Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,866 detections
Filters
Last updated
All Time
Detection languages
2,525
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,091
792
575
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
1,755
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Detects attempts to modify or delete Conditional Access Policies in Microsoft Graph. Adversaries may attempt to alter or remove Conditional Access Policies to bypass security controls and gain unauthorized access or persistence.
Detects HTTP requests attempting to access sensitive internal IP addresses (RFC-1918) or cloud metadata services (e.g., 169.254.169.254) which are common indicators of Server-Side Request Forgery (SSRF) exploitation attempts.
This rule detects successful Azure AD authentication attempts originating from known hosting provider or VPS IP addresses, combined with anomalous behavior such as headless browser user agents, impossible travel, or high-risk sign-in flags. This pattern is indicative of Adversary-in-the-Middle (AiTM) phishing proxies like Evilginx or Bluekit, which attempt to bypass MFA by proxying the authentication process.
Identifies when a owner is was removed from a application or service principal in Azure.
Detects successful authentication events from accounts identified as service, managed, or robot accounts (e.g., svc_, sa_, msol, robot) originating from external IP addresses or exhibiting an unusually high number of distinct source IP addresses. This behavior is indicative of potential credential theft, token replay attacks, or unauthorized usage of service account identities.
This rule detects potential cloud resource hijacking (e.g., cryptojacking) by monitoring for a sudden spike in the deployment of Azure virtual machines by a single user. It triggers if a user creates five or more virtual machines in a 10-minute window, specifically looking for deployments in regions where the user has not recently created VMs, or deployments utilizing high-compute SKUs commonly targeted for cryptocurrency mining.
This rule detects potential brute force attacks against Azure AD accounts by identifying users with 10 or more failed sign-in attempts due to invalid credentials within a 5-minute window. It summarizes the failure count and associated IP addresses for each user.
This rule detects an unusually high number of web search queries (identified by 'search' or 'query' in the URI) originating from a single IP address within a one-hour window. A threshold of 100 or more queries triggers the alert. This behavior could indicate automated activity such as web scraping, reconnaissance, or a denial-of-service attempt against the search functionality.
This rule monitors successful operations related to Azure Traffic Manager within Azure Activity logs. It summarizes the count of such operations by the caller and time, ordered by the most recent activity. This can be used to track administrative actions or changes made to Traffic Manager configurations.
This rule detects an unusual number of successful encryption-related operations performed by a single caller within a one-hour window in Azure Activity logs. This could indicate legitimate bulk administrative tasks or potentially malicious activity such as data encryption for impact (e.g., ransomware) or preparation for exfiltration by an attacker.
This rule detects a spike in modifications or creations of Azure Diagnostic Settings within a one-hour window. A high volume of 'Diagnostic Setting' operations by a single caller could indicate an attempt to alter logging configurations, potentially to impair defenses or hide malicious activity.
Detects updates or deletions of Azure Active Directory (Entra ID) Conditional Access policies that occur outside of typical business hours (Monday-Friday 08:00-18:00 UTC). Such modifications can be an indicator of an adversary attempting to circumvent security controls or maintain persistent, unauthorized access.
This rule detects potentially malicious modification or configuration changes to Azure Function Apps. It monitors for operations such as creation, updates, and configuration changes that contain suspicious indicators like hardcoded credentials (TOKEN, SECRET, PASS), potential reverse shell patterns, or large Base64 encoded payloads. The rule specifically excludes known CI/CD pipeline callers to minimize false positives.
Detects instances where a user or service principal is assigned to high-privilege roles (e.g., Global Administrator, Owner) without utilizing the Microsoft Entra Privileged Identity Management (PIM) service. This is indicated by the absence of 'PIM' in the LoggedByService field for a successful 'Add member to role' operation, which could signify an attempt to bypass established access controls and gain unauthorized elevated persistence.
This rule detects potentially malicious modification or configuration changes to Azure Function Apps. It monitors for operations such as creation, updates, and configuration changes that contain suspicious indicators like hardcoded credentials (TOKEN, SECRET, PASS), potential reverse shell patterns, or large Base64 encoded payloads. The rule specifically excludes known CI/CD pipeline callers to minimize false positives.
Detects a non-interactive sign-in using an existing session shortly after the user completes interactive MFA, which can indicate stolen token replay. This rule identifies scenarios where a user successfully completes an interactive multi-factor authentication (MFA) sign-in, and then, within a short time frame (1800 seconds or 30 minutes), a non-interactive sign-in occurs for the same user and session ID. This pattern is indicative of a stolen session token being replayed by an attacker, bypassing subsequent MFA prompts.
Detects a sequence of events where a cloud storage bucket is deleted and then immediately recreated with the same name. This pattern is indicative of a potential bucket hijacking attack, where an adversary attempts to take ownership of a bucket to intercept data streams, such as logging sinks, application data, or replication traffic.
Detects anomalous device registration in Azure AD where a device code flow is used to authenticate to the Device Registration Service (DRS) and the resulting device is registered with an 'Unknown' or 'Linux' operating system. This behavior is indicative of an adversary, such as Storm-2372, using tools like AADInternals to perform phantom device registration to bypass conditional access policies by simulating a device without TPM attestation.
This rule detects suspicious sign-in patterns indicative of an EvilTokens-style Microsoft Device Code OAuth phishing attack. It identifies successful device code flow sign-ins where Multi-Factor Authentication (MFA) was not applied or satisfied, suggesting an adversary has bypassed MFA using a stolen device code. The rule aggregates these suspicious sign-ins by user, listing associated applications, IP addresses, and locations for analyst review.
Detects suspicious user agents associated with Tycoon2FA phishing-as-a-service (PHaaS) attacks, specifically targeting Microsoft 365 accounts via device code phishing. The rule identifies 'axios/1.13.x' (credential relay variant) and 'node/undici' (device code variant) user agents in Azure AD sign-in logs where the original transfer method is 'deviceCodeFlow', and the device is neither managed nor compliant, and the sign-in token protection status is unbound.
Detects the registration of a new device or MFA authentication method in Microsoft Entra ID from an IP address geolocated to Morocco. This is a persistence tactic used by the Jingle Thief group (also tracked as Atlas Lion and STORM-0539).
Page 108 of 185