Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
472 detections
Filters
Last updated
All Time
Detection languages
342
74
19
16
7
Contributors
91
90
77
52
35
Categories
182
148
81
66
60
Platforms
406
68
63
58
26
Products / Services
10,680
9,761
6,694
4,418
3,744
472
MITRE Techniques
180
121
96
78
71
CVEs
6
5
5
5
2
IDS Classtypes
2
1
1
1
1
IDS Protocols
6
This rule detects potential unauthorized access to Azure Storage Blobs following the retrieval of storage account access keys. It correlates 'ListKeys' API events with subsequent blob access activities from either unrecognized IP addresses or via Shared Access Signature (SAS) tokens, indicating potential credential misuse.
Detects AzureHound or roadtx bulk enumeration of Microsoft Graph API endpoints using tokens obtained via CVE-2025-0309 CA policy bypass, characterized by high-frequency GET requests to /v1.0/users, /v1.0/groups, /v1.0/devices, /v1.0/servicePrincipals from Edge client IDs (f44b1140-bc5e-48c6-8dc0-5cf5a53c0e34 or 22098786-6e16-43cc-a27d-191a01a1e3b5) with password-only amr claim and no MFA.
Detects Azure Privileged Identity Management (PIM) role activations that occur outside of standard business hours (before 07:00 or after 19:00 UTC, or on weekends) or involve high-privilege roles (e.g., Global Administrator, Privileged Role Administrator, Security Administrator).
Detects Server-Side Template Injection (SSTI) attempts targeting the Floci API Gateway, specifically looking for Velocity Template Language (VTL) payloads intended to trigger Remote Code Execution via 'java.lang.ProcessBuilder', along with indicators of an IAM credential scope bypass.
Detects bulk enumeration of Microsoft Graph API endpoints (users, groups, devices, service principals) characteristic of tools like AzureHound or roadtx. The detection focuses on high-frequency GET requests originating from known Edge browser client IDs associated with CA policy bypass (CVE-2025-0309) where tokens lack MFA claims, indicating unauthorized reconnaissance in an Azure/Entra ID environment.
Detects high frequency administrative modifications, such as user creation/deletion, password resets, or group membership changes, performed by service accounts associated with Azure AD Connect or Microsoft Entra Connect. This behavior may indicate account compromise where a service principal is being abused to perform bulk identity management operations.
Detects modifications to Azure AD/Entra ID application configurations, specifically updating the 'RedirectUri' or 'ReplyUrls' to point to potentially external or unauthorized domains. This technique is often used in OAuth-based application-consent phishing campaigns to redirect authorization codes to adversary-controlled servers.
Detects users who modify their MFA settings (registration/update/delete) and subsequently perform privileged actions (such as adding role members or service principal credentials) within a short timeframe, while simultaneously observed active in communication applications like Teams, Zoom, or Webex. This behavior is indicative of potential account takeover where an adversary modifies authentication methods to gain persistent access, followed by privilege escalation.
This rule detects multiple attempts (10 or more within an hour) from a single IP address to access administrative interfaces on a web server. It specifically looks for URI queries containing keywords like 'admin', 'wp-admin', or 'administrator' in W3CIISLog data. Such activity often indicates a brute-force attack or scanning for administrative login pages.
This rule monitors the creation of new Azure Function Apps and identifies those that receive external, non-private network requests within 48 hours of their creation. This pattern may indicate the deployment of malicious or unauthorized serverless infrastructure for command-and-control, proxying, or automated tasks.
This rule detects potential automated credential stuffing attempts followed by successful authentication and subsequent access to sensitive/privileged APIs within Azure/Entra ID environments. It correlates multiple failed login attempts for service-oriented account names (e.g., svc, api, bot) with a successful login from the same user shortly thereafter, followed by privileged API operations (e.g., KeyVault secret access, user management) within a short time window.
Detects when a new federated identity credential is successfully added to an Azure Active Directory (Entra ID) application. This activity is a common method for attackers to establish persistent access to cloud resources by bypassing password-based authentication.
Detects instances where a user successfully authenticates from geographically distant locations within a short timeframe (impossible travel) followed by sensitive privileged operations within a 4-hour window.
Detects an unusually high frequency of storage blob and container listing operations within a short time window. This behavior often indicates an attempt to enumerate the contents of Azure Blob Storage, which may be a precursor to data discovery or exfiltration.
This rule detects a high frequency (3 or more within an hour) of command-line executions containing keywords like 'antivirus', 'defense', or 'endpoint' on a Windows system. This activity could indicate an adversary attempting to interact with, disable, or tamper with security software to evade detection.
Detects modifications to Azure AD/Entra ID application configurations, specifically updating the 'RedirectUri' or 'ReplyUrls' to point to potentially external or unauthorized domains. This technique is often used in OAuth-based application-consent phishing campaigns to redirect authorization codes to adversary-controlled servers.
Detects potential path traversal attempts in web server and gateway logs, specifically targeting URL parameters like 'url' or 'path'. The rule identifies suspicious URI sequences (e.g., dot-dot-slash) followed by large HTTP responses, which may indicate successful file retrieval or sensitive data access.
Detects potential SSRF or local file read attempts by identifying requests to sensitive system or application file paths (e.g., /proc/self/environ, /etc/passwd) that result in an unusually large response body compared to the historical baseline for that endpoint.
This rule detects potential unauthorized access to Azure Storage Blobs following the retrieval of storage account access keys. It correlates 'ListKeys' API events with subsequent blob access activities from either unrecognized IP addresses or via Shared Access Signature (SAS) tokens, indicating potential credential misuse.
This rule detects potential unauthorized access to Azure Storage Blobs following the retrieval of storage account access keys. It correlates 'ListKeys' API events with subsequent blob access activities from either unrecognized IP addresses or via Shared Access Signature (SAS) tokens, indicating potential credential misuse.
Detects when a new federated identity credential is successfully added to an Azure Active Directory (Entra ID) application. This activity is a common method for attackers to establish persistent access to cloud resources by bypassing password-based authentication.
Page 12 of 23