Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
This rule detects an unusually high volume (10 or more within an hour) of successful access control or role-related operations initiated by a single caller in Azure Activity logs. Such activity could indicate an adversary attempting to enumerate permissions, escalate privileges, or modify access to resources within an Azure environment.
This rule detects when a single caller performs five or more successful 'Create or Update Network Security Group' operations within a one-hour window in Azure Activity logs. This could indicate an attacker attempting to modify network access controls to facilitate lateral movement, C2, or data exfiltration, or a misconfigured automated process.
Detects cloud resources created in rarely used geographic regions for evasion
This rule detects when a user successfully grants five or more OAuth2 permissions within a five-minute window, specifically looking for sensitive scopes such as 'Mail.Read', 'Calendar.Read', 'User.Read.All', or 'Directory.Read.All'. This behavior can indicate an adversary attempting to gain broad access to an organization's data through a compromised application or user account.
Detects the creation of multiple service principals with administrative or sensitive keywords in their names within a short timeframe, potentially indicating an attempt to establish persistence or escalate privileges in a cloud environment. The rule specifically looks for service principals containing 'admin', 'sync', 'backup', or 'audit' in their display names, created by users outside of Microsoft's internal domains.
This rule detects the creation of a new service account key within Google Cloud Platform (GCP) via the 'iam.googleapis.com' API. Specifically, it looks for HTTP POST requests to URIs containing 'serviceAccounts' and 'keys'. This activity can be indicative of privilege escalation, where an attacker creates a new key for an existing service account to gain persistent access or elevate their privileges.
Detects modification of AWS organizational units to evade policy controls
Detects cloud instance creation in unusual regions for evasion
Detects disabling of AWS CloudTrail audit logging
This rule identifies suspicious activity within Microsoft Intune by focusing on sensitive operations, broad assignments, and actions performed by API actors (Service Principals) without an associated human User Principal Name (UPN). It specifically looks for operations like creating, adding, assigning, or updating DeviceManagementScripts, DeviceShellScripts, Win32LobApp, DeviceConfiguration, DeviceCompliancePolicy, EndpointSecurity, SecurityBaseline, ConfigurationPolicies, or GroupPolicyConfigurations. The rule also flags broad assignments targeting 'All Devices', 'All Users', 'allDevices', or 'allLicensedUsers'. The primary goal is to detect potential abuse of over-permissioned Graph API applications by attackers to bypass MFA and deploy malicious Mobile Device Management (MDM) commands or configurations.
Detects the creation of a new Global Administrator or Company Administrator account in Microsoft Entra ID (formerly Azure Active Directory). Adversaries may escalate privileges from compromised MDM administration roles (like Intune) to Entra ID Global Admin to cement full control over the tenant.
Detects attempts to list, read, create, update, or delete Kubernetes secrets via the Kubernetes API server. This activity could indicate an adversary attempting to gain access to sensitive information or manipulate the environment.
Detects API access to VPS providers for spinning up attack infrastructure
This rule detects a spike in modifications or creations of Azure Diagnostic Settings within a one-hour window. A high volume of 'Diagnostic Setting' operations by a single caller could indicate an attempt to alter logging configurations, potentially to impair defenses or hide malicious activity.
This rule detects when a single caller performs multiple (3 or more) retrievals of Azure Storage Account Keys within a one-hour window. This activity can indicate an attempt to gain unauthorized access to storage resources or exfiltrate data.
This rule detects when a single caller performs multiple (3 or more) retrievals of Azure Storage Account Keys within a one-hour window. This activity can indicate an attempt to gain unauthorized access to storage resources or exfiltrate data.
This rule detects when a single caller successfully updates three or more SQL Server firewall rules within a one-hour window. This behavior could indicate an adversary attempting to open up network access to a SQL database, potentially for data exfiltration, command and control, or further lateral movement.
This rule detects suspicious GitHub workflow modifications or pushes originating from multiple distinct IP addresses within a short time frame (1 hour). It specifically looks for 'WorkflowCreated', 'WorkflowUpdated', or 'Push' actions on GitHub, and triggers if more than one such event and more than one distinct IP address are observed for a given account within an hour. This could indicate compromised credentials or unauthorized access to a GitHub account being used to manipulate CI/CD pipelines.
This rule detects the issuance of OAuth tokens or OAuth consent events within cloud applications. It specifically looks for these events where the client application is not 'Microsoft Teams' or 'Azure CLI'. The rule summarizes the number of grants and distinct users for each client application and token ID over hourly intervals. This can help identify potentially unauthorized or suspicious OAuth application consents.
Detects modification of cloud instance attributes for evasion or persistence
Detects suspicious Azure PIM role activation requests for temporary elevated access
Page 96 of 135