Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
132 detections
Filters
Last updated
All Time
Detection languages
78
19
19
8
4
Contributors
36
27
25
9
6
Categories
107
68
19
12
11
Platforms
105
56
36
12
4
Products / Services
59
34
29
16
9
MITRE Techniques
18,108
15,617
12,573
8,385
6,207
CVEs
3
IDS Classtypes
2
IDS Protocols
2
No description available.
This rule detects rapid enumeration of Azure AD identity and configuration components by identifying a burst of specific, high-level administrative API calls (Get user flows, Get API connectors, Get identity providers, Get user attributes) within a short window. This pattern is indicative of reconnaissance activities aimed at mapping out the identity provider configuration.
This rule detects rapid enumeration of Azure AD identity and configuration components by identifying a burst of specific, high-level administrative API calls (Get user flows, Get API connectors, Get identity providers, Get user attributes) within a short window. This pattern is indicative of reconnaissance activities aimed at mapping out the identity provider configuration.
This rule detects rapid enumeration of Azure AD identity and configuration components by identifying a burst of specific, high-level administrative API calls (Get user flows, Get API connectors, Get identity providers, Get user attributes) within a short window. This pattern is indicative of reconnaissance activities aimed at mapping out the identity provider configuration.
This rule detects rapid enumeration of Azure AD identity and configuration components by identifying a burst of specific, high-level administrative API calls (Get user flows, Get API connectors, Get identity providers, Get user attributes) within a short window. This pattern is indicative of reconnaissance activities aimed at mapping out the identity provider configuration.
No description available.
Detects enumeration of Entra ID applications and permissions via AzureHound or ROADrecon, identified by distinct user-agent strings or abnormal Graph API request volume — the same signal Organization B's custom alerts used to catch CISA's red team.
This rule detects rapid enumeration of Azure AD identity and configuration components by identifying a burst of specific, high-level administrative API calls (Get user flows, Get API connectors, Get identity providers, Get user attributes) within a short window. This pattern is indicative of reconnaissance activities aimed at mapping out the identity provider configuration.
Detects an account making repeated Microsoft Graph API user search requests for payroll/HR display names via an axios HTTP client against a specific ApplicationId, consistent with Storm-2755 payroll-personnel reconnaissance.
Detects suspicious OAuth consent or connected app authorization followed by SaaS query, export, download, or bulk API activity from the same account within 24 hours, indicating possible OAuth token abuse or SaaS data exfiltration.
Detects GET requests to the Microsoft Graph API 'organization' endpoint, often used by malicious tools to validate a tenant environment or gather metadata before initiating C2 communication or secondary stages of an attack.
Detects GET requests to the Microsoft Graph API 'organization' endpoint, often used by malicious tools to validate a tenant environment or gather metadata before initiating C2 communication or secondary stages of an attack.
Detects the execution of 'az role assignment list' using the Azure CLI. This command is commonly used by adversaries to enumerate existing role assignments in an Azure environment, aiding in permission discovery and identifying potential targets for privilege escalation.
Detects GET requests to the Microsoft Graph API 'organization' endpoint, often used by malicious tools to validate a tenant environment or gather metadata before initiating C2 communication or secondary stages of an attack.
Detects anomalous, high-volume enumeration of Azure OAuth application IDs from a single IP address, indicative of an adversary attempting to map or verify OAuth applications, potentially leveraging spoofed client IDs for discovery or bypass attempts.
Detects Microsoft Graph API requests that query directory role assignments specifically looking for highly privileged roles such as Global Administrator, Exchange Administrator, or Security Administrator. This activity may indicate an adversary is enumerating privileged roles to identify potential targets for privilege escalation or lateral movement within an Azure/Microsoft 365 environment.
Detects anomalous activity where an identity performs a sequence of reconnaissance-related AWS API calls (e.g., listing roles, policies, or describing instances) followed shortly (within 10 minutes) by deployment actions like RunInstances or CreateCluster. This behavior is indicative of an attacker who has gained access to an identity and is surveying the environment before provisioning malicious infrastructure.
Detects automated enumeration patterns via the Microsoft Graph API, specifically targeting bulk directory pulls (requests with $top=999) and keyword-based searches for sensitive organizational data (payroll, HR, finance). This rule aggregates activity by user session to identify suspicious volumes and diversity of requests.
Detects high-volume, potentially automated enumeration of Microsoft Graph API endpoints targeting sensitive personnel data (payroll, HR, finance). This rule identifies requests using non-standard or suspicious user agents—such as curl, python-requests, or common web client patterns—when interacting with user and group directories in the Microsoft 365 environment, characteristic of the 'Payroll Pirate' (Storm-2755/Storm-2657) campaign patterns.
Detects the execution of 'aws sts get-caller-identity' combined with 'curl' operations utilizing stdin data piping, often associated with unauthorized identity enumeration and data exfiltration in cloud-native environments, particularly when initiated from developer tool contexts like Amazon Q/MCP configurations.
Detects the execution of AWS CLI commands typically used for cloud resource enumeration (e.g., listing users, roles, buckets, or identity information) when spawned by common development environments, IDEs, or shell interpreters. This rule is designed to identify potential post-exploitation activity where an attacker uses compromised developer credentials or environments to map the cloud infrastructure.
Page 4 of 7