Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
132 detections
Filters
Last updated
All Time
Detection languages
66
28
15
13
5
Contributors
29
22
20
13
12
Categories
96
93
27
19
16
Platforms
74
44
27
26
16
Products / Services
55
42
27
14
9
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
1
IDS Classtypes
2
IDS Protocols
2
This hunting query identifies successful AWS IAM access key creation events where a named IAM user creates a key for a different named IAM user.
Such activity may indicate persistence or privilege escalation, particularly when the target user has elevated permissions. The query compares the caller and target usernames; it does not assess the target user's permissions.
Hunting queries are designed to be run manually during threat hunting activities.
Such activity may indicate persistence or privilege escalation, particularly when the target user has elevated permissions. The query compares the caller and target usernames; it does not assess the target user's permissions.
Hunting queries are designed to be run manually during threat hunting activities.
This analytic detects the usage of the Azure CLI to interact with user accounts such as creating or deleting a user.
Adversaries create new users so that their malicious activity does not interrupt the normal functions of the compromised users and can remain undetected.
While legitimate administrative use is expected, anomalous execution patterns, unexpected users, or unusual parent processes should be treated as potential indicators of compromise and investigated promptly.
Adversaries create new users so that their malicious activity does not interrupt the normal functions of the compromised users and can remain undetected.
While legitimate administrative use is expected, anomalous execution patterns, unexpected users, or unusual parent processes should be treated as potential indicators of compromise and investigated promptly.
Detects administrative IAM operations such as user, role, or access key creation performed by an identity containing 'agent' in its ARN or username. This behavior is intended to flag unauthorized privilege escalation or persistence mechanisms initiated by automated service identities that should not be modifying IAM configurations.
Detects the addition of a Service Principal to an Azure AD group that has the 'isAssignableToRole' property set to true. This behavior is a known privilege escalation technique where the service principal inherits the privileged roles assigned to that group, bypassing standard direct role-assignment monitoring.
This rule detects scenarios where an external user is invited to an Azure AD tenant and subsequently granted a highly privileged role (such as Global Administrator or User Administrator) within a short window of time (1 hour). This pattern is indicative of potential persistence establishment or privilege escalation by an adversary using guest accounts.
Detects the creation of new programmatic credentials (AWS access keys, Azure AD service principal credentials, or GCP service account keys) where the identity creating the credential differs from the identity for which the credential is being issued. This behavior is often indicative of persistence mechanisms or credential abuse where an attacker with sufficient permissions creates secondary credentials for other accounts.
Detects 'CreateAccessKey' API calls in AWS CloudTrail where the principal making the request is different from the target IAM user. This pattern is commonly associated with persistence mechanisms where an attacker creates additional access keys on legitimate administrator accounts to maintain stealthy access.
Detects potential persistence mechanisms in AWS by monitoring the creation of new IAM users or roles, the issuance of long-lived credentials (access keys or login profiles), or the creation of roles with permissive cross-account trust policies. This rule specifically excludes known legitimate automation roles to reduce noise.
Detects the assignment of high-privilege Entra ID directory roles (e.g., Global Administrator) to identities that either have a recent risky sign-in history or were created within the last 48 hours. This pattern is indicative of privilege escalation following account compromise or the creation of backdoored accounts by an attacker. Assignments including change management tracking tags are excluded to reduce noise.
Detects a suspicious sequence of identity-related operations in Azure AD, characterized by the modification of authentication methods policies followed by rapid application or service principal registration, consent granting, or role assignments by the same actor within a 10-minute window. This behavior often indicates an adversary attempting to establish persistence or escalate privileges via malicious OAuth applications or service principals after weakening security posture.
Detects a suspicious sequence of identity-related operations in Azure AD, characterized by the modification of authentication methods policies followed by rapid application or service principal registration, consent granting, or role assignments by the same actor within a 10-minute window. This behavior often indicates an adversary attempting to establish persistence or escalate privileges via malicious OAuth applications or service principals after weakening security posture.
This rule detects the creation of a new Azure AD (Entra ID) application with a name containing AI-related keywords (e.g., 'ai', 'copilot', 'gpt') that is subsequently granted high-privilege Microsoft Graph API permissions within a 24-hour window. This behavior is often associated with attackers setting up seemingly benign-looking applications to conduct OAuth-based persistent access or data exfiltration.
Detects the addition or modification of federated identity credentials within Microsoft Entra ID (Azure AD). Adversaries may add these credentials to service principals or applications to achieve persistent access and potentially bypass traditional password-based authentication mechanisms.
Detects the presence or execution of artifacts associated with the TrustSink proof-of-concept (deploy.py, cleanup_eam.py, deploy_state.json), which is used to register or remove rogue Entra authentication providers.
Detects rapid, automated-style creation of an application, associated service principal, and delegated permission grants within a 60-second window. This behavior is indicative of the TrustSink technique or similar automated adversary infrastructure setup in Microsoft Entra ID (formerly Azure AD), where an attacker establishes persistence or elevated access through newly created apps.
Detects the registration of a new multi-tenant OAuth application in an enterprise cloud environment that requests high-risk scopes (e.g., mail access or directory write permissions). This behavior is often associated with OAuth-based consent phishing or the establishment of persistent backdoors in cloud environments.
Detects the registration of a new multi-tenant OAuth application in an enterprise cloud environment that requests high-risk scopes (e.g., mail access or directory write permissions). This behavior is often associated with OAuth-based consent phishing or the establishment of persistent backdoors in cloud environments.
Detects instances where an Entra ID (Azure AD) application is registered and subsequently granted consent by the same user within 30 minutes, specifically when the activity occurs outside of typical business hours (7 AM - 7 PM) or from disparate IP addresses. This behavior pattern is indicative of potential malicious OAuth application registration and subsequent token-granting by an attacker to maintain persistent access to an environment.
Detects potential backdoored persistence in AWS Lambda functions. The rule monitors for two patterns: 1) A Lambda function creation followed by granting cross-account 'lambda:InvokeFunction' permissions to an untrusted or wildcard principal. 2) A privilege escalation event (such as attaching policies) followed by a 'lambda:UpdateFunctionCode' operation on the same function by the same principal, which may indicate an attempt to inject malicious code into a serverless function.
This rule detects unscheduled modifications to federation, application, or service principal credentials, including ADFS token-signing certificates, in both Azure AD (via O365 management activity logs) and local Windows environments (via Security Event Logs). It filters these events against a known rotation schedule to highlight suspicious, non-routine changes that may indicate persistence establishment or identity provider tampering.
Detects when a user account assigned to high-privileged roles (Global Administrator or Authentication Policy Administrator) performs sensitive operations such as application registration, service principal creation, or modifications to authentication policies within a short timeframe (4 hours) of a successful sign-in. This activity is often associated with the initial setup phases of MFA bypass or persistence techniques in Entra ID.
Page 1 of 7