Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
302 detections
Filters
Last updated
All Time
Detection languages
166
46
36
22
20
Contributors
117
49
34
24
9
Categories
222
188
118
59
49
Platforms
201
75
70
46
19
Products / Services
129
121
49
46
27
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
CVEs
5
1
IDS Classtypes
2
IDS Protocols
2
Detects when an Azure Blob Storage container's access level is changed to allow public access, or when a long-lived, highly privileged Shared Access Signature (SAS) token is created. Threat actors can use these methods for persistence and data exfiltration.
Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access to instances. This activity could lead to initial access, persistence, or privilege escalation, potentially compromising sensitive data and operations.
Detects when new credentials (certificates or secrets) are added to an existing application or service principal within Azure/Entra ID. This activity, if not part of expected workflows, could indicate a malicious actor establishing persistence or escalating privileges by adding their own credentials to an application.
Detects the S3 Browser utility creating an IAM User or AccessKey in AWS. This activity can be indicative of an attacker establishing persistence or escalating privileges within an AWS environment.
Detects when an organization member or an outside collaborator is added to or removed from a project board or has their permission level changed or when an owner removes an outside collaborator from an organization or when two-factor authentication is required in an organization and an outside collaborator does not use 2FA or disables 2FA.
This detection specifically flags credentials being added to the Connect Sync Application in Entra ID, a technique known to have persistance from On-premise AD DS to Entra ID. It tries to look at both certificate, client secret, and federated credentials being added, and tries to remove legitimate renewal processes. Since the legitimate renewal process first adds a new certificate only te remove the old one short after, we by default allow for a maximum of 1 minute between the certificate create and delete events.
Detects when an application or service principal performs sensitive configuration changes, likely via the Microsoft Graph API. This can indicate an attacker using a compromised or malicious application for persistence (adding credentials), privilege escalation (adding owners), or defense evasion (modifying Conditional Access policies). This aligns with the "Consent & Compromise" research where attackers abuse application permissions.
Detects when a non-approved application is granted high-risk permissions via consent in Azure AD.
This is a common method for attackers to achieve persistence and privilege escalation in Microsoft 365 environments.
This is a common method for attackers to achieve persistence and privilege escalation in Microsoft 365 environments.
KQL Query
KQL Query
Detects the addition or update of key or password credentials specifically on the Microsoft Entra Connect Sync application registration (Service Principal) within Azure AD Audit Logs. This activity is highly suspicious as the normal update process for Entra Connect Sync typically replaces existing keys, and attackers may add credentials for persistence while leaving existing ones for legitimate operations.
'This hunting query identifies updates to the RequiredResourceAccess property of an OAuth application.
This property specifies resources that an application requires access to and the set of OAuth permission scopes and application roles that it needs under each of those resources.
This pre-configuration of required resource access drives the consent experience. The resourceAccess property of the requiredResourceAccess type is a collection of ResourceAccess.
A threat actor might update this property before granting permissions to an application.
'
This property specifies resources that an application requires access to and the set of OAuth permission scopes and application roles that it needs under each of those resources.
This pre-configuration of required resource access drives the consent experience. The resourceAccess property of the requiredResourceAccess type is a collection of ResourceAccess.
A threat actor might update this property before granting permissions to an application.
'
'Detects a Service Principal being assigned an app role that has sensitive access such as Mail.Read.
A threat actor who compromises a Service Principal may assign it an app role to allow it to access sensitive data, or to perform other actions.
Ensure that any assignment to a Service Principal is valid and appropriate.
Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-applications#application-granted-highly-privileged-permissions'
A threat actor who compromises a Service Principal may assign it an app role to allow it to access sensitive data, or to perform other actions.
Ensure that any assignment to a Service Principal is valid and appropriate.
Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-applications#application-granted-highly-privileged-permissions'
The query looks for users or service principals that attached an uncommon credential type to application.
As part of the Nobelium campaign, the attacker added credentials to already existing applications and used the application permissions to extract users' mails.
See How to: Use the portal to create an Microsoft Entra ID application and service principal that can access resources.
Reference - https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal
As part of the Nobelium campaign, the attacker added credentials to already existing applications and used the application permissions to extract users' mails.
See How to: Use the portal to create an Microsoft Entra ID application and service principal that can access resources.
Reference - https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal
This query will find when a new credential is added to an application or service principal.
The Nobelium activity group was able to gain sufficient access to add credentials to existing applications with mail read permissions. They used that access to exfiltrate email.
See Customer Guidance on Recent Nation-State Cyber Attacks for more on the Nobelium campaign (formerly known as Solorigate).
Additional information on OAuth Credential Grants can be found in RFC 6749 Section 4.4 or Microsoft Entra ID audit activity reference.
For further information on AuditLogs please see Microsoft Entra ID audit activity reference.
This query was inspired by an Azure Sentinel detection.
References:
https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
https://docs.microsoft.com/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow
https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-audit-activities
https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AuditLogs/NewAppOrServicePrincipalCredential.yaml
The Nobelium activity group was able to gain sufficient access to add credentials to existing applications with mail read permissions. They used that access to exfiltrate email.
See Customer Guidance on Recent Nation-State Cyber Attacks for more on the Nobelium campaign (formerly known as Solorigate).
Additional information on OAuth Credential Grants can be found in RFC 6749 Section 4.4 or Microsoft Entra ID audit activity reference.
For further information on AuditLogs please see Microsoft Entra ID audit activity reference.
This query was inspired by an Azure Sentinel detection.
References:
https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
https://docs.microsoft.com/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow
https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-audit-activities
https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AuditLogs/NewAppOrServicePrincipalCredential.yaml
Credentials were added to an application by UserA, after the application was granted admin consent rights by UserB
The Nobelium activity group has been observed adding credentials (x509 keys or password credentials) for one or more legitimate OAuth Applications or Service Principals, usually with existing Mail.Read or Mail.ReadWrite permissions, which grants the ability to read mail content from Exchange Online via Microsoft Graph or Outlook REST. Examples include mail archiving applications.
See Customer Guidance on Recent Nation-State Cyber Attacks for more on the Nobelium campaign (formerly known as Solorigate).
See Grant tenant-wide admin consent to an application for how to add admin consent to an application.
More Nobelium-related queries can be found listed under the See also section of this document.
References:
https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
https://docs.microsoft.com/azure/active-directory/manage-apps/grant-admin-consent
The Nobelium activity group has been observed adding credentials (x509 keys or password credentials) for one or more legitimate OAuth Applications or Service Principals, usually with existing Mail.Read or Mail.ReadWrite permissions, which grants the ability to read mail content from Exchange Online via Microsoft Graph or Outlook REST. Examples include mail archiving applications.
See Customer Guidance on Recent Nation-State Cyber Attacks for more on the Nobelium campaign (formerly known as Solorigate).
See Grant tenant-wide admin consent to an application for how to add admin consent to an application.
More Nobelium-related queries can be found listed under the See also section of this document.
References:
https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
https://docs.microsoft.com/azure/active-directory/manage-apps/grant-admin-consent
This query detects attempts to add attacker devices as allowed IDs for active sync using the Set-CASMailbox command.
This technique was seen in relation to Solorigate attack but the results can indicate potential malicious activity used in different attacks.
- Note that this query can be changed to use the KQL "has_all" operator, which hasn't yet been documented officially, but will be soon.
In short, "has_all" will only match when the referenced field has all strings in the list.
- Refer to Set-CASMailbox syntax: https://docs.microsoft.com/powershell/module/exchange/set-casmailbox?view=exchange-ps
This technique was seen in relation to Solorigate attack but the results can indicate potential malicious activity used in different attacks.
- Note that this query can be changed to use the KQL "has_all" operator, which hasn't yet been documented officially, but will be soon.
In short, "has_all" will only match when the referenced field has all strings in the list.
- Refer to Set-CASMailbox syntax: https://docs.microsoft.com/powershell/module/exchange/set-casmailbox?view=exchange-ps
Added credential from country X and Signed-In from country Y in a pecific time window:
This query tries to find all applications that credentials were added to them from country X while the application's identity Signed-In from country Y in a specific time window.
This query tries to find all applications that credentials were added to them from country X while the application's identity Signed-In from country Y in a specific time window.
Prior to deploying Macaw ransomware in an organization, adversaries will change the password for hundreds or thousands of accounts in order to lock users out of the network and impeded recovery efforts.
This rule detects suspicious activity following a successful login to the Azure AD PowerShell application. Specifically, it looks for a user performing multiple administrative actions within a short timeframe after logging in. These actions include adding or updating applications, adding delegated permission grants, or managing certificates and secrets for applications. This behavior is indicative of an attacker attempting to establish persistence or escalate privileges within an Entra ID environment after initial access.
Once a user authenticates to the Azure AD PowerShell application, if they take multiple admin actions indicative of establishing their own persistence with an Entra ID application within a portion of the access token time, alert for additional investigation
Page 13 of 15