Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
134 detections
Filters
Last updated
All Time
Detection languages
60
33
10
10
9
Contributors
42
25
8
7
6
Categories
84
54
30
20
19
Platforms
116
11
5
4
1
Products / Services
48
38
33
9
7
MITRE Techniques
18,108
15,617
12,573
8,385
6,207
CVEs
1
1
1
IDS Classtypes
2
1
IDS Protocols
1
1
1
Detects lateral movement where a Managed Identity of one Azure resource (e.g., VM) is used to execute code or access another resource. This is identified by successful 'Microsoft.Compute/virtualMachines/runCommand' operations where the caller is a ServicePrincipal (indicated by a GUID) and the 'InitiatedBy' field contains 'resourcegroups', suggesting the action was initiated by a resource rather than a direct user.
Identifies JSON Web Tokens (JWTs) where the signing algorithm in the header ('alg') is set to 'none'. A server that incorrectly trusts this header may skip signature validation, allowing an attacker to create arbitrary tokens and bypass authentication controls.
Detects suspicious process creation activities executed by the SYSTEM user, specifically looking for known malicious programs or command-line parameters often associated with credential dumping, defense evasion, and privilege escalation techniques. This includes the use of tools like Mimikatz, Rubeus, ProcDump, and various PowerShell obfuscation methods, as well as commands related to shadow copy deletion and registry hive saving.
Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escalation via hardcoded policy name indicators
Detects potential abuse of Microsoft Actor tokens for cross-tenant impersonation attacks targeting Entra ID tenants. This rule identifies suspicious audit log entries that may indicate exploitation of CVE-2025-55241, a critical vulnerability in Azure AD Graph API that allowed attackers to impersonate any user across Entra ID tenants using malicious Actor tokens.
The following analytic detects when a process with low, medium, or high integrity spawns a system integrity process from a user-controlled location. This behavior is indicative of privilege escalation attempts where attackers elevate their privileges to SYSTEM level from a user-controlled process or service. The detection leverages Sysmon data, specifically Event ID 15, to identify such transitions. Monitoring this activity is crucial as it can signify an attacker gaining SYSTEM-level access, potentially leading to full control over the affected system, unauthorized access to sensitive data, and further malicious activities.
Detects attempts to add sensitive privileges to a process token, a common technique for local privilege escalation. This could be part of an exploit chain following an information disclosure vulnerability like CVE-2025-53136.
Detects a sequence of events indicative of privilege escalation via TrustedInstaller token manipulation, a technique used by MostereRAT. The rule looks for a process starting the 'TrustedInstaller' service and then immediately launching a new process as the SYSTEM user.
Detects scenarios where attack attempts to elevate privileges via the command runas.
Detects scenarios where an attacker abuse RPC, NTLM relay and others components to escalate privileges.
Detects scenarios where attack attempts to elevate privileges via customize Runas tool.
Detects scenarios where an attacker grants new rights to an account in order to escalate privileges
This rule detects a sequence of successful Azure AD sign-ins from the same user and device. The first sign-in uses a refresh token (RT) for a non-interactive user session, specifically for the Microsoft Teams desktop client (app ID 29d9ed98-a469-4536-ade2-f981bc1d605e) from an Azure AD joined device, where the token protection status is 'unbound'. This is followed by a second successful sign-in using a primary refresh token (PRT) from the same user and device, excluding sign-ins to the 'Device Registration Service'. This sequence could indicate an adversary attempting to transition from an acquired refresh token to a primary refresh token, potentially to gain broader access or persistence within the Azure AD environment.
Detects a sequence of events indicative of a new device being registered using a refresh token, a TTP associated with the ROADtools framework following an OAuth phishing attack. This sequence involves the Device Registration Service adding a device with a specific hardcoded OS version, followed by user and owner assignments, all within a short timeframe and sharing the same correlation ID.
KQL Query from file: NEW Real-time Anomalous Token Detection
KQL Query from file: Attacker in the Middle Precision Detection
Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)
Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK SERVICE privileges
Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)
Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escalation via hardcoded policy name indicators
This query will find when federation trust settings are changed for a domain or when the domain is changed from managed to federated authentication. Results will relate to when a new Active Directory Federated Service (ADFS) TrustedRealm object, such as a signing certificate, is added.
Modification to domain federation settings should be rare, so confirm the added or modified target domain/URL is legitimate administrative behavior.
The actor, Nobelium, was observed modifying domain trust settings to subvert existing mechanisms and cause the domain to accept authorization tokens signed with actor-owned certificates. See Customer Guidance on Recent Nation-State Cyber Attacks.
To understand why an authorized user may update settings for a federated domain in Office 365, Azure, or Intune, see Update or repair the settings of a federated domain in Office 365, Azure, or Intune.
For details on security realms that accept security tokens, see the ADFS Proxy Protocol (MS-ADFSPP) specification: 3.2.5.1.2.4 Security Realm Data.
For further information on AuditLogs, please see Microsoft Entra ID audit activity reference.
This query is inspired by an Azure Sentinal detection.
References:
https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
https://docs.microsoft.com/office365/troubleshoot/active-directory/update-federated-domain-office-365
https://docs.microsoft.com/openspecs/windows_protocols/ms-adfspp/e7b9ea73-1980-4318-96a6-da559486664b
https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-audit-activities
https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AuditLogs/ADFSDomainTrustMods.yaml
Modification to domain federation settings should be rare, so confirm the added or modified target domain/URL is legitimate administrative behavior.
The actor, Nobelium, was observed modifying domain trust settings to subvert existing mechanisms and cause the domain to accept authorization tokens signed with actor-owned certificates. See Customer Guidance on Recent Nation-State Cyber Attacks.
To understand why an authorized user may update settings for a federated domain in Office 365, Azure, or Intune, see Update or repair the settings of a federated domain in Office 365, Azure, or Intune.
For details on security realms that accept security tokens, see the ADFS Proxy Protocol (MS-ADFSPP) specification: 3.2.5.1.2.4 Security Realm Data.
For further information on AuditLogs, please see Microsoft Entra ID audit activity reference.
This query is inspired by an Azure Sentinal detection.
References:
https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
https://docs.microsoft.com/office365/troubleshoot/active-directory/update-federated-domain-office-365
https://docs.microsoft.com/openspecs/windows_protocols/ms-adfspp/e7b9ea73-1980-4318-96a6-da559486664b
https://docs.microsoft.com/azure/active-directory/reports-monitoring/reference-audit-activities
https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AuditLogs/ADFSDomainTrustMods.yaml
Page 6 of 7