Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,865 detections
Filters
Last updated
All Time
Detection languages
2,524
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,091
792
575
Platforms
39,932
7,263
6,535
3,865
3,643
Products / Services
1,755
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Detects successful POST requests to better-auth API key creation or update endpoints that appear to be unauthenticated. This pattern is indicative of exploitation of CVE-2025-61928, where an attacker can create or modify API keys for any user without a valid session.
This rule detects suspicious enumeration of Azure Blob, File, Table, Queue, or DFS storage accounts by internal users. It identifies devices making network connections to public Azure storage URLs using potentially suspicious processes (e.g., PowerShell, Python, AzCopy, curl, wget, WinSCP, FileZilla, Storage Explorer). The rule then analyzes the distinct storage accounts accessed and uses a Jaccard index to identify unusual naming conventions among the accessed storage accounts, potentially indicating an insider attempting to discover or exfiltrate data from unfamiliar storage resources.
This detection identifies the execution of SyncAppvPublishingServer.vbs—a legitimate Microsoft App‑V script—when launched under wscript.exe or cscript.exe, which is abnormal outside of App‑V environments. Although the script is signed by Microsoft and intended to support application publishing workflows, threat actors have increasingly adopted it as a LOLScript-based execution proxy. By invoking this script directly and supplying crafted arguments, adversaries can cause it to spawn PowerShell or run additional commands on their behalf, often without ever calling powershell.exe explicitly. This evasion is highly effective against visibility controls that rely on direct process-name monitoring.
This rule detects suspicious user-agent strings in Microsoft Graph activity logs that are commonly associated with reconnaissance and attack tools targeting Azure AD and Microsoft 365 environments. These tools include BloodHound, ROADtools, AADInternals, and various other utilities used for enumeration, credential spraying, and other malicious activities.
Detects lateral movement where a Managed Identity of one Azure resource (e.g., VM) is used to execute code or access another resource. This is identified by successful 'Microsoft.Compute/virtualMachines/runCommand' operations where the caller is a ServicePrincipal (indicated by a GUID) and the 'InitiatedBy' field contains 'resourcegroups', suggesting the action was initiated by a resource rather than a direct user.
This rule identifies user accounts that have one or more roles assigned to them. It queries the 'IdentityInfo' table, filters for entries where the 'AssignedRoles' field is not empty, and then projects relevant account details such as UPN, display name, assigned roles, and object ID. Finally, it summarizes the data to retrieve the most recent record for each unique account object ID.
Detects when a Managed Identity successfully authenticates via the Azure Instance Metadata Service (IMDS) and subsequently performs administrative or enumeration actions within a short timeframe. This pattern can indicate an attacker has compromised a resource (e.g., a Virtual Machine) and is using its Managed Identity to move laterally or access other resources within the Azure environment. The rule correlates successful IMDS-based sign-ins with subsequent activities such as running commands on virtual machines, or listing/getting secrets and keys from Key Vaults, or other general administrative/alert-generating activities.
Detects when a VM Run Command is executed successfully, followed by the VM's Managed Identity authenticating to Azure Resource Manager. This pattern may indicate an attacker using Run Command to steal MI tokens for lateral movement.
This is a KQL script to automate investigation by full email address. This can be pitched as a workbook as well. Keep in mind all the extra stuff is there for automation, this doesn't need to be your day-to-day query. There's simpler stuff you can make it on the fly in a matter of seconds and give you similar results. This here is for extra information in case you need a single pane of glass.
Detects potential lateral movement attempts within Azure by a Service Principal (Managed Identity) executing 'runCommand' or other compute operations on virtual machines. This activity could indicate an attacker abusing a compromised Managed Identity to gain access to and control other resources.
This detection identifies when a Managed Identity (Service Principal) successfully executes a 'RunCommand' on an Azure virtual machine. This activity is a key indicator of lateral movement, where an attacker, having compromised a resource with a Managed Identity, uses that identity's permissions to execute code on another VM.
Detects successful VPN connections from various common security devices logging to CommonSecurityLog. Monitoring successful VPN logins is crucial for tracking remote access and identifying potential unauthorized access, especially when correlated with other events like logins from unusual locations or impossible travel scenarios.
Of course you can get an easier version to simply search emails by subject, this is too verbose. But this is used to make a workbook that will display a set of information about the incident and give you the possibility to click on a button, generate this and visit the incident's page.
This rule detects successful sign-ins to Azure Active Directory (AAD) from IP addresses outside of Australia and New Zealand, where the User-Agent string matches a list of known suspicious User-Agents. It filters out many legitimate User-Agents to reduce false positives, including those from Microsoft applications, mobile devices, and common tools.
Detects Windows logon events where the account name starts with 'WAC_' and belongs to a domain outside of the organization's tenant. This pattern is a key indicator for CVE-2026-20965 exploitation, where an attacker uses a forged token from an external tenant to gain unauthorized access to a Windows Admin Center (WAC) managed machine.
This query utilizes the IOCs provided by Rapid7 and focuses on columns in the DeviceFileEvents, DeviceProcessEvents and DeviceNetworkEvents tables. This is a high FP query, however each event will require an investigation to its legitimacy. The query accounts for all devices that have installed notepad++ in the past 400d and only looking for IOCs within time of known compromise in order to save on resources. Some IOCs are commented out due to high FP rate.
This rule detects successful sign-ins to Azure Active Directory (AAD) from IP addresses outside of New Zealand and Australia, where the User-Agent string matches a list of known suspicious User-Agents. It filters out many legitimate User-Agents to reduce false positives, including those from Microsoft applications, mobile devices, and common system services. The rule aims to identify potential unauthorized access attempts or compromised accounts leveraging unusual client software or scripts.
This rule detects sign-in attempts to Azure Active Directory (AAD) service principals where the User-Agent string contains "TruffleHog". TruffleHog is an open-source tool used for finding sensitive data (like credentials) in various data sources. Its presence in AAD sign-in logs, especially for service principals, could indicate an attempt to scan for or verify leaked secrets or credentials associated with service accounts.
This rule detects suspicious resource access patterns in Azure. Specifically, it flags instances where an 'Account' type actor (identified by a username) accesses resources that are not explicitly allowed for security monitoring (SecMon) or security orchestration, automation, and response (SecSoar) purposes. The rule also filters out activities from 'Microsoft-WindowsAzure-Frontdoor' and specific 'Microsoft.Resources' actions to reduce false positives. The primary goal is to identify unauthorized or unusual access to Azure resources by user accounts that fall outside defined security operational scopes.
This is a credential after-hours logon activity automation, whenever an employee that's not supposed to log on to the core banking system after hours do so, this will trigger and alert the SOC team.
This is for when we need to investigate user navigation through proxy logs to understand if visit was intentional or if it was a sideload (redirect/iframe/malvertising) causing the navigation.
Page 143 of 185