Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
47 detections
Filters
Last updated
All Time
Detection languages
23
6
6
6
3
Contributors
17
7
5
5
4
Categories
22
22
11
10
10
Platforms
29
11
10
8
6
Products / Services
19
12
11
9
6
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
4
1
IDS Classtypes
4
2
IDS Protocols
6
The following analytic identifies the addition of a new federated domain in an Office 365 environment. This behavior is detected by analyzing Office 365 management activity logs, specifically filtering for Workload=Exchange and Operation="Add-FederatedDomain". The addition of a new federated domain is significant as it may indicate unauthorized changes or potential compromises. If confirmed malicious, attackers could establish a backdoor, bypass security measures, or exfiltrate data, leading to data breaches and unauthorized access to sensitive information. Immediate investigation is required to review the details of the added domain and any concurrent suspicious activities.
This analytic identifies the use of `certutil.exe` with arguments indicating the manipulation or extraction of certificates. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because extracting certificates can allow attackers to sign new authentication tokens, particularly in federated environments like Windows ADFS. If confirmed malicious, this could enable attackers to forge authentication tokens, potentially leading to unauthorized access and privilege escalation within the network.
The following analytic detects the addition of new service principal accounts in O365 tenants. It leverages data from the `o365_management_activity` dataset, specifically monitoring for operations related to adding or creating service principals. This activity is significant because attackers can exploit service principals to gain unauthorized access and perform malicious actions within an organization's environment. If confirmed malicious, this could allow attackers to interact with APIs, access resources, and execute operations on behalf of the organization, potentially leading to data breaches or further compromise.
This rule detects administrative actions related to AWS SAML Identity Providers. Specifically, it triggers when a SAML provider is created, updated, or deleted within an AWS environment. Monitoring these events is crucial as SAML providers are used for federated access, and unauthorized changes could indicate attempts at persistence, privilege escalation, or defense evasion by manipulating authentication mechanisms.
This rule detects an anomaly in the SAML token issuer, indicating a potential compromise of the SAML token. The detection is triggered when the 'riskEventType' is 'tokenIssuerAnomaly', suggesting that the claims within the token are unusual or align with known attacker patterns. This could signify an adversary forging web credentials, specifically SAML tokens, to gain unauthorized access.
Page 3 of 3