Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
257 detections
Filters
Last updated
All Time
Detection languages
105
43
40
36
19
Contributors
106
29
29
20
16
Categories
211
160
107
57
47
Platforms
175
74
43
33
20
Products / Services
110
101
43
33
22
MITRE Techniques
18,108
15,614
12,573
8,384
6,204
CVEs
1
1
IDS Classtypes
2
IDS Protocols
2
Detects when an access level is changed for a Google Workspace application. An access level is part of BeyondCorp Enterprise which is Google Workspace's way of enforcing Zero Trust model. An adversary could remove access levels to gain easier access to Google Workspace resources, potentially leading to persistence or privilege escalation.
Detects when an application (service principal) is assigned Azure AD roles, such as global administrator, or Azure RBAC roles, such as subscription owner. This activity can indicate privilege escalation or persistence by an attacker who has compromised an application.
Detects when an app is assigned Azure AD roles, such as global administrator, or Azure RBAC roles, such as subscription owner.
Detects when an administrator grants an application either application permissions (app roles) or highly privileged delegated permissions within an Azure environment. This action is logged in the Azure audit logs as 'Add app role assignment to service principal'. Such assignments can lead to persistence or privilege escalation if abused.
Detects when administrator grants either application permissions (app roles) or highly privileged delegated permissions
Page 13 of 13