Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
367 detections
Filters
Last updated
All Time
Detection languages
171
65
41
41
18
Contributors
101
83
33
27
23
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
169
130
61
58
30
Products / Services
99
99
98
51
32
MITRE Techniques
348
205
152
112
107
CVEs
5
4
1
1
1
IDS Classtypes
1
IDS Protocols
1
Detects the assignment of highly privileged Azure AD/Entra ID directory roles (e.g., Global Administrator, Application Administrator) to a service principal. Assigning such roles to service principals is a common persistence technique, as these identities can be used to bypass conditional access policies and MFA through non-interactive authentication methods like client credentials.
Detects the assignment of highly privileged Azure AD/Entra ID directory roles (e.g., Global Administrator, Application Administrator) to a service principal. Assigning such roles to service principals is a common persistence technique, as these identities can be used to bypass conditional access policies and MFA through non-interactive authentication methods like client credentials.
This rule detects instances where a user successfully activates a privileged role via Privileged Identity Management (PIM) in a cloud environment, despite the activation policy requiring approval. It flags cases where the 'Add member to role completed' event indicates that approval is required, but the 'approvalStatus' is absent, suggesting an attempt to bypass the formal approval workflow.
This rule detects instances where a user successfully activates a privileged role via Privileged Identity Management (PIM) in a cloud environment, despite the activation policy requiring approval. It flags cases where the 'Add member to role completed' event indicates that approval is required, but the 'approvalStatus' is absent, suggesting an attempt to bypass the formal approval workflow.
This rule detects Entra ID Privileged Identity Management (PIM) role activations that occur with missing or generic justification, correlated with a sign-in session that has been flagged as risky (high/medium risk) or non-interactive. This combination suggests a potential session hijacking scenario where an adversary is attempting to elevate privileges using a compromised, legitimate user session.
Detects when a user account assigned to a highly privileged directory or cloud role performs the assignment shortly after exhibiting signs of compromise, such as risky sign-ins, anomalous locations, or suspected session token reuse.
Detects Microsoft Entra ID (formerly Azure AD) PIM or Just-In-Time role activations that occur without a proper approval workflow, are self-approved, or coincide with identified risky sign-in signals.
Detects when a user account assigned to a highly privileged directory or cloud role performs the assignment shortly after exhibiting signs of compromise, such as risky sign-ins, anomalous locations, or suspected session token reuse.
Detects Microsoft Entra ID (formerly Azure AD) PIM or Just-In-Time role activations that occur without a proper approval workflow, are self-approved, or coincide with identified risky sign-in signals.
This rule detects when a user is assigned a highly privileged role in Azure AD (e.g., Global Administrator, Security Administrator) shortly after that user has performed a sign-in event flagged as risky. This behavior is a strong indicator of account takeover or malicious privilege escalation within the cloud environment.
Detects the assignment of a highly privileged administrative or directory role to a user or service principal following a high-risk or anomalous sign-in event. This pattern is indicative of potential session hijacking where an adversary attempts to escalate privileges within a cloud environment after gaining initial access to a compromised account.
Detects 'Add member to role' operations in Entra ID where high-privileged directory roles are assigned to a user or service principal. This pattern is often a critical indicator of privilege escalation in account compromise scenarios where an attacker attempts to elevate their own or a secondary account's permissions within the tenant.
Flags Global Administrator / Privileged Role Administrator role grants occurring within one hour of a password/MFA reset or TAP issuance on the same account — the terminal step of a completed helpdesk-vishing takeover.
Detects the creation of a new local user account named 'ops' or an account with 'full' group privileges on MikroTik RouterOS. This rule is designed to identify potential persistence mechanisms following the exploitation of MikroTrick vulnerabilities (CVE-2026-67279/CVE-2026-86060), often indicated by anomalous prior login patterns.
Detects when a user account assigned to high-privileged roles (Global Administrator or Authentication Policy Administrator) performs sensitive operations such as application registration, service principal creation, or modifications to authentication policies within a short timeframe (4 hours) of a successful sign-in. This activity is often associated with the initial setup phases of MFA bypass or persistence techniques in Entra ID.
Detects high-risk administrative actions in Entra ID, such as role assignments, user creation, or password resets, occurring shortly after a user authenticates using the device code flow. This pattern is indicative of a post-compromise takeover where an adversary utilizes a stolen or coerced device code session to escalate privileges.
Detects the creation of a new local account that is immediately followed by (or associated with) execution from a process identified as an AI development or agent-based tool (e.g., Cursor, GitHub Copilot, Ollama). The rule correlates process creation events with Windows Security Event ID 4720 (User account created) and optionally checks for subsequent addition to the local Administrators group. This logic aims to surface potential unauthorized credential creation triggered by automated AI coding assistants or LLM-driven workflows.
Detects the addition of new members to a GitHub organization or team outside of standard business hours. This behavior is correlated with potential subsequent grants of repository administrative access or read access to secrets, characteristic of attacker patterns attempting to gain unauthorized access to cloud environments and OAuth tokens via CI/CD pipelines or VCS platforms.
Detects the creation of a local user account and its subsequent addition to the local Administrators group via PowerShell cmdlets (New-LocalUser, Add-LocalGroupMember) triggered by the ConfigurationRemotingServer.exe process. This activity is indicative of abuse of the WinGet Desired State Configuration (DSC) 'Script' resource to establish persistent administrative access.
This rule monitors for potential privilege escalation activity occurring shortly after an initial authentication event. It includes two primary vectors: 1) Azure AD users assigned to highly privileged roles shortly after a successful sign-in; 2) Users performing interactive or remote logons to Linux/Unix systems followed quickly by sudo or su commands to obtain root privileges.
This rule detects a correlation between a successful user login from an IP address not previously seen for that specific user in the last 14 days, followed immediately (within 1 hour) by sensitive administrative operations performed by the same user, such as adding members to roles or modifying application permissions.
Page 4 of 18