Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,865 detections
Filters
Last updated
All Time
Detection languages
2,524
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,091
792
575
Platforms
39,934
7,265
6,535
3,865
3,645
Products / Services
1,755
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Detects the configuration change that enables the 'external rest endpoint' feature in SQL Server 2025. Threat actors can abuse this feature using sp_invoke_external_rest_endpoint to natively exfiltrate data and establish C2 channels.
This rule detects attempts to create new accounts on major cloud platforms (AWS, Azure, Google Cloud) by monitoring HTTP traffic for specific hostnames and the 'signup' keyword in the URI. It specifically looks for connections to 'aws.amazon.com', 'portal.azure.com', or 'console.cloud.google' with 'signup' in the URI, indicating a potential account creation activity.
Detects compromised serverless functions being used as C2 relay infrastructure
Detects modification of cloud compute infrastructure to evade detection or remove evidence
Detects creation of Intune device management scripts, a potential privilege abuse vector.
This rule detects attempts to enumerate Azure Blob Storage containers. It specifically looks for HTTP requests targeting Azure Blob storage hosts (ending with '.blob.core.windows.net') and containing the query parameter '?comp=list', which is used to list containers within a storage account. This activity is indicative of reconnaissance or discovery against Azure cloud resources.
This rule detects a high volume of web requests (20 or more within 5 minutes from a single IP address) containing keywords commonly associated with denial-of-service (DoS) attacks, performance testing, or reconnaissance activities against web applications. Keywords include 'sleep', 'benchmark', and 'loadtest' in the URI query string.
Detects serverless function deployments used as C2 infrastructure
This rule detects a high volume of web requests (20 or more within 5 minutes from a single IP address) containing keywords commonly associated with denial-of-service (DoS) attacks, performance testing, or reconnaissance activities against web applications. Keywords include 'sleep', 'benchmark', and 'loadtest' in the URI query string.
This rule detects an unusually high number of web search queries (identified by 'search' or 'query' in the URI) originating from a single IP address within a one-hour window. A threshold of 100 or more queries triggers the alert. This behavior could indicate automated activity such as web scraping, reconnaissance, or a denial-of-service attempt against the search functionality.
This rule identifies successful device code authentications using the Microsoft Authentication Broker application (AppId '29d9ed98-a469-4536-ade2-f981bc1d605e') targeting Microsoft Graph (ResourceIdentity '00000003-0000-0000-c000-000000000000'). It specifically looks for these authentications originating from untrusted network locations. This activity is highly anomalous and can indicate an attacker generating Primary Refresh Tokens (PRTs) via device code phishing.
This rule detects potential tampering with Conditional Access Policies in Azure Active Directory by monitoring for multiple update, delete, or add operations on policies containing 'Conditional Access' in their display name within a one-hour window. This could indicate an adversary attempting to weaken security controls to maintain access or bypass MFA.
This rule detects a spike in modifications or creations of Azure Diagnostic Settings within a one-hour window. A high volume of 'Diagnostic Setting' operations by a single caller could indicate an attempt to alter logging configurations, potentially to impair defenses or hide malicious activity.
This query summarizes successful operations performed on Azure Container Registries, grouped by the caller and hourly time bins. It can be used for auditing or monitoring legitimate activity.
This rule detects a spike in successful Azure Load Balancer operations from a single caller within an hour. A count of 3 or more successful operations from the same caller within a one-hour window will trigger this alert. This could indicate automated activity or unusual configuration changes related to load balancers.
This rule detects an unusual number of successful encryption-related operations performed by a single caller within a one-hour window in Azure Activity logs. This could indicate legitimate bulk administrative tasks or potentially malicious activity such as data encryption for impact (e.g., ransomware) or preparation for exfiltration by an attacker.
Detects a spike in successful operations related to Azure Storage Account Keys by a single caller within a one-hour window. This could indicate an adversary attempting to enumerate, access, or exfiltrate storage account keys, or a legitimate user performing multiple key management activities.
This query summarizes successful operations performed on Azure Container Registries, grouped by the caller and hourly time bins. It can be used for auditing or monitoring legitimate activity.
This rule detects when an attacker enumerates Azure AD group memberships via the Microsoft Graph API. It specifically looks for HTTP requests to 'graph.microsoft.com' with URI paths containing '/groups/' and '/members', indicating an attempt to list group members. A threshold is applied to detect a burst of such requests from a single source.
This rule detects HTTP POST requests to graph.microsoft.com with the URI containing 'roleAssignmentScheduleRequests'. This pattern is indicative of an Azure PIM (Privileged Identity Management) Just-in-Time role activation request, which is a mechanism for users to temporarily elevate their privileges within Azure AD. While a legitimate administrative action, it can also be used by attackers for privilege escalation.
This rule detects attempts to register a new OAuth application within Azure Active Directory by monitoring HTTP POST requests to the Microsoft Graph API endpoint '/applications' on 'graph.microsoft.com'. This activity can be indicative of an attacker establishing persistence or gaining unauthorized access to cloud resources by creating a malicious application.
Page 127 of 185