Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,088 detections
Filters
Last updated
All Time
Detection languages
619
191
113
86
47
Contributors
302
211
112
88
54
Categories
481
416
353
192
164
Platforms
726
348
216
136
57
Products / Services
518
292
197
124
88
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,088
CVEs
5
5
5
5
4
IDS Classtypes
3
2
1
1
IDS Protocols
3
The analytic identifies a spike in the number of AWS Security Hub alerts for an AWS IAM User within a 4-hour interval. It leverages AWS Security Hub findings data, calculating the average and standard deviation of alerts to detect significant deviations. This activity is significant as a sudden increase in alerts for a specific user may indicate suspicious behavior or a potential security incident. If confirmed malicious, this could signify an ongoing attack, unauthorized access, or misuse of IAM credentials, potentially leading to data breaches or further exploitation.
The analytic detects the upload of a new container image to AWS Elastic Container Registry (ECR) outside of standard business hours. It leverages AWS CloudTrail logs to identify `PutImage` events occurring between 8 PM and 8 AM or on weekends. This activity is significant because container uploads outside business hours can indicate unauthorized or suspicious activity, potentially pointing to a compromised account or insider threat. If confirmed malicious, this could allow an attacker to deploy unauthorized or malicious containers, leading to potential data breaches or service disruptions.
The analytic detects when a user sets a default policy version in AWS. It leverages AWS CloudTrail logs to identify the `SetDefaultPolicyVersion` event from the IAM service. This activity is significant because attackers may exploit this technique for privilege escalation, especially if previous policy versions grant more extensive permissions than the current one. If confirmed malicious, this could allow an attacker to gain elevated access to AWS resources, potentially leading to unauthorized actions and data breaches.
The following analytic identifies successful single-factor authentication events against the Okta Dashboard for accounts without Multi-Factor Authentication (MFA) enabled. It detects this activity by analyzing Okta logs for successful authentication events where "Okta Verify" is not used. This behavior is significant as it may indicate a misconfiguration, policy violation, or potential account takeover. If confirmed malicious, an attacker could gain unauthorized access to the account, potentially leading to data breaches or further exploitation within the environment.
This rule detects login activity by Azure AD administrators to Microsoft cloud applications that are not part of a predefined list of common first-party applications. The rule specifically looks for successful logins where the application ID is not in the 'first_party_ms_cloud_apps' list and the user ID is present in the 'entra_id_admin_watchlist'. This helps identify potentially unusual or unauthorized access by administrators to less common or custom applications, which could indicate compromise or policy violation.
This rule detects Azure AD login activity to applications that are not part of a predefined list of first-party Microsoft Cloud Apps. This could indicate an attempt to access an unauthorized or unusual application within the Azure AD environment, potentially by a compromised account or an insider threat. The rule specifically excludes the 'On-Premises Directory Synchronization Service Account' to reduce false positives related to ADFS synchronization.
This rule detects successful login activity by administrative users to Microsoft Office 365 applications that are not part of a predefined list of common, first-party Microsoft cloud applications. This helps identify potentially unauthorized or unusual access to less common applications within the O365 ecosystem by privileged accounts. The rule specifically targets 'USER_LOGIN' events from 'Office 365' where the login is allowed and the application ID is not in the 'first_party_ms_cloud_apps' list. It also filters for users present in an 'msazure_admin_watchlist'.
This rule detects successful login activities to the Azure AD PowerShell application within Office 365. While legitimate administrative tasks often involve using Azure AD PowerShell, adversaries can also abuse this access to gather user information or perform other malicious actions. The rule specifically looks for successful user logins to the application identified by the product object ID '1b730954-1685-4b74-9bfd-dac224a7b894'. It also includes commented-out filters for ADFS Sync Accounts, which are typically legitimate and run every 30 minutes.
This rule detects successful Office 365 login activity to applications that are not part of a predefined list of common, first-party Microsoft Cloud applications. This can help identify potentially unauthorized or unusual access to cloud resources via less common applications, which might indicate credential compromise or an attempt to bypass standard access controls. The rule specifically excludes certain known benign Microsoft application IDs and allows for filtering out ADFS synchronization traffic.
Detects when a Key Management Service (KMS) decryption operation is carried out by a service account that is not in an allowlist. This behavior may indicate unauthorized access to sensitive information protected by KMS keys. The rule specifically looks for 'Decrypt' events within Google Cloud Platform (GCP) and flags any service account performing this action if it's not part of a predefined allowlist.
This rule detects when a Google Cloud identity experiences a low severity Security Command Center alert followed by a medium severity Security Command Center alert within a 24-hour period. This escalation in alert severity for the same identity could indicate an adversary attempting to gain further access or escalate privileges after an initial compromise or suspicious activity.
This rule detects O365 login activity to apps other than a defined list of first party MS Cloud Apps. Note that Azure Active Directory PowerShell and custom Azure apps are not in this list by default
Detects Azure AD admin login activity to apps other than a defined list of first party MS Cloud Apps. Note that Azure Active Directory PowerShell and custom Azure apps are not in this list by default
This rule detects Azure AD login activity to apps other than a defined list of first party MS Cloud Apps. Note that Azure Active Directory PowerShell and custom Azure apps are not in this list by default
Logins to Azure AD PowerShell app can have legitimate purposes, but are also abused to gain access to user information. Programmatic access to Entra ID (Azure AD) should generally be through apps, so reviewing these activities is needed.
This rule detects O365 login activity to apps other than a defined list of first party MS Cloud Apps. Note that Azure Active Directory PowerShell and custom Azure apps are not in this list by default
Detects when a Key Management Service (KMS) decryption operation is carried out by a service account that's not in the allowlist. This behavior may indicate unauthorized access to information.
Detects when a request to the Kubernetes API is rejected due to lack of authorization or due to an expired authentication token being used. This may indicate an attacker attempting to leverage credentials they have obtained.
This rule detects suspicious activity involving an initial successful authentication to Office 365, followed by a non-interactive sign-in to Azure Activity (Entra ID) from the same user and IP address, but with different session IDs, applications, and user agents. This pattern is indicative of token theft and reuse, potentially using tools like GraphRunner, where an adversary uses a stolen token to perform non-interactive actions. The rule specifically looks for a mismatch in session ID, application, and user agent between the initial interactive login and the subsequent non-interactive login, while the user and IP remain consistent. The user agent strings are specifically chosen to align with those used by the GraphRunner tool.
This rule detects successful user logins to the "Azure Active Directory PowerShell" application within Entra ID (formerly Azure AD). While legitimate administrative tasks may involve this application, the rule's description highlights that programmatic access to Azure AD should generally occur through other applications. Therefore, direct logins to this specific PowerShell application could indicate suspicious activity, such as an attacker using compromised credentials to gain access to user information or perform administrative actions. The rule focuses on successful login events and groups them by user over a 5-minute window, which can help identify clustered or repeated login attempts by a single user.
This rule detects when a user attempts to download multiple unique files from OneDrive via the Microsoft Graph API, and these download attempts result in a 401 Unauthorized status code. This behavior may indicate a permissions issue for the user, potentially due to misconfiguration, revoked access, or an attempt to access unauthorized resources.
Page 50 of 52