Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This rule detects when an Entra ID (formerly Azure Active Directory) conditional access policy has been modified. It specifically looks for 'USER_RESOURCE_UPDATE_CONTENT' events within Office 365, targeting the 'AzureActiveDirectory' application, where the 'extendedAuditEventCategory' is 'Policy' and the 'product_event_type' is 'Update policy.'. This indicates a change to a conditional access policy, which could be a legitimate administrative action or a malicious attempt to alter security controls.
This rule detects when a user is added to an administrative role within Microsoft Entra ID (formerly Azure AD). It specifically looks for events where the event type is 'USER_CHANGE_PERMISSIONS', the product event type is 'Add member to role', and the product name is 'Azure AD Directory Audit'. The rule is configured to trigger when a user is assigned to a role with the TemplateId '62e90394-69f5-4237-9190-012177145e10', which corresponds to the Global Administrator role in Azure AD. This activity is sensitive and warrants validation due to the high privileges associated with administrative roles.
This rule detects the creation, modification, or deletion of client secrets within an Entra ID (formerly Azure AD) application. While client secrets have legitimate uses, their manipulation can be a method for adversaries to establish persistence by gaining unauthorized access to an application's functionalities and data.
This rule detects successful login activity by administrative users to Microsoft Office 365 applications that are not part of a predefined list of common, first-party Microsoft cloud applications. This helps identify potentially unauthorized or unusual access to less common applications within the O365 ecosystem by privileged accounts. The rule specifically targets 'USER_LOGIN' events from 'Office 365' where the login is allowed and the application ID is not in the 'first_party_ms_cloud_apps' list. It also filters for users present in an 'msazure_admin_watchlist'.
This rule detects when a user is added to a role in Microsoft Entra ID (formerly Azure AD) outside of a Privileged Identity Management (PIM) process. While adding users to roles is a normal administrative action, performing it outside of PIM can indicate a potential security risk, as PIM provides just-in-time access and approval workflows for privileged roles. This rule specifically looks for "Add member to role outside of PIM (permanent)" events, which are often triggered via PowerShell API calls.
This rule detects successful login activities to the Azure AD PowerShell application within Office 365. While legitimate administrative tasks often involve using Azure AD PowerShell, adversaries can also abuse this access to gather user information or perform other malicious actions. The rule specifically looks for successful user logins to the application identified by the product object ID '1b730954-1685-4b74-9bfd-dac224a7b894'. It also includes commented-out filters for ADFS Sync Accounts, which are typically legitimate and run every 30 minutes.
Detects when a new user is created in Entra ID (formerly Azure Active Directory) and subsequently assigned administrative or other specified roles within a 90-minute window. This rule aims to identify potential privilege escalation or suspicious account setup activities.
This rule detects when a client secret is added to an application within Azure AD. While this action can be legitimate for application configuration and integration, it can also be abused by adversaries to establish persistence within the environment. By adding a secret, an attacker can maintain access to the application and potentially associated resources, even if their initial access method is remediated. The rule specifically looks for 'Update application' events related to 'Certificates and secrets management' in Azure AD Directory Audit logs.
This rule detects successful Office 365 login activity to applications that are not part of a predefined list of common, first-party Microsoft Cloud applications. This can help identify potentially unauthorized or unusual access to cloud resources via less common applications, which might indicate credential compromise or an attempt to bypass standard access controls. The rule specifically excludes certain known benign Microsoft application IDs and allows for filtering out ADFS synchronization traffic.
This rule detects a sequence of events where a new user account is created in Entra ID (formerly Azure AD) and then, shortly after, that same user is assigned an administrative-level role. This behavior can indicate an attacker establishing persistence or escalating privileges by creating a new account and immediately granting it high-level access.
Detects when a user attached a Lambda layer to an existing Lambda function.
A malicious Lambda layer could execute arbitrary code in the context of the function's IAM role.
This would give an adversary access to resources that the function has access to.
A malicious Lambda layer could execute arbitrary code in the context of the function's IAM role.
This would give an adversary access to resources that the function has access to.
Detects when a Key Management Service (KMS) decryption operation is carried out by a service account that is not in an allowlist. This behavior may indicate unauthorized access to sensitive information protected by KMS keys. The rule specifically looks for 'Decrypt' events within Google Cloud Platform (GCP) and flags any service account performing this action if it's not part of a predefined allowlist.
This rule detects when a Google Cloud identity experiences a low severity Security Command Center alert followed by a medium severity Security Command Center alert within a 24-hour period. This escalation in alert severity for the same identity could indicate an adversary attempting to gain further access or escalate privileges after an initial compromise or suspicious activity.
Detects when an Entra ID conditional access policy has been modified
Detects when a GitHub Personal Access Token (PAT) is created from an IP address identified as a Tor exit node. This activity is suspicious because adversaries often use Tor to anonymize their network traffic when performing malicious actions, such as establishing persistence or exfiltrating data. The creation of a PAT from a Tor IP could indicate an attacker attempting to gain persistent access to a GitHub account or repository before carrying out further actions like cloning repositories to steal data.
Detects when an SSH deploy key is added or modified in a GitHub repository. A compromised or unauthorized deploy key could allow malicious actors to push unauthorized changes into production environments, potentially bypassing code reviews and testing procedures. This could lead to the introduction of backdoors, malware, or the exfiltration of sensitive data.
Detects when a request to the Kubernetes API is rejected due to lack of authorization or due to an expired authentication token being used. This may indicate an attacker attempting to leverage credentials they have obtained.
Detects the installation of the AnyDesk remote access software service. This could indicate abuse if AnyDesk is not legitimately used within the environment. The rule specifically looks for Event ID 7045 from the 'Service Control Manager' provider, where the service name or image path contains 'AnyDesk' and the service name also contains 'Service'.
This rule detects suspicious activity involving an initial successful authentication to Office 365, followed by a non-interactive sign-in to Azure Activity (Entra ID) from the same user and IP address, but with different session IDs, applications, and user agents. This pattern is indicative of token theft and reuse, potentially using tools like GraphRunner, where an adversary uses a stolen token to perform non-interactive actions. The rule specifically looks for a mismatch in session ID, application, and user agent between the initial interactive login and the subsequent non-interactive login, while the user and IP remain consistent. The user agent strings are specifically chosen to align with those used by the GraphRunner tool.
This rule detects multiple failed attempts (401 Unauthorized status) to download the same file from OneDrive via the Microsoft Graph API. This behavior may indicate a permissions issue for the user attempting the download or could be an indicator of an adversary attempting to access unauthorized files.
This rule detects successful user logins to the "Azure Active Directory PowerShell" application within Entra ID (formerly Azure AD). While legitimate administrative tasks may involve this application, the rule's description highlights that programmatic access to Azure AD should generally occur through other applications. Therefore, direct logins to this specific PowerShell application could indicate suspicious activity, such as an attacker using compromised credentials to gain access to user information or perform administrative actions. The rule focuses on successful login events and groups them by user over a 5-minute window, which can help identify clustered or repeated login attempts by a single user.
Page 379 of 401