Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,235 detections
Filters
Last updated
All Time
Detection languages
734
214
105
78
51
Contributors
206
187
159
111
90
Categories
396
296
264
260
247
Platforms
492
314
281
204
110
Products / Services
379
234
152
109
106
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,235
CVEs
9
9
4
4
4
IDS Classtypes
11
6
4
2
1
IDS Protocols
10
5
3
This rule detects when guest users are invited to the tenant by individuals who are not on an approved list of inviters. This helps identify unauthorized or suspicious external user invitations that could lead to unauthorized access or compromise.
This rule identifies instances where a user has been assigned a privileged role within Azure Active Directory (now Microsoft Entra ID) but is not actively using that role. This is detected by monitoring 'redundantAssignmentAlertIncident' risk events from the Azure PIM (Privileged Identity Management) service. Such alerts can indicate over-privileged accounts, potential misconfigurations, or accounts that could be targeted for privilege escalation if compromised.
Detects when a user account is created and subsequently deleted within a short period. This behavior can indicate an adversary attempting to establish temporary persistence, perform actions, and then remove traces of their activity to evade detection. It could also be related to privilege escalation attempts where an account is created for a specific task and then removed.
Detects when failed sign-in attempts increase by 10% or greater within Azure AD. This could indicate brute-force attacks, password spraying, or attempts to gain unauthorized access to accounts.
Detects when successful authentications to important applications occur using only single-factor authentication. This could indicate a weakened security posture for critical resources or a bypass of expected multi-factor authentication policies.
This rule identifies suspicious activity related to Security Assertion Markup Language (SAML) in AWS. Specifically, it looks for two events: `AssumeRoleWithSAML` from the `sts.amazonaws.com` service and `UpdateSAMLProvider` from the `iam.amazonaws.com` service. An adversary could leverage these actions to gain unauthorized access, establish persistence, or escalate privileges within an AWS environment by manipulating SAML providers or assuming roles via SAML.
Detects when a user account is added to the local 'Administrators' group on a Windows system. This activity is critical for privilege escalation and persistence, as it grants the added user administrative rights. While it can be a legitimate administrative action, it is also a common technique used by attackers to maintain control and elevate privileges after initial compromise.
This rule detects failed attempts to elevate privileges (PIM activation) in Azure Active Directory from devices that are not designated as Privileged Access Workstations (PAW) or Secure Access Workstations (SAW). It specifically looks for messages indicating 'Add member to role completed (PIM activation)' in the sign-in logs, combined with conditions that identify non-compliant devices, unapproved IP addresses, unapproved countries, or unapproved device information. The rule is designed to flag suspicious privilege elevation attempts that originate from unauthorized or untrusted environments, which could indicate a compromised account or an attempt to bypass security controls.
This rule identifies when an admission controller is executed in Azure Kubernetes. Admission controllers intercept and potentially modify requests to the Kubernetes API server. Adversaries can leverage admission webhooks (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) for persistence, such as injecting malicious containers into pods or intercepting API requests to steal credentials and sensitive information.
Detects suspicious administrative activities on F5 BIG-IP devices, such as failed logins or configuration changes. This is based on recommendations from F5 in response to a security incident disclosed in October 2025 where a threat actor gained access to BIG-IP development environments. F5 advised customers to enhance monitoring for admin logins, failed authentications, and privilege and configuration changes.
Identifies when an account in a privileged role has not signed in for a specified number of days, indicating a potentially stale or unused privileged account. Such accounts can be a security risk if compromised, as they might not be actively monitored.
This rule detects unusual authentication interruptions in Azure Active Directory sign-in logs. Specifically, it looks for three types of ResultType and ResultDescription combinations: '50097 - Device authentication is required', '50155 - DeviceAuthenticationFailed', and '50158 - ExternalSecurityChallenge - External security challenge was not satisfied'. These events indicate that an authentication attempt was interrupted or failed due to device-related issues or an unmet external security challenge, which could be indicative of an adversary attempting to bypass authentication mechanisms or encountering unexpected security controls.
Detects suspicious processes attempting to log on with explicit credentials (Event ID 4648). This rule specifically targets common command-line utilities like cmd.exe, powershell.exe, wmic.exe, net.exe, and reg.exe when they are used to explicitly log on, while filtering out localhost connections and service accounts (users ending with '$') to reduce false positives. This behavior can indicate an adversary attempting to escalate privileges or move laterally using compromised credentials.
Detects failed sign-in attempts for privileged roles where the user does not meet expected security controls, such as signing in from an unapproved country, IP address, or device. This rule helps identify potential unauthorized access attempts to administrative accounts.
Identifies when the same privilege role has multiple activations by the same user, which could indicate an attempt to bypass time-based access restrictions or an adversary repeatedly activating a role for malicious purposes. This alert is triggered by the 'sequentialActivationRenewalsAlertIncident' risk event type in Azure PIM.
This rule identifies an event where the number of accounts assigned the Global Administrator role in Azure Active Directory (now Microsoft Entra ID) exceeds a predefined threshold. This is detected by monitoring the 'tooManyGlobalAdminsAssignedToTenantAlertIncident' risk event type from Azure PIM (Privileged Identity Management). A high number of Global Administrators can increase the attack surface and risk of privilege abuse or compromise.
Detects when a user successfully logs on to sanctioned applications from an IP address identified as risky by Microsoft Cloud App Security. This indicates a potential compromise of the user's account or an attempt to access resources from an unusual and potentially malicious location.
Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.
This rule detects the execution of the 'Reset-ComputerMachinePassword' PowerShell cmdlet. This cmdlet is used to change the computer account password that systems use to authenticate to domain controllers. Malicious use of this cmdlet can indicate an attempt to reset the local computer's password, potentially for privilege escalation, persistence, or defense evasion, as seen in some Qbot and ZeroLogon attacks.
This detection identifies when a user successfully authenticates from a country for the first time within a given period. It establishes a baseline of known countries for each user and alerts on any successful login originating from a country not present in that baseline. This behavior can indicate compromised credentials being used from an unusual location, or a legitimate user traveling to a new country.
This rule detects suspicious failed logon attempts by monitoring specific uncommon error codes. These error codes indicate issues such as logons to disabled accounts, attempts outside authorized hours, from unauthorized workstations, or due to trust relationship failures or insufficient logon rights. Such failures can suggest an adversary attempting to bypass security controls or test account validity and permissions.
Page 44 of 59