Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10 detections
Filters
Last updated
All Time
Detection languages
6
2
1
1
Contributors
3
2
2
1
1
Categories
7
6
3
2
2
Platforms
6
2
2
1
1
Products / Services
4
3
2
2
1
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
IDS Classtypes
2
IDS Protocols
2
Detects successful retrieval of storage account access keys by a user identity rather than an established deployment or backup service.
Detects successful retrieval of storage account access keys by a user identity rather than an established deployment or backup service. This activity can indicate an attacker attempting to gain access to sensitive data stored in Azure Storage Accounts.
Detects Tycoon 2FA operator recon assessing mailbox forwarding rules, auto-replies, and timezones. This KQL query identifies actions related to 'mailboxSettings' within 'Microsoft Graph' events, which can indicate an adversary enumerating user mailbox configurations.
Detects access to Azure portal for cloud service dashboard discovery
This rule detects HTTP requests to 'portal.azure.com', indicating access to the Azure management portal. A threshold is set to trigger an alert if 10 such requests are observed from the same source IP within 60 seconds. This activity is classified as a network scan, potentially for infrastructure discovery.
This rule detects multiple AWS console login attempts from a single source IP address within a short timeframe, specifically looking for access to the 'home' URI on 'console.aws.amazon.com'. This behavior could indicate an attacker attempting to discover cloud resources after gaining initial access to an AWS account.
Sublime Threat Intelligence and Research (STIR) identified a phishing campaign using a recently published open-source Javascript virtual machine and obfuscation tool called KrakVM. The initial KrakVM-encoded HTML file arrives as an attachment in phishing emails. These emails are short, often not even including a body, with subjects and HTML attachment filenames suggesting the target has a new voicemail, a vendor credit, or unpaid invoices
KQL Query from file: Detect Microsoft Graph API Abuse
KQL Query from file: ATP Detection for Critical Identities
This rule detects attempts to retrieve the Microsoft Graph authorization policy, specifically targeting the `/policies/authorizationPolicy` endpoint. This policy contains sensitive information about who can create applications, invite guest users, and other critical settings within Entra ID (formerly Azure AD). Such requests are typically made by administrators for review or modification, and unexpected calls to this endpoint could indicate reconnaissance or unauthorized access attempts. The rule filters for successful GET requests (HTTP 200) and excludes known Azure IP ranges to reduce false positives.
