Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
173 detections
Filters
Last updated
All Time
Detection languages
93
25
23
19
11
Contributors
98
20
18
9
5
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
134
60
56
24
6
Products / Services
94
57
57
24
12
MITRE Techniques
103
56
55
31
30
IDS Classtypes
1
1
IDS Protocols
3
The following analytic identifies the addition of a new federated domain in an Office 365 environment. This behavior is detected by analyzing Office 365 management activity logs, specifically filtering for Workload=Exchange and Operation="Add-FederatedDomain". The addition of a new federated domain is significant as it may indicate unauthorized changes or potential compromises. If confirmed malicious, attackers could establish a backdoor, bypass security measures, or exfiltrate data, leading to data breaches and unauthorized access to sensitive information. Immediate investigation is required to review the details of the added domain and any concurrent suspicious activities.
This rule detects administrative actions related to AWS SAML Identity Providers. Specifically, it triggers when a SAML provider is created, updated, or deleted within an AWS environment. Monitoring these events is crucial as SAML providers are used for federated access, and unauthorized changes could indicate attempts at persistence, privilege escalation, or defense evasion by manipulating authentication mechanisms.
Detects create, update or delete events of a SAML provider in AWS.
Detects the addition of a new Federated Domain in Microsoft Exchange. This event can be indicative of credential abuse or the establishment of a backdoor via federated identities, potentially in the context of a Golden SAML attack.
Detects the addition of a new Federated Domain.
Page 9 of 9