Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,864 detections
Filters
Last updated
All Time
Detection languages
2,523
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,448
1,199
1,091
792
575
Platforms
39,932
7,263
6,535
3,864
3,643
Products / Services
1,755
1,449
1,120
438
406
MITRE Techniques
1,888
1,391
913
814
726
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Detects when a user without the necessary permissions attempts to invite a guest user in an Azure environment, indicated by a failed 'Invite external user' operation in the audit logs. This could signify an attempt at unauthorized access, privilege escalation, or persistence.
This rule detects the successful creation of a new administrative account within an Azure environment. It specifically looks for audit log entries indicating both 'Add user' and 'Add member to role' actions occurring successfully, which signifies a user being created and then assigned a privileged role.
Detects failed authentication attempts originating from geographic locations (countries) that are not part of the organization's approved operational regions. This rule helps identify potential unauthorized access attempts or credential stuffing attacks from unexpected sources.
This rule detects changes to an application's Uniform Resource Identifier (URI) configuration within Azure. Such changes can include modifications to domain names, protocol usage (e.g., switching from HTTPS), the introduction of wildcards, or URIs pointing to uncontrolled domains. These types of modifications can be indicative of an attacker attempting to redirect traffic, establish persistence, or facilitate other malicious activities by altering how an application is accessed or interacts with external resources.
Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.
This detection identifies when a user successfully authenticates from a country for the first time within a given period. It establishes a baseline of known countries for each user and alerts on any successful login originating from a country not present in that baseline. This behavior can indicate compromised credentials being used from an unusual location, or a legitimate user traveling to a new country.
KQL Query
This analytic identifies the modification of the SourceAnchor (ImmutableId) attribute for an Azure Active Directory user. This detection leverages Azure AD audit logs, specifically monitoring the "Update user" operation and changes to the SourceAnchor attribute. This activity is significant as it is a step in setting up an Azure AD identity federation backdoor, allowing an adversary to establish persistence. If confirmed malicious, the attacker could impersonate any user, bypassing password and MFA requirements, leading to unauthorized access and potential data breaches.
This analytic detects the addition of a new federated domain within an Azure Active Directory tenant. It identifies successful "Set domain authentication" operations in Azure AD AuditLogs. This activity is significant as it may indicate the use of the Azure AD identity federation backdoor technique, allowing an adversary to establish persistence. If confirmed malicious, the attacker could impersonate any user, bypassing password and MFA requirements, potentially leading to unauthorized access and control over the Azure AD environment.
Researching about how to classify ISP based on different factors, I created a query based on ISP sign-in attempts.
KQL Query from file: Palo Alto Scanning Surges Detection
This rule detects potential device code phishing attempts by correlating URL click events with sign-in logs using the 'deviceCode' authentication protocol. It specifically looks for successful or failed sign-ins (result types 0, 50074, 50076, 500121) that occur after a user clicks on a URL.
KQL Query
Detects potential Multi-Factor Authentication (MFA) fatigue attacks by identifying a high number of MFA denial events for a single user within a short timeframe. This rule specifically looks for sign-in logs where the user explicitly declined the authentication prompt, indicating a possible attempt by an attacker to bombard the user with MFA requests until they approve one.
This rule detects suspicious sign-in attempts to Microsoft services (login.microsoftonline.com, graph.microsoft.com, outlook.office365.com) that occur within 30 minutes of a user clicking on a URL associated with these services. The sign-in is considered suspicious if it originates from a user agent commonly used by automated tools (e.g., axios, curl, python-requests, httpclient, Go-http-client) and is flagged with a 'atRisk' or 'high' risk level by Azure AD. This combination suggests a potential credential compromise following a phishing attempt, where an attacker might be using automated tools to leverage stolen credentials.
This rule detects instances where a user clicks on a URL identified as potentially malicious (phishing-related) and subsequently has a risky sign-in event in Azure AD. The rule correlates URL click events from email with Azure AD sign-in logs, specifically looking for sign-ins marked as risky or originating from suspicious user agents (e.g., specific axios versions). The phishing URLs are identified by keywords such as 'azureapplicationregistration.pages.dev', 'chrnobinson.com', 'workers.dev', '.pages.dev', '.web.core.windows.net', '/oauth2/v2.0/authorize', 'client_id=', and 'scope=openid'.
This rule identifies successful user sign-ins originating from IP addresses known to belong to VPN services. It leverages an external list of VPN IP ranges to correlate with Azure AD SigninLogs. This can indicate an attempt to bypass geo-restrictions, hide true origin, or could be legitimate use of a VPN by an employee.
Detects .NET DLLs containing hardcoded Azure Storage Account credentials, such as access keys or SAS tokens. This technique was observed in the Axis Communications plugin for Autodesk Revit, where it could have enabled a supply chain attack.
This rule detects successful or failed logon attempts originating from IP addresses identified by threat intelligence as associated with botnets, command and control (C2) infrastructure, or proxies. The rule specifically looks for 'LogOn' or 'FailedLogOn' activity types where the source IP's threat intelligence indicator type is 'Botnet', 'C2', or 'Proxy', and where activity insights are available.
Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.
Detects the creation or update of an Azure Sentinel analytics rule. This can indicate administrative activity related to security monitoring configuration. Monitoring these changes is crucial for detecting potential tampering with detection capabilities or the introduction of malicious rules.
Page 150 of 184