Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,088 detections
Filters
Last updated
All Time
Detection languages
619
191
113
86
47
Contributors
302
211
112
88
54
Categories
481
416
353
192
164
Platforms
726
348
216
136
57
Products / Services
518
292
197
124
88
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,088
CVEs
5
5
5
5
4
IDS Classtypes
3
2
1
1
IDS Protocols
3
This rule identifies statistically unusual or first-time Azure operations performed by a principal (user or service principal). It uses a risk-based alerting model, assigning a higher risk score to operations defined as high-risk. The rule establishes a baseline of normal activity over 30 days and alerts when current activity significantly deviates from this baseline or when an operation is observed for the very first time for a given identity.
The analytic detects the creation of a new Automation Runbook Webhook within an Azure tenant. It leverages Azure Audit events, specifically the "Create or Update an Azure Automation webhook" operation, to identify this activity. This behavior is significant because Webhooks can trigger Automation Runbooks via unauthenticated URLs exposed to the Internet, posing a security risk. If confirmed malicious, an attacker could use this to execute code, create users, or maintain persistence within the environment, potentially leading to unauthorized access and control over Azure resources.
Detects suspicious OAuth app consents, role assignments, and group changes involving Workday and Salesforce, indicating potential account compromise or privilege escalation.
Detects a user self-assigning access to a large number of applications in Okta within a short time frame. This behavior is associated with the threat group UNC3944 (Scattered Spider) for privilege escalation and lateral movement across SaaS applications.
This rule detects changes to privileged roles and group memberships within Azure Active Directory. It helps identify potential unauthorized privilege escalation, supports compliance and audit requirements, and allows correlation of identity changes with suspicious activity or alerts. The rule specifically looks for operations such as adding/removing members from roles or groups, and updating role memberships or user details, ensuring the operation was successful.
This detection specifically flags credentials being added to the Connect Sync Application in Entra ID, a technique known to have persistance from On-premise AD DS to Entra ID. It tries to look at both certificate, client secret, and federated credentials being added, and tries to remove legitimate renewal processes. Since the legitimate renewal process first adds a new certificate only te remove the old one short after, we by default allow for a maximum of 1 minute between the certificate create and delete events.
This detection flags any changes happening on the Connect Sync Application in Entra ID. Since this is a very interesting account for attackers to abuse when moving laterally between AD DS and Entra ID, any change to the account should be investigated. We try to exclude legitimate certificate renewal processes, and a new account onboarding in the detection rule.
This rule detects suspicious Okta login attempts where a user successfully passes the initial authentication factor but then fails or abandons a subsequent Multi-Factor Authentication (MFA) challenge, originating from a new IP address, device (user agent), and city combination. It filters out events from known corporate VPN IP addresses to reduce false positives.
Detects suspicious activities in Salesforce environments consistent with the TTPs of the ShinyHunters threat group (also tracked as UNC6040/UNC6240). The attack involves social engineering (vishing) to trick users into authorizing malicious OAuth applications that impersonate legitimate tools like 'Salesforce Data Loader'. This rule looks for key indicators such as the installation of unreviewed packages, creation of impersonating connected apps, elevation of permissions to 'full' API access, and large data exports.
Detects when an application or service principal performs sensitive configuration changes, likely via the Microsoft Graph API. This can indicate an attacker using a compromised or malicious application for persistence (adding credentials), privilege escalation (adding owners), or defense evasion (modifying Conditional Access policies). This aligns with the "Consent & Compromise" research where attackers abuse application permissions.
Purpose: Hunts for risky OAuth applications in Microsoft 365 with overly permissive Microsoft Graph permissions.
Key Actions:
Finds enabled OAuth apps and retrieves their latest state (arg_max).
Expands permissions and flags sensitive ones (e.g., Mail.Send, Files.ReadWrite.All, User.ReadWrite.All, Sites.ReadWrite.All).
Notes publisher verification, origin, and last modification date.
Marks risky apps via HasRiskyPermissions flag.
Use Cases: Detects malicious consent grant phishing, overprivileged third-party apps, and integrations that could enable data theft or long-term access.
Key Actions:
Finds enabled OAuth apps and retrieves their latest state (arg_max).
Expands permissions and flags sensitive ones (e.g., Mail.Send, Files.ReadWrite.All, User.ReadWrite.All, Sites.ReadWrite.All).
Notes publisher verification, origin, and last modification date.
Marks risky apps via HasRiskyPermissions flag.
Use Cases: Detects malicious consent grant phishing, overprivileged third-party apps, and integrations that could enable data theft or long-term access.
This rule detects the creation of new Microsoft Power Automate flows that are configured to use connectors capable of exfiltrating data via email or collaboration platforms like Microsoft Teams. It specifically looks for flows created with connectors which could indicate an attempt to send sensitive information outside the organization.
This detection identifies interactive sign-ins from countries that a user has not accessed from in the past 30 days, based on successful logins. It highlights unusual geographic access patterns, such as remote work via VPNs, possible account compromise, or other travel-related anomalies.
Only interactive sign-ins are included to reduce noise from background service logins and token refreshes.
Recommended Extensions:
1. Trusted Applications Watchlist
Use a Sentinel watchlist (e.g., `TrustedAppsWatchlist`) to maintain known or expected applications (like SAP Cloud Identity Services, Microsoft Teams, Outlook Mobile) that frequently authenticate across multiple countries or devices. This helps suppress expected behavior and avoids alert fatigue.
2. Workation / Remote User Watchlist
Create a watchlist (e.g., `WorkationUsers`) with UPNs or user aliases of employees who are temporarily working abroad or from rotating locations. This allows legitimate, location-shifting activity to be filtered out of alerting, reducing false positives during travel seasons or flexible remote work arrangements.
Only interactive sign-ins are included to reduce noise from background service logins and token refreshes.
Recommended Extensions:
1. Trusted Applications Watchlist
Use a Sentinel watchlist (e.g., `TrustedAppsWatchlist`) to maintain known or expected applications (like SAP Cloud Identity Services, Microsoft Teams, Outlook Mobile) that frequently authenticate across multiple countries or devices. This helps suppress expected behavior and avoids alert fatigue.
2. Workation / Remote User Watchlist
Create a watchlist (e.g., `WorkationUsers`) with UPNs or user aliases of employees who are temporarily working abroad or from rotating locations. This allows legitimate, location-shifting activity to be filtered out of alerting, reducing false positives during travel seasons or flexible remote work arrangements.
The analytic detects an unusually high number of denied Multi-Factor Authentication (MFA) requests for a single user within a 10-minute window, specifically when more than nine MFA prompts are declined. It leverages Azure Active Directory (Azure AD) sign-in logs, focusing on "Sign-in activity" events with error code 500121 and additional details indicating "MFA denied; user declined the authentication." This behavior is significant as it may indicate a targeted attack or account compromise attempt, with the user actively declining unauthorized access. If confirmed malicious, it could lead to data exfiltration, lateral movement, or further malicious activities.
Detects potential exploitation of Microsoft Entra ID (formerly Azure AD) by attackers who abuse app role permissions to backdoor federated domains and escalate to Global Administrator using forged SAML tokens
The analytic identifies instances where a Duo admin logs in using a browser other than Chrome, which is considered unusual based on typical access patterns. This behavior is significant for a SOC because the use of an unexpected browser may indicate credential compromise, session hijacking, or the use of unauthorized devices by attackers attempting to evade detection. Detecting such anomalies enables early investigation and response, helping to prevent privilege escalation, policy manipulation, or further compromise of sensitive administrative accounts. The impact of this attack could include unauthorized changes to security policies, user access, or the disabling of critical security controls, posing a substantial risk to the organizations security posture.
This rule detects when an application consent operation occurs in Azure Active Directory, specifically looking for broad consent types such as 'AllPrincipals' or when an administrator has granted consent. This can indicate a malicious application gaining wide permissions within the Azure AD tenant.
KQL Query from file: Potential MFASweep (tool) activity has been detected.
This detection identifies when Microsoft Copilot Studio agents are created in your organization's tenant. This activity is significant as the default behavior in Copilot agent creation is to configure a new service principal with cloud app administrator role.
Copilot agents can be found in the Microsoft Admin Portal https://admin.microsoft.com/Adminportal/Home#/copilot/agents
Copilot agents can be found in the Microsoft Admin Portal https://admin.microsoft.com/Adminportal/Home#/copilot/agents
KQL Query from file: GraphRunner Recon Detection & Response
KQL Query from file: Azure Cloud Security Monitoring
Page 44 of 52