Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
597 detections
Filters
Last updated
All Time
Detection languages
285
97
95
69
31
Contributors
186
88
47
47
44
Categories
20,401
11,795
5,864
5,145
4,864
597
Platforms
300
161
158
103
25
Products / Services
221
148
147
132
88
MITRE Techniques
536
265
233
226
98
CVEs
5
5
5
5
4
IDS Classtypes
1
IDS Protocols
1
Detects the creation of a new Entra ID application followed closely by high-privilege permission grants or consent. This is a common technique used by attackers to establish persistent access to cloud resources, such as mailboxes or sensitive data, via OAuth application backdoors.
Detects when high-privilege application permissions (e.g., Directory.ReadWrite.All, Application.ReadWrite.All) are granted to a service principal via admin consent. This behavior can be used by attackers to gain persistent, stealthy administrative access to a Microsoft Entra ID tenant.
Detects the registration of a new MFA authentication method on an Entra ID account from an unrecognized IP or device, occurring in close temporal proximity to a password reset or a risky sign-in event. This behavior is indicative of an adversary establishing persistence via self-service MFA registration after compromising user credentials.
This rule detects when a non-privileged user adds a new owner to an Azure AD Application or Service Principal, followed by a suspicious modification (such as adding credentials or permissions) to that same application within 30 minutes. This behavior is indicative of an adversary attempting to gain persistent, elevated access to an application's service principal to manipulate its configuration or permissions.
This rule detects when a non-privileged user adds a new owner to an Azure AD Application or Service Principal, followed by a suspicious modification (such as adding credentials or permissions) to that same application within 30 minutes. This behavior is indicative of an adversary attempting to gain persistent, elevated access to an application's service principal to manipulate its configuration or permissions.
This rule detects scenarios where a new credential (password or key) is added to a service principal or application, followed by an authentication event using that service principal within a short window (1 hour). This pattern is indicative of potential credential injection or persistence attempts, where an attacker adds a secret and immediately leverages it to establish access.
This rule detects scenarios where a new credential (password or key) is added to a service principal or application, followed by an authentication event using that service principal within a short window (1 hour). This pattern is indicative of potential credential injection or persistence attempts, where an attacker adds a secret and immediately leverages it to establish access.
Detects the creation of an AWS IAM access key (CreateAccessKey) for the root account or identities with administrative naming conventions. This activity can indicate persistence establishment by an attacker who has gained high-privileged access, as new access keys provide a durable way to maintain programmatic control that bypasses standard session-based security controls.
This rule detects when new credentials (secrets or certificates) are added to an Azure Active Directory Service Principal. It flags this activity as suspicious if it occurs outside of typical business hours or if it exhibits signs of 'rapid re-keying', where multiple credentials are added to the same service principal within a 24-hour window. This behavior is a common indicator of persistence maintenance or credential rotation to support unauthorized access.
This rule monitors Office 365 management logs for device registration or join events in Azure Active Directory where the resulting device state is flagged as both non-compliant and unmanaged, despite having a 'Workplace' or 'AzureAd' trust type. It further aggregates these events by user to identify potential suspicious patterns, such as bulk registrations or rapid activity within a 30-minute window, which may indicate account compromise or unauthorized device enrollment.
Detects instances where a user account that has been flagged as risky (e.g., unfamiliar features, impossible travel, or malicious IP activity) performs a modification or registration of multi-factor authentication (MFA) security information within a short timeframe (30 minutes). This behavior is highly indicative of an adversary attempting to establish persistence or bypass authentication controls after a credential compromise.
Detects a sequence of events where a user performs a risky or anomalous login to Azure AD, such as from an anonymous network or an non-compliant device, followed shortly after by the registration of a new MFA method or security information. This behavior is indicative of an attacker who has compromised credentials and is attempting to establish persistence or bypass authentication controls by enrolling their own MFA device.
Detects modifications to IAM role trust policies (UpdateAssumeRolePolicy) or the creation of new roles (CreateRole) where the Principal is configured with a wildcard or generic open access. This configuration enables any AWS account to assume the role, representing a significant risk for privilege escalation and persistence establishment by attackers.
Detects 'CreateAccessKey' API calls in AWS CloudTrail where the principal making the request is different from the target IAM user. This pattern is commonly associated with persistence mechanisms where an attacker creates additional access keys on legitimate administrator accounts to maintain stealthy access.
Detects a successful self-service password reset followed shortly by an authentication method change on the same account -- the exact SSPR-then-MFA-reregistration sequence used by Storm-3068 and Storm-2949 for persistence.
Hardened before submission: switched TargetResources[0] positional indexing to mv-expand + type == "User" matching, consistent with the fix already applied to the Agent User group-membership rule.
MITRE ATT&CK: T1098.005 (Account Manipulation: Device Registration), T1556 (Modify Authentication Process)
Hardened before submission: switched TargetResources[0] positional indexing to mv-expand + type == "User" matching, consistent with the fix already applied to the Agent User group-membership rule.
MITRE ATT&CK: T1098.005 (Account Manipulation: Device Registration), T1556 (Modify Authentication Process)
Detects potential help-desk impersonation or social engineering activity involving account credential or MFA method resets, followed shortly by a sign-in from an unknown device or geography. The rule excludes activity tied to established ticketing systems or standard automated password expiration processes.
Detects potential help-desk impersonation or social engineering activity involving account credential or MFA method resets, followed shortly by a sign-in from an unknown device or geography. The rule excludes activity tied to established ticketing systems or standard automated password expiration processes.
Detects unauthorized privilege escalation for AI agent identities within an orchestration platform. The rule triggers when an AI agent account receives an IAM role change, API scope grant, or tool permission update that lacks a corresponding human-approval audit event, or occurs shortly after the agent generates logs indicating potential prompt injection or anomalous behavior.
Detects the creation of scheduled tasks, recurring jobs, or webhook subscriptions by a user identity flagged as an AI_AGENT. This activity is monitored for persistence, especially when the event lacks a descriptive context or targets external networks, suggesting potential unauthorized agent behavioral drift or malicious persistence.
Detects a suspicious sequence of events where a user's registered phone number or recovery contact method is updated, followed shortly by an MFA factor reset or new factor enrollment. This pattern is a common indicator of a SIM-swap attack, where an attacker intercepts SMS-based MFA codes after hijacking the victim's phone number.
Detects a suspicious sequence of identity-related operations performed by a single user within a 2-hour window. The chain consists of a password reset, MFA method modification, new device registration, and a subsequent privilege escalation event (such as role assignment or application consent). This pattern is consistent with helpdesk-vishing campaigns often used by threat actors like Scattered Spider to perform full account takeovers.
Page 4 of 29