Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,864 detections
Filters
Last updated
All Time
Detection languages
2,523
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,448
1,199
1,091
792
575
Platforms
39,937
7,246
6,535
3,864
3,628
Products / Services
1,755
1,449
1,120
438
406
MITRE Techniques
1,888
1,391
913
814
726
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Detects when an Azure Blob Storage container's access level is changed to allow public access, or when a long-lived, highly privileged Shared Access Signature (SAS) token is created. Threat actors can use these methods for persistence and data exfiltration.
Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith. The rule specifically looks for 'UserLoggedIn' operations with 'Success' status for the Microsoft Intune Company Portal ApplicationId, while excluding a specific ObjectId often associated with mobile device enrollment to reduce false positives.
Detects the registration of a new device or MFA authentication method in Microsoft Entra ID from an IP address geolocated to Morocco or associated with specific Moroccan ASNs. This is a persistence tactic used by the Jingle Thief group (also tracked as Atlas Lion and STORM-0539).
This rule detects when a user successfully elevates their permissions to manage all Azure Subscriptions. This action grants broad access across the Azure environment and should be immediately investigated if it is not a planned administrative activity. Such an elevation could be leveraged by an attacker to gain extensive control over Azure resources.
This rule detects attempts to read or retrieve BitLocker recovery keys from Azure audit logs. This activity can be indicative of an attacker attempting to gain access to encrypted data on compromised devices or to bypass disk encryption for persistence or defense evasion.
This rule detects when user accounts are created or deleted in Azure Active Directory by users who are not on an approved list. It specifically looks for 'Add user' or 'Delete user' messages in the audit logs with a 'Success' status, and then filters out actions initiated by known, approved administrators.
This rule detects when a user is added to an administrator's role within Azure Active Directory. This is a critical event as it grants elevated privileges to the user, which could be abused for malicious purposes such as persistence, privilege escalation, or initial access. The detection specifically looks for 'Add member to role.' operations in AzureActiveDirectory workload where the new role value ends with 'Admins' or 'Administrator'.
This rule detects the use of legacy authentication protocols for sign-ins to Azure AD. Legacy authentication protocols (such as POP3, IMAP, SMTP, MAPI, Exchange ActiveSync, Exchange Web Services, and 'Other client') do not support modern security features like Multi-Factor Authentication (MFA) and are often targeted by attackers for credential stuffing, brute-force attacks, and other credential-based attacks. Detecting and alerting on these sign-ins helps identify potential compromise or policy violations.
Detects when a temporary access pass (TAP) is added to an account in Azure AD. TAPs are a passwordless authentication method that can be used for onboarding, recovery, or as a strong credential. The addition of a TAP, especially to privileged accounts, should be investigated as it could indicate an attempt to gain or maintain unauthorized access.
This rule detects when Privileged Identity Management (PIM) alerts are disabled within Azure. Disabling PIM alerts can be a defense evasion tactic, as it prevents security teams from being notified of critical activities related to privileged roles, potentially allowing an attacker to operate undetected after gaining initial access or escalating privileges.
Detects successful sign-ins by privileged role accounts that occur outside of normal business hours or from unusual geographic locations. This rule is designed to flag potentially suspicious activity that could indicate compromised credentials or insider threat activity, especially for administrative accounts.
Identifies when a user grants permissions to another user on Azure resources. The rule specifically looks for the 'Microsoft.Authorization/roleAssignments/write' operation in Azure Activity Logs, which indicates a role assignment creation or modification. This can be an indicator of privilege escalation or persistence.
This rule detects when a user's account type is changed from 'Guest' to 'Member' within Azure Active Directory. This change signifies an elevation of privileges for the user, as 'Member' accounts typically have broader access and capabilities compared to 'Guest' accounts. Such a modification could be an indicator of an adversary attempting to gain higher privileges or establish persistence within the cloud environment.
Detects when a Privileged Identity Management (PIM) elevation request is approved or denied within Azure AD. This rule helps monitor critical administrative actions related to privilege escalation. Any approvals or denials outside of expected administrative operations should be investigated as they could indicate unauthorized privilege management or attempts to bypass security controls.
This rule detects successful sign-in attempts to Azure AD from devices that are not registered in Active Directory (non-compliant devices) and where Multi-Factor Authentication (MFA) was not required. The sign-in is also flagged as 'atRisk' by Azure AD. This scenario can indicate an adversary attempting to gain initial access or maintain persistence using compromised credentials from an unregistered device, bypassing stronger authentication controls.
This rule identifies a critical security misconfiguration or bypass scenario within Azure Privileged Identity Management (PIM) where a privileged role can be activated without requiring multi-factor authentication (MFA). This can significantly increase the risk of unauthorized access and privilege escalation if an attacker compromises credentials for an account with PIM roles.
This rule detects instances where a user denies a multi-factor authentication (MFA) prompt. This could indicate that an attacker has successfully obtained the user's password and is attempting to gain unauthorized access, prompting the legitimate user for MFA approval. The user's denial signals that they did not initiate the login attempt.
Detects when new credentials (certificates or secrets) are added to an existing application or service principal within Azure/Entra ID. This activity, if not part of expected workflows, could indicate a malicious actor establishing persistence or escalating privileges by adding their own credentials to an application.
Monitors for successful device registration or join events in Azure AD where Multi-Factor Authentication (MFA) was not performed. This could indicate an adversary bypassing MFA to gain persistent access or escalate privileges by registering a new device.
This rule identifies when a user or application modifies the federation settings on a domain within Azure Active Directory. Such modifications can impact how users authenticate and can be leveraged by attackers for persistence, privilege escalation, or defense evasion by altering trust relationships.
Detects when changes are made to Privileged Identity Management (PIM) role settings within Azure Active Directory. This could indicate an attempt to alter how privileged roles are managed, potentially to facilitate unauthorized access or persistence.
Page 147 of 184