changes, successful vManage-admin SSH logins, and potential configuration exfiltration via vManage API calls.
Detects the modification of sensitive banking or payment election records (e.g., direct deposit details) in Workday or similar HR SaaS platforms shortly after a user login event from the same source IP. This behavior is consistent with 'Payroll Pirate' style attacks where adversaries use stolen session tokens (via AiTM phishing) to redirect employee salary payments.
Detects automated Microsoft Graph API requests indicative of the 'Payroll Pirate' campaign, specifically targeting payroll and HR personnel after initial access via AiTM session token theft. The rule identifies two malicious patterns: bulk user directory harvesting using '?$top=999' and keyword-targeted enumeration (payroll, human, compensation) using OR-chained search queries and pagination markers ($skiptoken).
Detects when a single session identifier is used to access multiple cloud applications, where at least three distinct applications are accessed within an hour, and these applications were not part of the original interactive sign-in. This behavior can indicate a token replay attack, specifically as described in the Elastic Security Labs research on Tycoon 2FA AiTM detection engineering.
This rule identifies potential account compromise by detecting successful logins to at least two different SaaS applications monitored by Microsoft Cloud App Security (MCAS) within a 2-hour window, originating from geolocations separated by more than 500 kilometers. This behavior is indicative of credential sharing or account hijacking where an adversary accesses multiple cloud services rapidly from geographically distant locations.
Detects an unusually high frequency of storage blob and container listing operations within a short time window. This behavior often indicates an attempt to enumerate the contents of Azure Blob Storage, which may be a precursor to data discovery or exfiltration.
Detects the modification of Azure Storage account management policies where the 'daysAfterModificationGreaterThan' condition is set to 7 days or less, specifically including a 'delete' action. This could indicate an attempt by an adversary to shorten the lifecycle of data for rapid, automated, and potentially malicious data destruction within Azure Blob Storage.
Detects instances where a specific identity or caller triggers Azure Function or Logic App workflows at a high volume (more than 50 successful invocations within a 5-minute window). This threshold may indicate automated exploitation, potential brute-force attempts on API endpoints, or a misconfigured/malfunctioning service causing excessive resource usage.
This rule detects potential OAuth token abuse by correlating credential consent grants with subsequent unusual cloud access patterns from different geographic locations. It looks for activities like adding a service principal, adding OAuth2 permission grants, or consenting to an application, followed by access to specific cloud applications (Salesforce, Drift, Slack, Microsoft 365, Workday) from an IP address that does not match the IP address from which the consent was granted. The rule aggregates these events and triggers if there are at least 4 related events within a 6-hour window.
This rule detects attempts to grant consent to OAuth applications, which could indicate an illicit consent grant attack. It specifically looks for successful operations related to consenting to applications, adding app role assignments to service principals, adding delegated permission grants, or adding OAuth2PermissionGrants within audit logs. The rule extracts details such as the target application, the user who consented, their initiating IP address, and the permissions granted.
Detects a sequence of events where an actor deletes a Google Cloud Storage bucket and then immediately recreates it, a pattern consistent with bucket hijacking intended to manipulate resource access or bypass security controls on data streams.
Detects the creation or modification of Azure Storage Account management policies that include rules configured to delete blobs, snapshots, or versions in less than 30 days. This behavior may indicate an attempt at data destruction or unauthorized cleanup of cloud storage objects.
Detects high-velocity queries to Graph API regarding transitiveRoleAssignments, a Tycoon 2FA post-compromise activity. This activity is indicative of reconnaissance for role assignments within Microsoft Graph, potentially by an adversary like Volt Typhoon (Tycoon 2FA).
This rule detects successful additions or updates to service principal credentials or application certificates/secrets within Azure AD. This activity can indicate persistence establishment by an attacker who has compromised an account with sufficient permissions to manipulate application identities.
Detects successful OAuth application consent events where the requested permissions include sensitive scopes such as Mail, Files, or User profile access. This is a common indicator of OAuth application-based phishing or persistence attempts, often referred to as 'Illicit Consent Grant' attacks.
Detects when a single user initiates a high volume (5 or more) of external guest user invitations within a one-hour window. This behavior can be indicative of reconnaissance or attempts to establish persistence by an compromised account by inviting external identities into the tenant.
Page 91 of 135