Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,865 detections
Filters
Last updated
All Time
Detection languages
2,524
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,091
792
575
Platforms
39,932
7,263
6,535
3,865
3,643
Products / Services
1,755
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
This rule detects privilege escalation events associated with Azure Arc agent processes. It monitors for specific Windows Security Event IDs (4672, 4673, 4674, 4688) where the involved process or its parent is an Azure Arc agent process (himds.exe, azcmagent.exe, gc_worker.exe, gc_service.exe) and the SubjectUserName is not a standard system account. This helps identify potential attempts to elevate privileges using or targeting the Azure Arc agent.
Detects inbound emails originating from 'azure-noreply@microsoft.com' with subjects that typically indicate financial transactions (e.g., 'Invoice Paid', 'Payment Reference') or system alerts (e.g., 'MemorySpike', 'DiskFull'). This pattern could be indicative of phishing attempts leveraging a seemingly legitimate sender to trick recipients.
This analytic query detects potential phishing compromise activity by correlating URL click events from Defender for Office 365 with Sign-in device code authentication logs.
Detects mass device wipe, retire, or delete operations performed via Microsoft Intune, inspired by the Stryker/Handala attack. This rule combines five detection signals: static velocity threshold, bulk destructive actions from a single operator, first-time operator detection, UEBA anomaly correlation, and ML anomaly detection. Operations are categorized into Tier 1 (critical, zero baseline activity like wipe/retire) and Tier 2 (high, legitimate IT ops activity like device delete, subject to velocity and ML thresholds). Severity escalates based on the number of overlapping signals.
Detects when a single user account successfully signs in from two or more distinct IP addresses within a short timeframe. This can be an indicator of an adversary-in-the-middle (AiTM) attack where both the legitimate user and the attacker have active, authenticated sessions from different locations.
Detects command line executions from non-standard applications attempting to query the local Azure Arc metadata endpoints (ports 40341/40342), which may indicate an attacker enumerating or exploiting the HIMDS token service (CVE-2026-26117).
This rule detects several types of suspicious activities related to Microsoft Graph API calls, specifically targeting device management actions. It identifies: 1. Actions from an IP address not previously seen for a given caller identity. 2. Actions performed by a service principal that has not been observed before. 3. High-risk actions (e.g., device wipe, retire, remote lock, reset passcode) or device configuration changes occurring outside of business hours or on weekends. 4. Bulk device targeting, where a single caller identity performs actions on a large number of devices within a short time frame. These detections aim to identify potential compromise of accounts or malicious administrative actions.
Detects potential adversary-in-the-middle (AiTM) session hijacking by identifying a single session ID being used in successful sign-ins from multiple distinct IP addresses and with different User-Agent strings within a short timeframe. This behavior is indicative of an attacker stealing a session cookie and replaying it from their own machine, a technique commonly used by phishing kits like Tycoon2FA.
Detects potential adversary-in-the-middle (AiTM) session hijacking by identifying a single session ID being used in successful sign-ins from multiple distinct IP addresses and with different User-Agent strings within a short timeframe. This behavior is indicative of an attacker stealing a session cookie and replaying it from their own machine, a technique commonly used by phishing kits like Tycoon2FA.
Detects modifications to Azure AD federation settings or domain authentication methods. Such changes can be indicative of a Golden SAML attack, where an attacker establishes a new federation trust to forge SAML tokens and gain unauthorized access.
Azure Blob Storage Account Key Access
Cortex XDR
Detects successful access to Azure Blob Storage using storage account keys (key1 or key2). This activity is often indicative of an adversary using compromised credentials to access cloud storage resources.
Azure Blob SAS Access
Cortex XDR
Detects access to Azure Blob Storage using Shared Access Signature (SAS) authentication. This rule specifically looks for successful blob operations where the authentication type is SAS and the identity name matches 'key1' or 'key2', which are often associated with storage account access keys used to generate SAS tokens. Monitoring such access can help identify unauthorized or suspicious use of SAS tokens.
This rule detects suspicious activity where a new device is registered after a user browse or click on a Microsoft device login page. This could indicate an adversary attempting to register a new device to bypass multi-factor authentication or establish persistence.
This rule detects network connection events and Entra ID sign-in events originating from Iran. It aggregates these events hourly to identify potential suspicious activity from a geo-restricted or high-risk country.
This rule detects potential GraphRunner activity in Azure environments by identifying suspicious authentication attempts to Microsoft Graph using the 'deviceCode' authentication protocol, combined with specific user agent strings associated with the GraphRunner tool. It categorizes detections into high confidence (both device code and suspicious user agent), device code authentication only, or suspicious user agent only.
This rule detects impossible travel scenarios for user sign-ins that occur shortly after a device associated with that user has been wiped, retired, or deleted. It calculates the speed between consecutive sign-in locations for the same user and flags any travel exceeding 900 km/h, indicating a potential compromise or fraudulent activity.
KQL Query
This rule correlates an email URL click with a subsequent risky sign-in from the same user within a short timeframe (1 hour). This is a strong indicator of a successful Adversary-in-the-Middle (AiTM) phishing attack, such as those conducted with the Tycoon2FA kit, where a user is tricked into authenticating through a malicious site, allowing the attacker to capture their session.
This rule detects sign-in attempts originating from IP addresses associated with Starlink (Space Exploration Technologies) autonomous system. This could indicate an unusual access vector, especially if Starlink is not a common or expected internet service provider for the organization's users.
Detects successful sign-ins to the Microsoft Intune Company Portal (AppId '9ba1a5c7-f17a-4de9-a1f1-6178c8d51223') where Conditional Access Policies (CAP) have failed. This indicates an attempt to bypass device compliance requirements, potentially allowing access from non-compliant or unmanaged devices.
Correlates an email URL click with a subsequent risky sign-in from the same user within a short timeframe. This pattern is a strong indicator of a successful Adversary-in-the-Middle (AiTM) phishing attack, such as those conducted with the Tycoon2FA kit, where a user is tricked into authenticating through a malicious site, allowing the attacker to capture their session.
Page 139 of 185