Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
94 detections
Filters
Last updated
All Time
Detection languages
52
10
9
8
8
Contributors
18
14
10
9
6
Categories
73
38
15
15
14
Platforms
53
31
21
13
6
Products / Services
45
21
16
14
10
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
CVEs
2
IDS Classtypes
3
1
IDS Protocols
4
The analytic detects a spike in the number of API calls made to cloud infrastructure by a user. It leverages cloud infrastructure logs and compares the current API call volume against a baseline probability density function to identify anomalies. This activity is significant because an unusual increase in API calls can indicate potential misuse or compromise of cloud resources. If confirmed malicious, this could lead to unauthorized access, data exfiltration, or disruption of cloud services, posing a significant risk to the organization's cloud environment.
The analytic detects cloud API calls executed by user roles that have not previously run these commands. It leverages the Change data model in Splunk to identify commands executed by users with the user_type of AssumedRole and a status of success. This activity is significant because new commands from different user roles can indicate potential malicious activity or unauthorized actions. If confirmed malicious, this behavior could lead to unauthorized access, data breaches, or other damaging outcomes by exploiting new or unmonitored commands within the cloud environment.
The following analytic detects a spike in the number of API calls made to cloud security groups by a user. It leverages data from the Change data model, focusing on successful firewall-related changes. This activity is significant because an abnormal increase in security group API calls can indicate potential malicious activity, such as unauthorized access or configuration changes. If confirmed malicious, this could allow an attacker to manipulate security group settings, potentially exposing sensitive resources or disrupting network security controls.
The analytic detects the creation of a new API token within an Okta tenant. It uses OktaIm2 logs ingested via the Splunk Add-on for Okta Identity Cloud to identify events where the `system.api_token.create` command is executed. This activity is significant because creating a new API token can indicate potential account takeover attempts or unauthorized access, allowing an adversary to maintain persistence. If confirmed malicious, this could enable attackers to execute API calls, access sensitive data, and perform administrative actions within the Okta environment.
This rule detects GET requests to the Microsoft Graph API's '/v1.0/groups' endpoint. This activity can indicate an adversary enumerating groups within an Azure Active Directory environment, potentially using tools like GraphRunner's 'Get-DynamicGroups' function or similar custom scripts. Successful requests (HTTP 200) are specifically targeted.
This rule identifies enumeration of user inboxes within an Entra ID tenant via the Microsoft Graph API. It specifically looks for multiple GET requests to the `/v1.0/users/*/mailFolders/Inbox/messages` endpoint from a single IP address and session within a 5-minute window. The detection is based on the behavior of tools like Invoke-GraphOpenInboxFinder in GraphRunner, but is applicable to any tool performing similar inbox scanning. The rule provides outcomes detailing the number of scanned users, successful accesses (HTTP 200), forbidden accesses (HTTP 403), and not found inboxes (HTTP 404).
This rule detects multiple failed attempts (401 Unauthorized status) to download the same file from OneDrive via the Microsoft Graph API. This behavior may indicate a permissions issue for the user attempting the download or could be an indicator of an adversary attempting to access unauthorized files.
This rule detects requests to the Microsoft Graph API endpoint for listing applications (https://graph.microsoft.com/v1.0/applications). This activity can be indicative of reconnaissance by an attacker attempting to enumerate applications within an Entra ID (Azure AD) environment. The rule specifically looks for successful GET requests (HTTP 200 response code) to this endpoint.
This rule detects calls to the undocumented 'Estimate Access' API in Microsoft Graph. This API is used by tools like GraphRunner for reconnaissance purposes, specifically to determine what actions a user can perform. While not inherently malicious, its use can indicate an adversary attempting to enumerate permissions or discover accessible resources within an Azure environment. The rule filters for successful POST requests to the specific beta endpoint and excludes certain Microsoft IP ranges to reduce false positives.
This rule detects attempts to enumerate updatable groups within Microsoft Entra ID (formerly Azure Active Directory) using the Microsoft Graph API. Specifically, it looks for a combination of a GET request to the `/v1.0/groups` endpoint and a POST request to the `/beta/roleManagement/directory/estimateAccess` endpoint within a 5-minute window from the same IP address and session. This activity is indicative of tools like GraphRunner's `Get-UpdatableGroups` function, which adversaries might use to identify groups they can modify for privilege escalation or persistence.
Page 5 of 5