Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8 detections
Filters
Last updated
All Time
Detection languages
7
1
Contributors
3
2
2
1
Categories
6
5
4
3
1
Platforms
6
4
1
Products / Services
6
4
2
1
MITRE Techniques
6
5
2
2
1
CVEs
71
71
64
58
49
Detects attempts by non-Azure Arc agent processes to access '.key' files within the Azure Arc Tokens directory. This activity could indicate an attempt to exploit CVE-2026-26117 or other credential access techniques targeting Azure Arc service principal tokens.
Detects attempts by non-Azure Arc agent processes to access '.key' files within the Azure Arc Tokens directory. This activity could indicate an attempt to exploit CVE-2026-26117 or other credential access techniques targeting Azure Arc service principal tokens.
This rule identifies Azure Arc-enabled machines running agent versions older than 1.61, which are potentially vulnerable to CVE-2026-26117. It queries Azure Activity logs to extract agent versions and flags machines with outdated agents.
This rule detects unusual modifications to Azure Arc machine identities or Role-Based Access Control (RBAC) assignments following local activity. It specifically looks for 'Write', 'Update', or 'Assign' operations on resources within the 'Microsoft.HybridCompute' resource provider where the properties include 'identity' or 'roleAssignment'. This could indicate an attempt to establish persistence or escalate privileges on hybrid machines.
Detects attempts by non-Azure Arc agent processes to access '.key' files within the Azure Arc Tokens directory. This activity could indicate an attempt to exploit CVE-2026-26117 or other credential access techniques targeting Azure Arc service principal tokens.
This rule detects privilege escalation events associated with Azure Arc agent processes. It monitors for specific Windows Security Event IDs (4672, 4673, 4674, 4688) where the involved process or its parent is an Azure Arc agent process (himds.exe, azcmagent.exe, gc_worker.exe, gc_service.exe) and the SubjectUserName is not a standard system account. This helps identify potential attempts to elevate privileges using or targeting the Azure Arc agent.
Detects attempts by non-Azure Arc agent processes to access '.key' files within the Azure Arc Tokens directory. This activity could indicate an attempt to exploit CVE-2026-26117 or other credential access techniques targeting Azure Arc service principal tokens.
Detects command line executions from non-standard applications attempting to query the local Azure Arc metadata endpoints (ports 40341/40342), which may indicate an attacker enumerating or exploiting the HIMDS token service (CVE-2026-26117).
