Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,088 detections
Filters
Last updated
All Time
Detection languages
619
191
113
86
47
Contributors
302
211
112
88
54
Categories
481
416
353
192
164
Platforms
726
348
216
136
57
Products / Services
518
292
197
124
88
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,088
CVEs
5
5
5
5
4
IDS Classtypes
3
2
1
1
IDS Protocols
3
This rule identifies successful sign-in events using the Azure CLI application where multi-factor authentication (MFA) was not enforced. This is a potential indicator of a misconfiguration where sensitive cloud management interfaces are accessible via single-factor authentication, or a sign of an adversary attempting to leverage a less secure authentication pathway.
Detects anomalous, high-volume data retrieval from Salesforce via OAuth-authenticated Connected Apps using SOQL or Bulk API. This behavior is indicative of a compromised integration token being used by an adversary to exfiltrate sensitive CRM data, such as User, Account, Case, or Opportunity records, by bypassing standard user interface workflows.
Detects high-risk operations performed by the Entra ID/AAD Connect synchronization service account (e.g., Sync_* or ADToAADSyncServiceAccount). This account, which often holds broad directory permissions, is a prime target for attackers to gain persistence or escalate privileges within the cloud directory. The rule monitors for unauthorized sign-ins, sensitive configuration changes (such as modifications to federation trust, authentication policies, or directory synchronization settings), and password resets targeting the sync account itself.
This rule detects anomalous sign-in behavior for Azure Service Principals by comparing current activity against a 14-day baseline. It alerts on sign-ins from new ASNs or countries, significant spikes in sign-in volume, or unauthorized access to sensitive resources such as Microsoft Graph, Exchange Online, or Azure Key Vault, while filtering out known cloud egress ranges.
This rule identifies potential account compromise through the detection of non-interactive Azure AD sign-ins originating from geographically distant locations within a short, travel-implausible timeframe. Such activity is highly indicative of the theft and export of a Primary Refresh Token (PRT) from a legitimate endpoint, which is subsequently replayed by an adversary from external infrastructure to gain unauthorized access to cloud resources.
Detects a service principal or application identity performing a burst of deletion operations across multiple Azure resource types, such as Storage Accounts, SQL Databases, Key Vaults, and Function Apps. This behavior is indicative of malicious activity, including potential cloud environment destruction or 'agentic' destructive operations similar to those observed in the Storm-3168 (JADEPUFFER) threat activity.
This rule detects a multi-stage attack chain where a device shows signs of credential theft (accessing browser credential stores or cookies) followed closely by a successful cloud authentication from that same user using a device identifier not previously observed in the last 30 days.
This rule correlates endpoint security alerts for popular information-stealer malware (Lumma, StealC, Vidar, RedLine, Acreed, Atomic Stealer) with subsequent successful cloud identity authentication events from the same user account. The correlation window is set to 72 hours following an endpoint infostealer detection, which suggests potential account takeover or unauthorized access facilitated by credentials stolen from a compromised endpoint.
Detects anomalous large-scale data export operations in Google BigQuery (via jobs.insert or jobs.query) performed by identities (service accounts, API keys) not previously observed in the environment. This activity is indicative of credential abuse where stolen third-party analytics or monitoring service tokens are utilized for illicit data exfiltration, a behavior consistent with tactics employed by threat actors such as ShinyHunters.
Detects a sequence of events indicative of an account takeover (ATO) attack, starting with a help-desk initiated password reset, followed immediately by new MFA factor or device enrollment, and concluding with an application login from an unrecognized device or location.
This rule detects potentially compromised accounts by correlating risky Entra ID sign-ins to Citrix NetScaler with subsequent VPN session establishment followed by rapid, high-volume outbound connection activity from the source IP address. This pattern is indicative of a threat actor using compromised credentials to gain access via VPN and immediately perform internal network scanning or data staging.
Detects non-interactive Microsoft Entra ID service principal or managed identity sign-in events originating from an IP address, ASN, or country that has not been historically associated with that specific service principal. This behavior may indicate the use of compromised service principal credentials or stolen access tokens from adversary-controlled infrastructure.
Detects anomalous sign-in activity for service principals (non-interactive accounts) where the same application authenticates from multiple distinct countries within a 24-hour window. This behavior often indicates the unauthorized use of compromised service principal credentials, such as client secrets or certificates, from distributed attacker-controlled infrastructure.
Detects potential abuse of Azure Cloud Shell backing storage (acsCloudShell) to stage or persist malicious scripts following an Azure AD session compromise. Adversaries may use this storage to blend in with legitimate engineering operations while maintaining persistent access to their tooling.
Detects instances where an IAM user or role attempts to assume a role in a different AWS account (Cross-Account) without providing a valid ExternalID. This often indicates unauthorized attempts to access or abuse cross-account trust relationships, which is a common technique for lateral movement or privilege escalation in cloud environments.
Detects impossible-travel activity where a single user account authenticates successfully from multiple distinct countries or IP addresses within a short 15-minute window. This behavior is highly indicative of potential session hijacking or the concurrent use of a stolen session token by both an attacker and a legitimate user.
Detects successful user authentication to Microsoft Entra ID or Exchange Online using legacy authentication protocols (e.g., IMAP, POP3, SMTP AUTH, Exchange ActiveSync) that bypass modern MFA enforcement. The rule specifically alerts when these legacy sign-ins originate from a source IP address not previously associated with that specific user account, indicating potential credential abuse.
This rule detects potential session hijacking by correlating endpoint-based detections of known infostealer malware (e.g., Vidar, Lumma, Redline) with a subsequent cloud Identity Provider (IdP) login for the same user. The correlation specifically focuses on instances where the IdP authentication originates from an IP address different from the infected host, suggesting the use of stolen session cookies by an external actor to access corporate resources.
Detects an account performing a mass download or synchronization of files from SharePoint or OneDrive within a 30-minute window, occurring within two hours of a medium or high-risk Azure AD sign-in event. This pattern is indicative of potential account takeover and subsequent data exfiltration by an adversary using harvested credentials.
The following analytic identifies cloud instances being modified by users who have not previously modified them. It leverages data from the Change data model, focusing on successful modifications of EC2 instances. This activity is significant because it can indicate unauthorized or suspicious changes by potentially compromised or malicious users. If confirmed malicious, this could lead to unauthorized access, configuration changes, or potential disruption of cloud services, posing a significant risk to the organization's cloud infrastructure.
The following analytic detects cloud provisioning activities originating from previously unseen regions. It leverages cloud infrastructure logs to identify events where resources are started or created, and cross-references these with a baseline of known regions. This activity is significant as it may indicate unauthorized access or misuse of cloud resources from unfamiliar locations. If confirmed malicious, this could lead to unauthorized resource creation, potential data exfiltration, or further compromise of cloud infrastructure.
Page 3 of 52