Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
62 detections
Filters
Last updated
All Time
Detection languages
41
10
7
2
1
Contributors
27
8
6
6
2
Categories
21
21
19
17
16
Platforms
39
9
8
8
5
Products / Services
20
18
16
11
6
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
1
1
1
1
IDS Classtypes
1
IDS Protocols
1
This rule identifies successful user sign-ins originating from IP addresses known to belong to VPN services. It leverages an external list of VPN IP ranges to correlate with Azure AD SigninLogs. This can indicate an attempt to bypass geo-restrictions, hide true origin, or could be legitimate use of a VPN by an employee.
This rule detects suspicious activity related to Azure Active Directory service principals. It specifically looks for a service principal performing multiple (5 or more within an hour) 'Add service principal', 'Add owner to application', or 'Add permission grant' operations. This pattern could indicate an attacker attempting to escalate privileges or establish persistence within an Azure AD environment by manipulating service principals and application permissions.
This rule detects suspicious activity related to Azure Active Directory service principals. It specifically looks for a service principal performing multiple (5 or more within an hour) 'Add service principal', 'Add owner to application', or 'Add permission grant' operations. This pattern could indicate an attacker attempting to escalate privileges or establish persistence within an Azure AD environment by manipulating service principals and application permissions.
This rule identifies successful user sign-ins originating from IP addresses known to belong to VPN services. It leverages an external list of VPN IP ranges to correlate with Azure AD SigninLogs. This can indicate an attempt to bypass geo-restrictions, hide true origin, or could be legitimate use of a VPN by an employee.
This rule detects repeated successful operations related to public access or firewall configuration changes within Azure Activity Logs. A high count (3 or more) of such operations by the same caller within an hour could indicate malicious activity, such as an attacker attempting to open up network access to compromised resources or exfiltrate data.
This rule detects suspicious application consent activity in Azure AD. It identifies instances where a user successfully grants consent to three or more applications within a one-hour window. This behavior can indicate an adversary attempting to gain access to resources by tricking users into consenting to malicious applications.
This rule detects multiple attempts (10 or more within an hour) from a single IP address to access administrative interfaces on a web server. It specifically looks for URI queries containing keywords like 'admin', 'wp-admin', or 'administrator' in W3CIISLog data. Such activity often indicates a brute-force attack or scanning for administrative login pages.
Detects an unusually high volume (100 or more within an hour) of API calls (POST, DELETE, PUT methods to URIs containing 'api') originating from a single IP address. This activity could indicate various malicious behaviors such as brute-force attacks, credential stuffing, web application attacks, or a denial-of-service attempt against the API endpoint.
This rule detects a high volume (50 or more) of HTTP errors (status codes 400 and above) originating from a single client IP address within a 5-minute time window. This behavior can be indicative of various malicious activities such as brute-force attacks, web application vulnerability scanning, or denial-of-service attempts against a web server.
This rule detects a spike in modifications or creations of Azure Diagnostic Settings within a one-hour window. A high volume of 'Diagnostic Setting' operations by a single caller could indicate an attempt to alter logging configurations, potentially to impair defenses or hide malicious activity.
This rule detects a high volume of web requests (20 or more within 5 minutes from a single IP address) containing keywords commonly associated with denial-of-service (DoS) attacks, performance testing, or reconnaissance activities against web applications. Keywords include 'sleep', 'benchmark', and 'loadtest' in the URI query string.
Detects modification of a storage account network rule set to allow public access, bypass trusted-service checks, or add broad network ranges.
Detects modification of an Azure storage account network rule set to allow public access, bypass trusted-service checks, or add broad network ranges. This could indicate an attacker attempting to gain broader access to sensitive data stored in Azure Storage.
Detects external HTTP POST requests to vulnerable Oracle PeopleSoft Environment Management Hub (PSEMHUB) and Integration Broker endpoints. This behavior is associated with UNC6240 (ShinyHunters) zero-day exploitation of CVE-2026-35273.
Detects bulk export of Confluence wiki content
This rule detects repeated successful operations related to public access or firewall configuration changes within Azure Activity Logs. A high count (3 or more) of such operations by the same caller within an hour could indicate malicious activity, such as an attacker attempting to open up network access to compromised resources or exfiltrate data.
This rule detects multiple attempts (10 or more within an hour) from a single IP address to access administrative interfaces on a web server. It specifically looks for URI queries containing keywords like 'admin', 'wp-admin', or 'administrator' in W3CIISLog data. Such activity often indicates a brute-force attack or scanning for administrative login pages.
Detects an unusually high volume (100 or more within an hour) of API calls (POST, DELETE, PUT methods to URIs containing 'api') originating from a single IP address. This activity could indicate various malicious behaviors such as brute-force attacks, credential stuffing, web application attacks, or a denial-of-service attempt against the API endpoint.
This rule detects a spike in modifications or creations of Azure Diagnostic Settings within a one-hour window. A high volume of 'Diagnostic Setting' operations by a single caller could indicate an attempt to alter logging configurations, potentially to impair defenses or hide malicious activity.
This rule detects repeated successful operations related to public access or firewall configuration changes within Azure Activity Logs. A high count (3 or more) of such operations by the same caller within an hour could indicate malicious activity, such as an attacker attempting to open up network access to compromised resources or exfiltrate data.
This rule detects a high volume of web requests (20 or more within 5 minutes from a single IP address) containing keywords commonly associated with denial-of-service (DoS) attacks, performance testing, or reconnaissance activities against web applications. Keywords include 'sleep', 'benchmark', and 'loadtest' in the URI query string.
Page 1 of 3