Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,916 detections
Filters
Last updated
All Time
Detection languages
2,236
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
805
765
576
Platforms
1,843
1,022
856
814
656
Products / Services
988
596
477
456
383
MITRE Techniques
18,115
15,635
12,577
8,388
6,215
4,916
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
Logins to Azure AD PowerShell app can have legitimate purposes, but are also abused to gain access to user information. Programmatic access to Entra ID (Azure AD) should generally be through apps, so reviewing these activities is needed.
This rule detects O365 login activity to apps other than a defined list of first party MS Cloud Apps. Note that Azure Active Directory PowerShell and custom Azure apps are not in this list by default
Detects potential exploitation attempts of CVE-2024-3400, an OS command injection vulnerability in Palo Alto GlobalProtect. The rule looks for suspicious strings indicating directory traversal or command injection within Palo Alto GlobalProtect logs.
Detects when a request to the Kubernetes API is rejected due to lack of authorization or due to an expired authentication token being used. This may indicate an attacker attempting to leverage credentials they have obtained.
Detects HTTP requests to low reputation Top-Level Domains (TLDs) or for files with suspicious extensions, which may indicate an attempt to download malicious content or establish command and control.
This rule detects suspicious activity involving an initial successful authentication to Office 365, followed by a non-interactive sign-in to Azure Activity (Entra ID) from the same user and IP address, but with different session IDs, applications, and user agents. This pattern is indicative of token theft and reuse, potentially using tools like GraphRunner, where an adversary uses a stolen token to perform non-interactive actions. The rule specifically looks for a mismatch in session ID, application, and user agent between the initial interactive login and the subsequent non-interactive login, while the user and IP remain consistent. The user agent strings are specifically chosen to align with those used by the GraphRunner tool.
This rule detects multiple failed attempts (401 Unauthorized status) to download the same file from OneDrive via the Microsoft Graph API. This behavior may indicate a permissions issue for the user attempting the download or could be an indicator of an adversary attempting to access unauthorized files.
This rule detects successful user logins to the "Azure Active Directory PowerShell" application within Entra ID (formerly Azure AD). While legitimate administrative tasks may involve this application, the rule's description highlights that programmatic access to Azure AD should generally occur through other applications. Therefore, direct logins to this specific PowerShell application could indicate suspicious activity, such as an attacker using compromised credentials to gain access to user information or perform administrative actions. The rule focuses on successful login events and groups them by user over a 5-minute window, which can help identify clustered or repeated login attempts by a single user.
This rule detects when a user attempts to download multiple unique files from OneDrive via the Microsoft Graph API, and these download attempts result in a 401 Unauthorized status code. This behavior may indicate a permissions issue for the user, potentially due to misconfiguration, revoked access, or an attempt to access unauthorized resources.
This rule identifies when the HTTP DELETE method is used within the Microsoft Graph API. This can indicate administrative activities such as deleting users, groups, or other resources. The rule specifically looks for network HTTP events where the product event type is 'Microsoft Graph Activity' and the HTTP method is 'DELETE'. It excludes IP addresses within a specific Azure CIDR range (20.151.0.0/16) to reduce noise from internal Azure operations. Further tuning can be applied to target specific API endpoints or user agents.
This rule detects successful group deletion events within Microsoft Entra ID (formerly Azure AD). It specifically looks for audit logs where the event type is 'GROUP_DELETION', the product event type is 'Delete group', the product is 'Azure AD Directory Audit', the vendor is 'Microsoft', and the security result indicates the action was 'ALLOW'. The rule also groups these events by user over a 5-minute window.
This rule detects when a user is successfully removed from a group within Office 365. It specifically looks for 'GROUP_MODIFICATION' events with the product event type 'Remove member from group.' from Microsoft Office 365, where the action was allowed.
This rule detects the hard deletion of an application within Entra ID (formerly Azure AD). A 'hard delete' means the application is permanently removed without a recovery option, which can indicate malicious activity such as an attacker attempting to remove traces of their presence or disrupt services by deleting critical applications.
Detects when a group is successfully deleted in Office 365. This rule specifically looks for events where the event type is 'GROUP_DELETION', the product event type is 'Delete group.', the product is 'Office 365', the vendor is 'Microsoft', and the security result action is 'ALLOW'. It also tracks the user responsible for the deletion.
Detects HTTP requests to low reputation TLDs (e.g. .xyz, .top, .ru) or ending in suspicious file extensions (.exe, .dll, .hta), which may indicate malicious activity.
This rule identifies changes to SAML (Security Assertion Markup Language) provider configurations within Google Workspace. Monitoring these changes is crucial for security teams as modifications to SAML configurations can potentially weaken an organization's security posture, leading to unauthorized access or other security incidents. The rule specifically looks for events categorized as 'SAML2_SERVICE_PROVIDER_CONFIG_SETTINGS' or with product event types matching 'SAML2_SERVICE_PROVIDER_CONFIG'.
Detects API calls originating from AWS accounts that are not part of the organization, based on a reference list of approved AWS account IDs. This could indicate unauthorized access or activity from external entities.
Detects potential exploitation of CVE-2024-1212, an unauthenticated command injection vulnerability in Progress Kemp LoadMaster. The rule specifically looks for GET requests to the '/access/set' API with the parameters 'param=enableapi' and 'value=1', combined with an "Authorization" header containing a base64 encoded value with uncommon characters, indicative of an attempted exploit.
This rule identifies when a new domain is added to the list of trusted domains within Google Workspace. An adversary might leverage this capability to establish trusted relationships, potentially manipulating sharing settings to gain unauthorized access to sensitive organizational files and folders.
This rule detects when a single user generates an excessive number of 'Permission Denied' events within a one-hour timeframe in Google Cloud Platform (GCP). Specifically, it looks for more than 5 'BLOCK' actions with a severity of 'ERROR' and a status code of '7' (which typically indicates 'Permission Denied' in GCP API errors) from a single user. Additionally, it requires these events to span across more than one target application and more than one product event type, which helps to reduce false positives by indicating broader activity rather than a single, isolated error.
Detects successfully authenticated user logins to Okta based on Okta's Behavior Detection pattern analysis, specifically looking for high-risk indicators such as new geo-location, new device, new IP, new city, new state, new country, or velocity anomalies. It also flags logins originating from unauthorized target geographies like Cuba, Iran, North Korea, Russia, and Syria. The rule only applies to existing users, not newly created ones.
Page 222 of 235