Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,866 detections
Filters
Last updated
All Time
Detection languages
2,525
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,091
792
575
Platforms
39,934
7,265
6,535
3,866
3,645
Products / Services
1,755
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Detects bursts of Microsoft Graph API calls hitting multiple distinct reconnaissance endpoints within a 60-second window. This behavior can indicate an adversary performing rapid enumeration or discovery within a Microsoft 365 environment.
Detects successful user authentications originating from IP addresses associated with known EvilToken infrastructure hosted on Railway.com. This indicates potential compromise of user accounts via phishing or other credential access techniques, where the adversary is using their infrastructure to authenticate.
Detects attempts to add credentials or secrets to a service principal to establish persistence independent of user accounts. This rule specifically looks for 'Add service principal credentials' or 'Update application - Certificates and secrets management' operations in Azure AuditLogs.
Detects deployment of the VMAccess extension via Azure Management plane, which can be abused by attackers to create local backdoor administrators on Azure Virtual Machines.
Detects Graph API queries targeting getResourceTenants, identifying lateral movement preparation. This activity can be indicative of an adversary attempting to enumerate tenant relationships within Microsoft Graph to understand the environment and potentially identify targets for further compromise or lateral movement.
Detects the exchange of FOCI refresh tokens across the Microsoft app family, a tactic utilized by Tycoon 2FA. This KQL query identifies successful sign-ins where a single user's session (CorrelationId) interacts with more than 3 distinct applications within a 5-minute window, indicating potential token abuse.
Detects anomalous access to Privileged Access Management (PAM) platforms (e.g., CyberArk, BeyondTrust, Delinea, HashiCorp Vault, Thycotic, ARCON PAM). The rule identifies successful sign-ins occurring outside typical business hours (7 AM to 7 PM) that also exhibit either a high volume of sign-ins (more than 5 per hour per user/app) or access from multiple new IP addresses (more than 2 unique IPs per hour per user/app). This behavior is indicative of potential abuse of privileged accounts, possibly by threat actors like Silk Typhoon (HAFNIUM).
Detects sign-ins to Entra ID using Axios, Undici, or Node-Fetch user agents, which are fingerprints of Tycoon 2FA attacks. This rule helps identify potential multi-factor authentication bypass attempts.
Detects device code authentication via Microsoft Authentication Broker targeting Microsoft Graph, which is a known indicator of Adversary-in-the-Middle (AiTM) attacks or device code phishing.
Detects extraction of Azure Storage account keys (ListKeys) used to facilitate programmatic, static-auth data exfiltration.
Detects bulk Azure AD group membership enumeration via Graph API
Detects an unusually high volume of successful operations related to Azure App Services originating from a single caller within a one-hour window. This could indicate automated activity, reconnaissance, or a misconfigured application.
Detects network connection attempts to the cloud Instance Metadata Service (IMDS) endpoint (169.254.169.254) initiated by processes that are not known cloud management agents or system utilities, which may indicate unauthorized credential or IAM role token theft.
This rule detects the successful execution of the 'Run Command' action on Azure virtual machines outside of defined business hours (8 AM to 6 PM). Run Command allows the execution of arbitrary scripts on a VM, which can be leveraged for administrative tasks but also by attackers for post-exploitation activities, persistence, or lateral movement. Monitoring these operations during off-hours may indicate unauthorized use or anomalous administrative activity.
This rule detects potential cloud resource hijacking (e.g., cryptojacking) by monitoring for a sudden spike in the deployment of Azure virtual machines by a single user. It triggers if a user creates five or more virtual machines in a 10-minute window, specifically looking for deployments in regions where the user has not recently created VMs, or deployments utilizing high-compute SKUs commonly targeted for cryptocurrency mining.
Detects modifications or deletions of Conditional Access policies in an environment. This includes disabling policies or altering key configurations like users, groups, applications, platforms, or locations, which could be indicative of an attacker attempting to bypass security controls or maintain persistent access.
Detects inbound messages whose subject closely matches the campaign's reported stolen client data extortion wording. The rule looks for specific keywords like 'lost', 'confidential', 'data', 'clients' (all present) and 'very important', 'important', 'client data' (any present) in the email subject, specifically for inbound emails that are either the first contact or have no threat types identified.
Identifies login attempts from RedVDS infrastructure IPs deliberately utilizing legacy authentication protocols (IMAP/POP3) to bypass Modern Authentication Conditional Access policies.
Correlates browsers encountering a certificate error (invalid issuer) for a major cloud provider due to DNS redirection.
This rule detects suspicious authentication behavior where a user logs in with multiple unique devices and multiple MFA methods within a short timeframe (5 minutes). This could indicate an attempt to bypass multi-factor authentication or account compromise.
This rule detects suspicious activity involving the creation or update of managed identities and the assignment of highly privileged roles (Contributor, Owner, User Access Administrator) to them. It specifically looks for multiple such assignments within a one-hour window to managed identities associated with automation, runbook, or function resources, indicating potential privilege escalation or malicious access.
Page 120 of 185