Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
367 detections
Filters
Last updated
All Time
Detection languages
171
65
41
41
18
Contributors
101
83
33
27
23
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
169
130
61
58
30
Products / Services
99
99
98
51
32
MITRE Techniques
348
205
152
112
107
CVEs
5
4
1
1
1
IDS Classtypes
1
IDS Protocols
1
This rule detects scenarios where an external user is invited to an Azure AD tenant and subsequently granted a highly privileged role (such as Global Administrator or User Administrator) within a short window of time (1 hour). This pattern is indicative of potential persistence establishment or privilege escalation by an adversary using guest accounts.
This detection identifies when users are added to privileged Active Directory
groups by leveraging the Windows Security Event Code 4728 along with a lookup
of privileged AD groups provided by Splunk Enterprise Security.
Attackers often add user accounts to privileged AD groups to escalate privileges
or maintain persistence within an Active Directory environment.
Monitoring for modifications to privileged groups can help identify potential security breaches
and unauthorized access attempts.
groups by leveraging the Windows Security Event Code 4728 along with a lookup
of privileged AD groups provided by Splunk Enterprise Security.
Attackers often add user accounts to privileged AD groups to escalate privileges
or maintain persistence within an Active Directory environment.
Monitoring for modifications to privileged groups can help identify potential security breaches
and unauthorized access attempts.
Detects high-privilege IAM role assignments in Google Cloud Platform and Microsoft Azure environments. The rule specifically monitors for assignments of overly permissive roles (e.g., Owner, Global Administrator, or wildcard actions) that could allow for full environment compromise or persistence.
Detects the assignment of high-privilege application permissions (e.g., Mail.ReadWrite, full_access_as_app, Files.ReadWrite.All, Sites.FullControl.All) to a service principal. This pattern is indicative of an attacker who has compromised an Application Administrator account and is attempting to establish long-term, unattended access to cloud resources such as mailboxes and SharePoint sites via OAuth client-credential flows.
Detects when a high-privileged administrative role is assigned to an Azure Service Principal. This technique is often used for persistent, stealthy control over a tenant, as service principals are not subjected to user-centric access reviews or MFA challenges. The rule triggers on both permanent and PIM-eligible role assignments.
Detects when a user is added as an owner to an Azure AD Application or Service Principal, specifically highlighting instances where the new owner does not currently hold a privileged directory role. This pattern is often used as a persistence mechanism to maintain long-term access to an environment without requiring high-level administrative credentials.
Detects when a Service Principal is assigned to a highly privileged administrative role in Azure Active Directory (Entra ID). This activity can be an indicator of an adversary establishing persistence or escalating privileges by leveraging non-human identities.
Detects the assignment of highly privileged Azure AD/Entra ID directory roles (e.g., Global Administrator, Application Administrator) to a service principal. Assigning such roles to service principals is a common persistence technique, as these identities can be used to bypass conditional access policies and MFA through non-interactive authentication methods like client credentials.
Detects the assignment of high-privilege directory roles (e.g., Global Administrator) to a user account, where the initiator's sign-in session is identified as anomalous. Anomalous indicators include non-interactive sign-in, unknown/untrusted device state, elevated risk score, or activity occurring outside of configured business hours.
Detects the assignment of high-privilege directory roles (e.g., Global Administrator) to a user account, where the initiator's sign-in session is identified as anomalous. Anomalous indicators include non-interactive sign-in, unknown/untrusted device state, elevated risk score, or activity occurring outside of configured business hours.
Detects the assignment of high-privilege Entra ID directory roles (e.g., Global Administrator) to identities that either have a recent risky sign-in history or were created within the last 48 hours. This pattern is indicative of privilege escalation following account compromise or the creation of backdoored accounts by an attacker. Assignments including change management tracking tags are excluded to reduce noise.
Detects the assignment of high-privilege roles to cloud user accounts in Entra ID, AWS, or GCP when that assignment is preceded by anomalous sign-in behavior (high-risk or failed authentication) within 24 hours, or when the account appears to be dormant (no activity in 90+ days) prior to the privilege assignment.
Detects a suspicious sequence of identity-related operations in Azure AD, characterized by the modification of authentication methods policies followed by rapid application or service principal registration, consent granting, or role assignments by the same actor within a 10-minute window. This behavior often indicates an adversary attempting to establish persistence or escalate privileges via malicious OAuth applications or service principals after weakening security posture.
Detects a suspicious sequence of identity-related operations in Azure AD, characterized by the modification of authentication methods policies followed by rapid application or service principal registration, consent granting, or role assignments by the same actor within a 10-minute window. This behavior often indicates an adversary attempting to establish persistence or escalate privileges via malicious OAuth applications or service principals after weakening security posture.
Detects a suspicious sequence of identity-related operations performed by a single user within a 2-hour window. The chain consists of a password reset, MFA method modification, new device registration, and a subsequent privilege escalation event (such as role assignment or application consent). This pattern is consistent with helpdesk-vishing campaigns often used by threat actors like Scattered Spider to perform full account takeovers.
Detects a suspicious pattern consistent with rapid handoff from an initial access broker to an operator: a user account is added to a privileged group (e.g., Domain Admins) followed within 5 minutes by successful logins to 3 or more distinct hosts. This behavior indicates immediate privilege escalation followed by rapid lateral movement.
Detects anomalous Privileged Identity Management (PIM) role activations in Entra ID that deviate from standard patterns. This includes instances where roles are activated without required approvals, for unusually long durations, or when an account activates multiple distinct roles within a short time frame, potentially indicating account takeover or abuse of standing privileges.
This rule detects when a Service Principal or Application is assigned to highly privileged directory roles within Microsoft Entra ID (formerly Azure AD). Adversaries may perform this action to achieve persistence or escalate privileges within the cloud environment by granting high-level administrative access to a compromised or adversary-controlled service principal.
Detects when a service principal is added as an owner to an application or another service principal. This activity indicates a potential privilege escalation or persistence attempt, where a compromised application gains administrative control over other identities or resources within the Azure environment.
Detects when a user is added as an owner to an Azure AD Application or Service Principal, specifically highlighting instances where the new owner does not currently hold a privileged directory role. This pattern is often used as a persistence mechanism to maintain long-term access to an environment without requiring high-level administrative credentials.
Detects the assignment of highly privileged Azure AD/Entra ID directory roles (e.g., Global Administrator, Application Administrator) to a service principal. Assigning such roles to service principals is a common persistence technique, as these identities can be used to bypass conditional access policies and MFA through non-interactive authentication methods like client credentials.
Page 3 of 18