Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This rule detects when a user attempts to download multiple unique files from OneDrive via the Microsoft Graph API, and these download attempts result in a 401 Unauthorized status code. This behavior may indicate a permissions issue for the user, potentially due to misconfiguration, revoked access, or an attempt to access unauthorized resources.
This rule detects the successful creation of a new group within Microsoft Graph API. It specifically looks for HTTP POST requests to the `/v1.0/groups` endpoint that result in a 201 (Created) HTTP response code. The rule's description indicates it can be triggered by the `Invoke-SecurityGroupCloner` function from the GraphRunner tool, which is used for cloning security groups.
This rule identifies when the HTTP DELETE method is used within the Microsoft Graph API. This can indicate administrative activities such as deleting users, groups, or other resources. The rule specifically looks for network HTTP events where the product event type is 'Microsoft Graph Activity' and the HTTP method is 'DELETE'. It excludes IP addresses within a specific Azure CIDR range (20.151.0.0/16) to reduce noise from internal Azure operations. Further tuning can be applied to target specific API endpoints or user agents.
This rule detects HTTP 400 Bad Request errors when attempting to interact with the Microsoft Graph API's /v1.0/groups endpoint via a POST request. This specific activity can indicate a failed attempt to duplicate a group, potentially by tools like GraphRunner's Invoke-SecurityGroupCloner function. It focuses on identifying issues during group creation or modification operations within Azure AD through the Graph API.
This rule detects successful group deletion events within Microsoft Entra ID (formerly Azure AD). It specifically looks for audit logs where the event type is 'GROUP_DELETION', the product event type is 'Delete group', the product is 'Azure AD Directory Audit', the vendor is 'Microsoft', and the security result indicates the action was 'ALLOW'. The rule also groups these events by user over a 5-minute window.
This rule detects when an excessive number of permissions are changed for an application within Microsoft Entra ID (formerly Azure AD). While adding permissions is a normal activity, a sudden increase in the number of permissions granted to an application, exceeding a defined threshold (currently 5), could indicate malicious activity such as an attacker attempting to escalate privileges or broaden access for a compromised application. The rule specifically looks for 'Update application' events in Azure AD Directory Audit logs where the 'RequiredResourceAccess' attribute changes significantly.
This rule detects when a single user adds more than 4 members to the same Office 365 group within a 5-minute window. It specifically looks for successful 'Add member to group' events in Office 365 audit logs, focusing on the `GROUP_MODIFICATION` event type. The threshold of 4 users added is configurable.
This rule detects when a user is successfully removed from a group within Office 365. It specifically looks for 'GROUP_MODIFICATION' events with the product event type 'Remove member from group.' from Microsoft Office 365, where the action was allowed.
Detects potentially suspicious loading of "ksproxy.ax", which may indicate an attempt to exploit CVE-2024-35250. This vulnerability allows for privilege escalation.
This rule detects the hard deletion of an application within Entra ID (formerly Azure AD). A 'hard delete' means the application is permanently removed without a recovery option, which can indicate malicious activity such as an attacker attempting to remove traces of their presence or disrupt services by deleting critical applications.
This rule detects successful events where a user is added to a group within Office 365. It specifically looks for 'GROUP_MODIFICATION' events with the product event type 'Add member to group.' originating from 'Office 365' by 'Microsoft' where the security action was 'ALLOW'. The rule also identifies the user performing the action, the group name, group GUID, and the user who was added to the group.
Detects when a group is successfully deleted in Office 365. This rule specifically looks for events where the event type is 'GROUP_DELETION', the product event type is 'Delete group.', the product is 'Office 365', the vendor is 'Microsoft', and the security result action is 'ALLOW'. It also tracks the user responsible for the deletion.
Detects when a request to the Kubernetes API is rejected due to lack of authorization or due to an expired authentication token being used.
This may indicate an attacker attempting to leverage credentials they have obtained.
This may indicate an attacker attempting to leverage credentials they have obtained.
Detects the execution of AADInternals PowerShell cmdlets. AADInternals is a tool used for administering Azure AD and Office 365, which can be abused by threat actors for various attacks including reconnaissance, credential access, and impact within Azure AD or Office 365 environments. The rule specifically looks for the unique "-AADInt" string prefix in cmdlet names.
This rule identifies changes to SAML (Security Assertion Markup Language) provider configurations within Google Workspace. Monitoring these changes is crucial for security teams as modifications to SAML configurations can potentially weaken an organization's security posture, leading to unauthorized access or other security incidents. The rule specifically looks for events categorized as 'SAML2_SERVICE_PROVIDER_CONFIG_SETTINGS' or with product event types matching 'SAML2_SERVICE_PROVIDER_CONFIG'.
Detects API calls originating from AWS accounts that are not part of the organization, based on a reference list of approved AWS account IDs. This could indicate unauthorized access or activity from external entities.
This rule detects the creation or modification of a DLL path within the Windows Time service (W32Time) TimeProviders registry key. Adversaries may abuse this mechanism to establish persistence by registering a malicious DLL to be loaded and executed when the system boots. The rule specifically looks for changes to the 'DllName' value under 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders' and filters out known legitimate DLLs associated with the W32Time service.
This rule detects when highly privileged administrative roles, specifically 'Owner' or 'Editor', are assigned to a service account within Google Cloud Platform. This activity is significant because service accounts with such elevated permissions can be leveraged by attackers for persistence, privilege escalation, and to perform a wide range of actions within the GCP environment, potentially leading to compromise of cloud resources.
This rule detects when a single user generates an excessive number of 'Permission Denied' events within a one-hour timeframe in Google Cloud Platform (GCP). Specifically, it looks for more than 5 'BLOCK' actions with a severity of 'ERROR' and a status code of '7' (which typically indicates 'Permission Denied' in GCP API errors) from a single user. Additionally, it requires these events to span across more than one target application and more than one product event type, which helps to reduce false positives by indicating broader activity rather than a single, isolated error.
This rule detects when a Google Cloud Platform (GCP) Identity and Access Management (IAM) Organization Policy is either updated or deleted. Such actions can indicate an attempt to modify security controls, potentially to facilitate persistence or privilege escalation within the GCP environment. Monitoring these changes is crucial for maintaining the security posture of an organization's cloud resources.
Detects successfully authenticated user logins to Okta based on Okta's Behavior Detection pattern analysis, specifically looking for high-risk indicators such as new geo-location, new device, new IP, new city, new state, new country, or velocity anomalies. It also flags logins originating from unauthorized target geographies like Cuba, Iran, North Korea, Russia, and Syria. The rule only applies to existing users, not newly created ones.
Page 380 of 401