Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,865 detections
Filters
Last updated
All Time
Detection languages
2,524
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,091
792
575
Platforms
39,932
7,263
6,535
3,865
3,643
Products / Services
1,755
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
This rule detects potential MFA push fatigue attacks by identifying a high volume of failed multi-factor authentication challenges for a single user within a short time window. It aggregates sign-in logs, specifically looking for result types indicative of MFA failures, and alerts if a user receives more than a defined threshold of MFA challenges within a 30-minute period.
This rule detects a potential quishing (QR code phishing) attack followed by a suspicious successful sign-in to Entra ID (formerly Azure AD). It correlates URL click events or device network events containing deep link indicators (like 'tg://login', 'wa.me/settings/linked_devices', 'signal://', 'line://') or '.apk' file downloads with a successful Entra ID sign-in by the same user within a 30-minute window. This behavior suggests a user may have scanned a malicious QR code, clicked a phishing link, or downloaded a malicious application, leading to a successful but potentially compromised authentication.
This rule detects password spraying attacks where a single IP address attempts to authenticate against multiple unique user accounts within a specified time window, resulting in failed sign-in attempts. It specifically looks for a high number of unique users failing authentication from the same IP, which is characteristic of password spraying to avoid account lockouts.
This rule detects when multi-factor authentication (MFA) or strong authentication settings are disabled or removed for a user account. It specifically looks for successful audit log entries related to operations such as 'Disable Strong Authentication', 'Update user', 'Update StsRefreshTokensValidFrom', 'Admin registered security info', or 'Admin deleted security info'. This activity could indicate an adversary attempting to maintain persistent access to a compromised account by weakening its authentication requirements.
Enrichment rule pulling identity details from IdentityInfo table.
Correlated with AuditLogs via AccountUPN to enrich admin and target
user identity details including department and job title.
Used in correlation with Rule 09198296-c7e9-43a7-b85f-6aaa70d281c5
via correlation rule 5841b08f-f363-4139-a70a-5cc91e13efc3.
Note: Multiple join fallback logic (by UPN, last name, full name)
and StrippedAdminName prefix removal are handled natively in KQL.
Correlated with AuditLogs via AccountUPN to enrich admin and target
user identity details including department and job title.
Used in correlation with Rule 09198296-c7e9-43a7-b85f-6aaa70d281c5
via correlation rule 5841b08f-f363-4139-a70a-5cc91e13efc3.
Note: Multiple join fallback logic (by UPN, last name, full name)
and StrippedAdminName prefix removal are handled natively in KQL.
This rule detects high-volume access to Azure Key Vault secrets, keys, or certificates within a one-hour window. It specifically looks for successful read operations on secrets, keys, and certificates, as well as modifications to access policies. A high volume (more than 10 accesses) from a single caller within an hour is flagged as potential credential harvesting.
This rule detects when a high-privilege role is assigned to a user in Azure Active Directory. It specifically looks for 'Add member to role', 'Add eligible member to role', or 'Add scoped member to role' operations that successfully assign one of a predefined list of privileged roles (e.g., Global Administrator, Security Administrator, Application Administrator) to a user. This activity can indicate privilege escalation or unauthorized access within an Azure AD environment.
This rule detects outbound network connections to known Command and Control (C2) and exfiltration domains associated with the SANDWORM_MODE campaign. These domains are used to exfiltrate stolen credentials and other sensitive data.
This rule identifies the creation or deletion of user accounts in Azure AD (Entra ID) by principals not on an approved list. It relies on a customized list of approved administrators/service principals to reduce false positives.
Identifies successful Entra ID sign-ins using the Device Code Flow from a geographic location not seen for that user in the last 30 days. The device code flow involves two separate interactions (the attacker's device and the victim's browser), so a mismatch between the sign-in location and the user's established locations is a strong indicator of a session hijacking attempt.
This detection identifies potentially malicious SSH tunneling activity initiated by OpenClaw‑derived AI agents, including earlier variants such as Clawdbot and Moltbot. OpenClaw is known to operate with extensive access to the underlying operating system and command‑line interface, creating opportunities for misuse when vulnerable or misconfigured. Instances of OpenClaw have been shown to expose sensitive automation capabilities, making them a high‑risk launching point for unauthorized system‑level actions.
The rule specifically looks for SSH or Plink processes executed with tunneling or proxying flags (such as -L, -R, -D, -oProxyCommand, and similar switches commonly associated with port forwarding, lateral movement, credential exfiltration, covert channels, and SOCKS proxy creation). When these commands originate from OpenClaw, Clawdbot, or Moltbot processes, it may indicate that an AI agent has been compromised or repurposed to establish unauthorized remote access pathways.
The rule specifically looks for SSH or Plink processes executed with tunneling or proxying flags (such as -L, -R, -D, -oProxyCommand, and similar switches commonly associated with port forwarding, lateral movement, credential exfiltration, covert channels, and SOCKS proxy creation). When these commands originate from OpenClaw, Clawdbot, or Moltbot processes, it may indicate that an AI agent has been compromised or repurposed to establish unauthorized remote access pathways.
Multi-layered detection rule that identifies anomalous behavior on privileged accounts across six independent detection layers: absolute rule violations ("never actions"), self-calibrating ratio-based thresholds, behavioral technique substitution (e.g., WMI drop-off while other lateral movement continues), time-series statistical anomaly detection via series_decompose_anomalies(), reconnaissance burst detection on LDAP/directory queries, and MFA gap analysis. All layers roll up into a composite risk score for analyst prioritization. Originally derived from diffpatterns() analysis of real penetration test data vs. normal operations, this community edition replaces environment-specific hardcoded thresholds with self-calibrating statistical baselines. Requires Microsoft Defender for Identity and Entra ID Sign-in Logs.
This rule detects suspicious activity where an 'unfamiliar sign-in properties' alert occurs shortly after an administrator has changed a user's Multi-Factor Authentication (MFA) method. It correlates security alerts for unfamiliar sign-ins with audit logs indicating MFA method changes for the same user within a short timeframe. The rule then checks if the user's sign-in activity shows multiple IP addresses or locations, indicating a potential compromise or MFA bypass after the change.
This rule detects potential lateral movement within Azure by identifying instances where a Managed Identity of one Virtual Machine (VM) is used to execute commands on another VM. It specifically looks for Azure Activity logs where the caller is a Service Principal, the 'InitiatedBy' field (xms_mirid) contains 'resourcegroups', and the operation name indicates a 'runCommand' or a 'Microsoft.Compute' action. This combination suggests that a Managed Identity is being leveraged to perform actions across VMs, which could be indicative of an attacker moving laterally after compromising a VM with an attached Managed Identity.
This rule detects sign-ins by Azure Managed Identities where the token was likely obtained via the Instance Metadata Service (IMDS). It identifies these sign-ins by looking for 'ImdsIdentityProvider' in the UserAgent or 'Imds' in the ClientCredentialType within AADManagedIdentitySignInLogs. This activity could indicate lateral movement through abuse of managed identities attached to virtual machines.
Detect the email delivery delta, comparing before and after the Priority Account Protection Enablement date.
This rule detects modifications to properties of 'break glass' accounts. It joins a watchlist of identity categories containing 'Break Glass' accounts with Azure Audit Logs to identify specific operations performed on these accounts. The rule focuses on changes to user principal names, operation names, activity display names, results, and AAD operation types.
This rule detects sign-in attempts by 'Break Glass' accounts. Break Glass accounts are emergency access accounts typically used in situations where normal administrative access methods are unavailable. Monitoring their usage is critical due to the high privileges usually associated with these accounts. The rule joins sign-in logs with a watchlist of identities to specifically identify activity related to these designated accounts.
Identifies successful Entra ID sign-ins using the Device Code Flow from a geographic location not seen for that user in the last 30 days. The device code flow involves two separate interactions (the attacker's device and the victim's browser), so a mismatch between the sign-in location and the user's established locations is a strong indicator of a session hijacking attempt.
This rule detects when a guest user from a common public email domain (e.g., gmail.com, outlook.com) is invited to an Azure Active Directory (AAD) tenant and subsequently added to an AAD security group. This could indicate an attempt to grant unauthorized access to an external account or a misconfiguration allowing guest users to be added to sensitive groups.
This rule detects when an external user is invited to Azure Active Directory (AAD) from a common, publicly available email domain (e.g., gmail.com, outlook.com, yahoo.com). This can be an indicator of an attacker attempting to establish persistence or gain initial access by inviting an external account they control, or it could be a legitimate business process for collaboration with external parties using personal email addresses.
Page 142 of 185