Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,866 detections
Filters
Last updated
All Time
Detection languages
2,525
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,091
792
575
Platforms
39,936
7,266
6,535
3,866
3,647
Products / Services
1,755
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Detects the same authentication session or token identifier used from geographically inconsistent locations within a short period. This could indicate session hijacking or an adversary using a compromised session from a different location.
Detects a rapid burst of file upload activity to cloud storage applications from a single account, including unusual proxy or device context. This rule identifies scenarios where an account performs 20 or more upload events or uploads 20 or more distinct objects within a 15-minute time window to common cloud storage services like Google Drive, Dropbox, Box, MEGA, OneDrive, or ShareFile. It also highlights if any of these uploads originate from an anonymous proxy.
Detects a session issued through browser MFA and subsequently used through a non-interactive, mobile, or command-line client. This behavior is indicative of an adversary potentially using a stolen session token to bypass multi-factor authentication.
Detects the execution of cloud CLI tools (aws, az, gsutil) using commands designed for bulk or recursive deletion of data from cloud object storage (S3, Azure Blob, GCS). This activity is commonly associated with destructive attacks, ransomware, or unauthorized data removal.
Detects the execution of cloud CLI tools (aws, az, gsutil) using commands designed for bulk or recursive deletion of data from cloud object storage (S3, Azure Blob, GCS). This activity is commonly associated with destructive attacks, ransomware, or unauthorized data removal.
Detects attempts to modify or delete Conditional Access Policies in Microsoft Graph. This could indicate an adversary attempting to weaken security controls to facilitate unauthorized access or persistence.
This rule detects successful OAuth logins originating from IP addresses identified as residential proxies. This behavior can indicate an adversary attempting to bypass geo-blocking or other IP-based restrictions, potentially using stolen credentials (Valid Accounts) or after a successful phishing campaign (Spearphishing Link) to gain initial access or maintain persistence.
Detects unauthorized or non-standard processes attempting to create, modify, or access sensitive cloud configuration and credential files, such as AWS credentials, Azure CLI token caches, or GCP application default credentials. This behavior is indicative of potential credential theft or unauthorized access to cloud environment tokens.
Detects the creation of a Temporary Access Pass (TAP) by a service principal or agent identity, rather than a human administrator. This scenario indicates a potential compromise where a Temporary Access Agent with UserAuthMethod-TAP.ReadWrite.All permission is abused to generate a TAP for a Global Administrator.
This rule detects Nested App Authentication (NAA) broker abuse, specifically when the Azure Portal silently acquires Microsoft Graph tokens for privileged first-party nested applications. It correlates these silent token acquisitions with a preceding interactive Azure Portal sign-in from the same user and IP address within a 30-minute window, indicating a potential AiTM (Adversary-in-the-Middle) kill chain indicator. The rule identifies known vulnerable nested application IDs and looks for 'refreshToken' or 'broker' as the incoming token type during the Graph token acquisition.
This rule detects Nested App Authentication (NAA) broker abuse, specifically when the Azure Portal silently acquires Microsoft Graph tokens for privileged first-party nested applications. It correlates these silent token acquisitions with a preceding interactive Azure Portal sign-in from the same user and IP address within a 30-minute window, indicating a potential AiTM (Adversary-in-the-Middle) kill chain indicator. The rule identifies known vulnerable nested application IDs and looks for 'refreshToken' or 'broker' as the incoming token type during the Graph token acquisition.
Detects successful sign-ins to specific Azure AD applications known to bypass Conditional Access policies, where Conditional Access was not applied. This could indicate an attempt to circumvent security controls.
Detects multiple failed connection attempts to Azure Database for MySQL, which may indicate a brute force attack. This rule specifically looks for 'Access Denied' errors (error code 1045) or other non-zero error codes during connection attempts within a defined timeframe from the same client IP address.
Detects a new phone, authenticator application, FIDO key, or passkey registered after account recovery activity, which can establish attacker-controlled multifactor authentication.
Detects a successful Key Vault access policy or role change that grants secret-reading capability to a user or service principal. This could indicate an adversary attempting to gain access to sensitive credentials stored in Azure Key Vault.
Detects successful retrieval of storage account access keys by a user identity rather than an established deployment or backup service. This activity can indicate an attacker attempting to gain access to sensitive data stored in Azure Storage Accounts.
Detects outbound email from an organizational mailbox to a common consumer email provider with multiple or large attachments. This could indicate data exfiltration or unauthorized transfer of sensitive information.
Detects general Entra ID sign-ins originating from Railway.com PaaS IP space, which could indicate a token replay campaign or other unauthorized access.
Detects automated Microsoft Graph API requests indicative of the 'Payroll Pirate' campaign, specifically targeting payroll and HR personnel after initial access via AiTM session token theft. The rule identifies two malicious patterns: bulk user directory harvesting using '?$top=999' and keyword-targeted enumeration (payroll, human, compensation) using OR-chained search queries and pagination markers ($skiptoken).
Identifies successful device code authentications originating from non-trusted named locations. This can indicate an attempt to bypass multi-factor authentication or compromise an account through device code phishing.
Detects successful authentications where a Temporary Access Pass (TAP) was used as the primary authentication method. TAPs bypass standard password and MFA requirements, and their usage outside of expected scenarios (like onboarding or account recovery) could indicate an adversary bypassing authentication mechanisms.
Page 115 of 185