Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
94 detections
Filters
Last updated
All Time
Detection languages
52
10
9
8
8
Contributors
18
14
10
9
6
Categories
73
38
15
15
14
Platforms
53
31
21
13
6
Products / Services
45
21
16
14
10
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
CVEs
2
IDS Classtypes
3
1
IDS Protocols
4
This rule detects anomalous activity involving cloud-based shell services (AWS CloudShell, Azure Cloud Shell, GCP Cloud Shell). It triggers on two main conditions: (1) First-time usage of these shell environments by a principal within the detection window, and (2) The execution of commands associated with data staging, ingress tool transfer, or exfiltration (e.g., curl, wget, storage copy commands).
This rule detects anomalous activity involving cloud-based shell services (AWS CloudShell, Azure Cloud Shell, GCP Cloud Shell). It triggers on two main conditions: (1) First-time usage of these shell environments by a principal within the detection window, and (2) The execution of commands associated with data staging, ingress tool transfer, or exfiltration (e.g., curl, wget, storage copy commands).
This rule detects the initialization of an AWS CloudShell environment or session where Multi-Factor Authentication (MFA) was not explicitly recorded in the event data. Unauthorized access to CloudShell can provide an adversary with a command-line interface to interact with AWS APIs, potentially facilitating further malicious activities.
Detects the use of AWS CloudShell to execute commands that download or install external files (e.g., using curl, wget, pip, or git), excluding those originating from known approved sources such as AWS-owned domains or standard package registries. This behavior may indicate an adversary attempting to download offensive tooling or backdoors into the cloud environment.
Detects the execution of the roadtx command-line utility, which is a component of the ROADtools framework used for OAuth device code flow interaction and token acquisition within Entra ID (formerly Azure AD) environments.
Detects Microsoft Graph API requests that query directory role assignments specifically looking for highly privileged roles such as Global Administrator, Exchange Administrator, or Security Administrator. This activity may indicate an adversary is enumerating privileged roles to identify potential targets for privilege escalation or lateral movement within an Azure/Microsoft 365 environment.
This rule detects potentially malicious reconnaissance or enumeration activity by identifying a high volume of Microsoft Graph API requests (GET requests) to sensitive directory endpoints (users, groups, directoryRoles, servicePrincipals) from a single application identity (AppId) and IP address within a short time window.
This rule detects potential reconnaissance activity in Microsoft 365 environments by monitoring Graph API requests. It specifically looks for large-scale user enumeration patterns or queries containing keywords associated with HR, payroll, or sensitive financial information, often indicative of an adversary attempting to identify high-value targets. The detection focuses on both standard 'List' operations and specific URI patterns used for bulk data extraction.
This rule detects potentially malicious reconnaissance or enumeration activity by identifying a high volume of Microsoft Graph API requests (GET requests) to sensitive directory endpoints (users, groups, directoryRoles, servicePrincipals) from a single application identity (AppId) and IP address within a short time window.
Detects automated enumeration patterns via the Microsoft Graph API, specifically targeting bulk directory pulls (requests with $top=999) and keyword-based searches for sensitive organizational data (payroll, HR, finance). This rule aggregates activity by user session to identify suspicious volumes and diversity of requests.
Detects the use of PowerShell to perform automated reconnaissance against Microsoft Graph API endpoints, specifically targeting HR, payroll, and personal user data. This activity is associated with post-compromise behaviors seen in campaigns like Payroll Pirate, where attackers utilize compromised credentials to harvest sensitive organizational information.
This rule detects potential Remote Code Execution (RCE) attempts leveraging Velocity Template Language (VTL) injection vulnerabilities within AWS API Gateway. It monitors logs for specific indicators, including references to 'ProcessBuilder', malicious template artifacts, and exploitation patterns associated with the 'floci-apigateway-vtl-rce-poc' exploit.
Detects the execution of AWS CLI commands typically used for cloud resource enumeration (e.g., listing users, roles, buckets, or identity information) when spawned by common development environments, IDEs, or shell interpreters. This rule is designed to identify potential post-exploitation activity where an attacker uses compromised developer credentials or environments to map the cloud infrastructure.
This rule monitors ServiceNow API traffic for high-volume requests originating from unauthenticated or guest accounts, particularly outside of standard business hours. It uses time-windowed aggregation to detect potential brute force, unauthorized scanning, or enumeration attempts against the ServiceNow platform.
Detects potential Velocity Template Language (VTL) injection attacks targeting API Gateway environments. The rule identifies suspicious payloads in HTTP request bodies or URLs that attempt to leverage Java-based classes (e.g., ProcessBuilder) for code execution. It also monitors for IAM scope bypass attempts, abnormal HTTP method/path combinations associated with API Gateway control-plane operations, and evidence of shell/system commands being spawned from API Gateway-related parent processes.
Detects high-volume Microsoft Graph API and SCIM endpoint enumeration consistent with employee directory scraping, potentially by threat groups like BlackFile/Cordial Spider. This rule identifies suspicious activity based on a high count of directory queries or distinct URIs accessed within a short time frame, originating from non-Microsoft/Google/Amazon/IBM ASNs and using common scripting/API user agents.
Detects the successful creation or update of an Azure API Management Service. This activity could indicate legitimate administrative actions or, if unexpected, potential unauthorized access or privilege escalation within the Azure environment. Monitoring these events can help identify suspicious configuration changes or resource provisioning by malicious actors.
Detects the execution of 'aws sts get-caller-identity' from unexpected or potentially suspicious parent processes such as Node.js, bash/sh, or IDE-related processes like VS Code or Amazon Q. This command is often used by developers to confirm identity, but when triggered from these contexts, it may indicate unauthorized access or exploration by an adversary operating within a development environment.
Detects ROPC (Resource Owner Password Credentials) token requests to Microsoft Graph using specific client IDs associated with Microsoft To-Do or Intune Company Portal. This activity could indicate an attempt to bypass MFA via hidden Conditional Access policy exclusions, as described in CVE-2025-0309.
This rule detects the creation of Temporary Access Passes (TAPs) via the Microsoft Graph API targeting highly privileged accounts. This activity could indicate an attacker abusing a service principal with UserAuthMethod-TAP.ReadWrite.All permissions to gain temporary access to critical accounts like Global Administrators, Privileged Role Administrators, or Security Administrators. The rule specifically looks for POST requests to the 'temporaryAccessPassMethods' endpoint in Microsoft Graph Activity Logs and correlates this with IdentityInfo to identify if the target user holds a privileged role.
Detects suspicious app installations, custom app creation, and bot additions within Microsoft Teams. This rule identifies activities such as sideloaded app installations, which can bypass standard vetting processes and serve as a persistence mechanism for attackers. It also flags custom app creation outside of typical development teams, which could indicate the deployment of command and control (C2) bots or data exfiltration applications. Additionally, the rule looks for the addition of bots to teams and suspicious keywords in app names that might suggest impersonation or malicious tooling.
Page 1 of 5