Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,088 detections
Filters
Last updated
All Time
Detection languages
619
191
113
86
47
Contributors
302
211
112
88
54
Categories
481
416
353
192
164
Platforms
726
348
216
136
57
Products / Services
518
292
197
124
88
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,088
CVEs
5
5
5
5
4
IDS Classtypes
3
2
1
1
IDS Protocols
3
Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.
This rule monitors and alerts when a user is added to the 'Global Administrator' or 'Device Administrator' roles within Azure Active Directory. These roles grant highly elevated privileges, making this activity critical for detecting potential persistence, privilege escalation, or initial access attempts by adversaries. The detection logic specifically looks for 'Add member to role' operations within the RoleManagement category, targeting the unique identifiers for these two sensitive administrative roles.
Detects when a configuration change is made to an application's AppID URI in Azure Active Directory (now Microsoft Entra ID). This change can be indicative of an adversary attempting to modify an application's identity to facilitate malicious activities such as phishing, unauthorized access, or maintaining persistence.
Detects when a user successfully resets their own password within Azure Active Directory. This rule specifically looks for 'UserManagement' category events with a 'Success' status, initiated by a 'UPN' (User Principal Name) and targeting a 'UPN' with an 'ActivityType' containing 'Password reset'.
This rule detects sign-in attempts to Azure AD where the authentication requirement was single-factor, the sign-in was successful (ResultType: 0), the network location details were empty (indicating an unknown or unclassified location), and the device ID was also empty (indicating an unknown or unregistered device). This combination suggests a sign-in from an unknown device and potentially an untrusted location, which could be indicative of an adversary attempting to gain initial access or maintain persistence.
Detects failed attempts to sign in to disabled accounts within Azure Active Directory. This could indicate an attacker attempting to use compromised credentials for an account that has been deactivated, or an attempt to bypass security controls by targeting dormant accounts.
This rule detects successful user authentications from your Azure AD tenant to other Azure AD tenants. This activity can indicate an attacker attempting to maintain access or escalate privileges by leveraging existing user accounts to access resources in external tenants, or it could be a legitimate business-to-business (B2B) collaboration that needs to be approved.
Detects the creation of an Inline IAM policy by the 'S3 Browser' utility, where the policy still contains the default S3 bucket name placeholder value of "<YOUR-BUCKET-NAME>" instead of a specific bucket name. This indicates a potential misconfiguration or an attempt to create a broad policy that might be further exploited.
This rule detects successful user authentications originating from geographic locations (countries) that are not designated as operational areas for the organization. This helps identify potential unauthorized access attempts or compromised accounts being used from unexpected locations.
This rule detects sign-in failures in Azure Active Directory (now Microsoft Entra ID) that are specifically due to Conditional Access policies not being met. It identifies attempts where a user or service tried to authenticate but was blocked because the Conditional Access requirements were not satisfied. This could indicate an attacker attempting to bypass security controls, or legitimate users/services failing to meet policy requirements.
Detects when a user is added to a privileged role in Azure AD. This could indicate an attempt to escalate privileges or establish persistence within the cloud environment.
Detects when user access has been blocked by Azure Conditional Access policies. This indicates that token issuance was denied, which could be a sign of unauthorized login attempts to valid accounts.
Detects when a user successfully logs on to sanctioned applications from an IP address identified as risky by Microsoft Cloud App Security. This indicates a potential compromise of the user's account or an attempt to access resources from an unusual and potentially malicious location.
Detects when a user without the necessary permissions attempts to invite a guest user in an Azure environment, indicated by a failed 'Invite external user' operation in the audit logs. This could signify an attempt at unauthorized access, privilege escalation, or persistence.
This rule detects the successful creation of a new administrative account within an Azure environment. It specifically looks for audit log entries indicating both 'Add user' and 'Add member to role' actions occurring successfully, which signifies a user being created and then assigned a privileged role.
Detects failed authentication attempts originating from geographic locations (countries) that are not part of the organization's approved operational regions. This rule helps identify potential unauthorized access attempts or credential stuffing attacks from unexpected sources.
This rule detects changes to an application's Uniform Resource Identifier (URI) configuration within Azure. Such changes can include modifications to domain names, protocol usage (e.g., switching from HTTPS), the introduction of wildcards, or URIs pointing to uncontrolled domains. These types of modifications can be indicative of an attacker attempting to redirect traffic, establish persistence, or facilitate other malicious activities by altering how an application is accessed or interacts with external resources.
This detection identifies when a user successfully authenticates from a country for the first time within a given period. It establishes a baseline of known countries for each user and alerts on any successful login originating from a country not present in that baseline. This behavior can indicate compromised credentials being used from an unusual location, or a legitimate user traveling to a new country.
Detects changes to payment or bank account information in Workday. This activity is associated with 'payroll pirate' attacks by threat actor Storm-2657, who modify payroll details to divert salary payments after compromising an account.
Detects a user password change synced from on-premises Active Directory, immediately followed by the same user registering a new MFA method. This sequence is highly suspicious for existing privileged accounts and was used by the threat actor Storm-0501 to compromise a Global Administrator account that previously lacked MFA.
This query is designed to detect a series of anomalous user behaviors that, when combined, may indicate a compromised account. It flags activity that is uncharacteristic for a specific user, such as performing an unusual action, using an unfamiliar application, connecting from an unexpected ISP or country, or logging in from a new device for the first time. The final filter | where InvestigationPriority > 5 focuses the results on high-priority alerts, which are more likely to be legitimate threats. This approach uses behavioral analytics to identify deviations from a user's normal baseline, making it effective for detecting both insider threats and external attacks that have breached credentials.
Page 43 of 52