Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
302 detections
Filters
Last updated
All Time
Detection languages
166
46
36
22
20
Contributors
117
49
34
24
9
Categories
222
188
118
59
49
Platforms
201
75
70
46
19
Products / Services
129
121
49
46
27
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
CVEs
5
1
IDS Classtypes
2
IDS Protocols
2
The following analytic identifies the creation of AWS IAM access keys by a user for another user, which can indicate privilege escalation. It leverages AWS CloudTrail logs to detect instances where the user creating the access key is different from the user for whom the key is created. This activity is significant because unauthorized access key creation can allow attackers to establish persistence or exfiltrate data via AWS APIs. If confirmed malicious, this could lead to unauthorized access to AWS services, data exfiltration, and long-term persistence in the environment.
The analytic detects the creation of a new API token within an Okta tenant. It uses OktaIm2 logs ingested via the Splunk Add-on for Okta Identity Cloud to identify events where the `system.api_token.create` command is executed. This activity is significant because creating a new API token can indicate potential account takeover attempts or unauthorized access, allowing an adversary to maintain persistence. If confirmed malicious, this could enable attackers to execute API calls, access sensitive data, and perform administrative actions within the Okta environment.
The analytic detects the addition of new credentials to Service Principals and Applications in Azure AD. It leverages Azure AD AuditLogs, specifically monitoring the "Update application*Certificates and secrets management" operation. This activity is significant as it may indicate an adversary attempting to maintain persistent access or escalate privileges within the Azure environment. If confirmed malicious, attackers could use these new credentials to log in as the service principal, potentially compromising sensitive accounts and resources, leading to unauthorized access and control over the Azure environment.
The following analytic detects updates to the SAML provider in AWS. It leverages AWS CloudTrail logs to identify the `UpdateSAMLProvider` event, analyzing fields such as `sAMLProviderArn`, `sourceIPAddress`, and `userIdentity` details. Monitoring updates to the SAML provider is crucial as it may indicate a perimeter compromise of federated credentials or unauthorized backdoor access set by an attacker. If confirmed malicious, this activity could allow attackers to manipulate identity federation, potentially leading to unauthorized access to cloud resources and sensitive data.
The following analytic detects the addition of new service principal accounts in O365 tenants. It leverages data from the `o365_management_activity` dataset, specifically monitoring for operations related to adding or creating service principals. This activity is significant because attackers can exploit service principals to gain unauthorized access and perform malicious actions within an organization's environment. If confirmed malicious, this could allow attackers to interact with APIs, access resources, and execute operations on behalf of the organization, potentially leading to data breaches or further compromise.
The following analytic detects the addition of new credentials for Service Principals within an Office 365 tenant. It uses O365 audit logs, focusing on events related to credential modifications or additions in the AzureActiveDirectory workload. This activity is significant because Service Principals represent application identities, and their credentials allow applications to authenticate and access resources. If an attacker successfully adds or modifies these credentials, they can impersonate the application, leading to unauthorized data access, data exfiltration, or malicious operations under the application's identity.
Detects when a user attaches a Lambda layer to an existing AWS Lambda function. A malicious Lambda layer could execute arbitrary code in the context of the function's IAM role, potentially granting an adversary access to resources the function has access to. This activity could indicate privilege escalation or unauthorized modification of serverless functions.
This rule detects the creation, modification, or deletion of client secrets within an Entra ID (formerly Azure AD) application. While client secrets have legitimate uses, their manipulation can be a method for adversaries to establish persistence by gaining unauthorized access to an application's functionalities and data.
This rule detects when a client secret is added to an application within Azure AD. While this action can be legitimate for application configuration and integration, it can also be abused by adversaries to establish persistence within the environment. By adding a secret, an attacker can maintain access to the application and potentially associated resources, even if their initial access method is remediated. The rule specifically looks for 'Update application' events related to 'Certificates and secrets management' in Azure AD Directory Audit logs.
Secrets added to applications have legitimate purposes, but can also be a method of persistence.
Secrets added to applications have legitimate purposes, but can also be a method of persistence. This alert will trigger on creation, modification or delete of a client secret
Detects when a GitHub Personal Access Token (PAT) is created from an IP address identified as a Tor exit node. This activity is suspicious because adversaries often use Tor to anonymize their network traffic when performing malicious actions, such as establishing persistence or exfiltrating data. The creation of a PAT from a Tor IP could indicate an attacker attempting to gain persistent access to a GitHub account or repository before carrying out further actions like cloning repositories to steal data.
Detects when an SSH deploy key is added or modified in a GitHub repository. A compromised or unauthorized deploy key could allow malicious actors to push unauthorized changes into production environments, potentially bypassing code reviews and testing procedures. This could lead to the introduction of backdoors, malware, or the exfiltration of sensitive data.
Detects when a GitHub Personal Access Token is created from a known Tor exit node IP address. An adversary may create a Personal Access Token before carrying out follow up actions such as cloning GitHub repositories to steal data.
This rule detects the successful creation of a new group within Microsoft Graph API. It specifically looks for HTTP POST requests to the `/v1.0/groups` endpoint that result in a 201 (Created) HTTP response code. The rule's description indicates it can be triggered by the `Invoke-SecurityGroupCloner` function from the GraphRunner tool, which is used for cloning security groups.
This rule detects HTTP 400 Bad Request errors when attempting to interact with the Microsoft Graph API's /v1.0/groups endpoint via a POST request. This specific activity can indicate a failed attempt to duplicate a group, potentially by tools like GraphRunner's Invoke-SecurityGroupCloner function. It focuses on identifying issues during group creation or modification operations within Azure AD through the Graph API.
This rule detects when an excessive number of permissions are changed for an application within Microsoft Entra ID (formerly Azure AD). While adding permissions is a normal activity, a sudden increase in the number of permissions granted to an application, exceeding a defined threshold (currently 5), could indicate malicious activity such as an attacker attempting to escalate privileges or broaden access for a compromised application. The rule specifically looks for 'Update application' events in Azure AD Directory Audit logs where the 'RequiredResourceAccess' attribute changes significantly.
This rule detects when a single user adds more than 4 members to the same Office 365 group within a 5-minute window. It specifically looks for successful 'Add member to group' events in Office 365 audit logs, focusing on the `GROUP_MODIFICATION` event type. The threshold of 4 users added is configurable.
Detects when an SSH deploy key is added or modified in a GitHub repository. A compromised or unauthorized deploy key could allow malicious actors to push unauthorized changes into production environments, potentially bypassing code reviews and testing procedures. This could lead to the introduction of backdoors, malware, or the exfiltration of sensitive data.
This rule detects successful events where a user is added to a group within Office 365. It specifically looks for 'GROUP_MODIFICATION' events with the product event type 'Add member to group.' originating from 'Office 365' by 'Microsoft' where the security action was 'ALLOW'. The rule also identifies the user performing the action, the group name, group GUID, and the user who was added to the group.
Adding permissions to an application is expected, however if excessive permissions are changed at one time over a defined threshold, it may be worth validating.
Page 14 of 15