Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects modification of a storage account network rule set to allow public access, bypass trusted-service checks, or add broad network ranges.
Detects modifications or publication of Azure Automation runbooks by users or service principals other than known, pre-approved automation service principals. This activity may indicate an unauthorized user or compromised service principal attempting to inject malicious code into automation workflows.
Detects modification of an Azure storage account network rule set to allow public access, bypass trusted-service checks, or add broad network ranges. This could indicate an attacker attempting to gain broader access to sensitive data stored in Azure Storage.
This rule monitors the creation of new Azure Function Apps and identifies those that receive external, non-private network requests within 48 hours of their creation. This pattern may indicate the deployment of malicious or unauthorized serverless infrastructure for command-and-control, proxying, or automated tasks.
Detects high-impact configuration changes to Azure management groups or subscriptions (e.g., write/delete operations) that are performed by non-privileged accounts or outside of defined business change windows. This activity can indicate unauthorized privilege escalation, resource manipulation, or reconnaissance by an adversary.
Detects suspicious OAuth application or service principal registration, or permission consent, performed by users who are not part of designated IT administrator groups. This rule flags high-privilege permission grants (e.g., Mail.Read, Directory.ReadWrite.All) or application consent events, which are common methods for establishing long-term persistence in cloud environments.
This rule detects successful administrative actions related to the creation, deletion, or modification of Azure Management Groups, Subscriptions, and resources within them. Such actions can indicate unauthorized structural changes to the environment, potential privilege escalation, or attempts to modify tenant-level governance.
This rule detects successful administrative actions related to the creation, deletion, or modification of Azure Management Groups, Subscriptions, and resources within them. Such actions can indicate unauthorized structural changes to the environment, potential privilege escalation, or attempts to modify tenant-level governance.
Detects suspicious app installations, custom app creation, and bot additions within Microsoft Teams. This rule flags activities such as sideloaded app installations (which bypass Teams store vetting and can be used for persistence), custom app creation outside of typical development teams (potentially indicating C2 bots or data exfiltration apps), and the addition of bots, especially when combined with suspicious keywords in the app name. These actions can be indicative of an adversary establishing persistence or gaining unauthorized access and control within the Teams environment.
Detects the creation of Kubernetes pods with dangerous security settings that could lead to container escape or privilege escalation. This includes configurations such as hostNetwork enabled, allowPrivilegeEscalation set to true, or running as root (runAsUser = 0). The rule specifically monitors 'io.k8s.core.v1.pods.create' operations in cloud audit logs.
This rule detects suspicious activities related to OAuth application consent and service principal operations originating from proxy infrastructure. Specifically, it looks for actions such as adding service principal credentials, granting OAuth2Permission, consenting to applications, adding delegated permission grants, or adding new service principals/applications, where the initiating IP address is identified as belonging to a proxy service. This combination of activities and source IP can indicate an adversary attempting to establish persistence or escalate privileges within an Azure AD environment.
Identifies a single IP address (the attacker) accessing multiple distinct enterprise applications (Exchange, SharePoint, Teams) in rapid succession using a hijacked cookie.
Detects an AI agent (manipulated by a poisoned recommendation prompt) attempting to access internal Cloud Metadata endpoints (e.g., AWS IMDS, Azure IMDS) to steal underlying infrastructure tokens.
Detects queries extracting large contact lists or license details ($top=999 or $top=1000) via Microsoft Graph API, indicating automated data harvesting or reconnaissance activities. This behavior could be indicative of an adversary attempting to collect information about an organization's users or licensed software.
Detects Key Vault access policy or role changes that grant secret-reading capabilities.
Detects disabling of Conditional Access policies via Graph API
Detects access to App Service Kudu deployment or command endpoints by an identity not normally associated with deployment operations.
Detects access to Azure App Service Kudu deployment or command endpoints by an identity not normally associated with deployment operations. This could indicate an attacker using compromised credentials to interact with the application's underlying infrastructure.
Detects a single identity rapidly reading a large number of distinct secrets from an Azure Key Vault within a short timeframe (10 minutes). This behavior is indicative of automated secret harvesting, potentially by an attacker who has compromised an identity with access to the Key Vault. The rule specifically looks for at least 25 reads and 10 distinct secrets accessed by the same identity and IP address within the time window.
This rule detects anomalous access to cloud services, specifically Salesforce, Drift, Salesloft, HubSpot, and Marketo, that may indicate OAuth token abuse. It identifies scenarios where a high volume of actions (8 or more) occur within a short timeframe (3 hours or less) from a single IP address but with multiple unique user agents (2 or more). The detection is further refined by looking for actions related to 'Add delegated permission grant' or 'Create service principal', which are indicative of an attacker attempting to establish persistence or escalate privileges after gaining access through a compromised OAuth token.
This rule detects potential data exfiltration attempts or sensitive information disclosure through Microsoft Copilot Enterprise Search. It specifically looks for 'URLClick' actions from 'Microsoft Copilot Enterprise Search' where the raw event data contains a 'q=' parameter (indicating a query) and also contains keywords like 'extract', 'embed', or 'img'. This combination suggests that a user might be attempting to extract or embed content, potentially sensitive, via a Copilot search query, which could lead to data leakage.
Page 92 of 135