Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,864 detections
Filters
Last updated
All Time
Detection languages
2,523
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,448
1,199
1,091
792
575
Platforms
39,926
7,251
6,535
3,864
3,632
Products / Services
1,755
1,449
1,120
438
406
MITRE Techniques
1,888
1,391
913
814
726
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Detects anomalous sign-in behavior using the OAuth 2.0 device code authorization flow. The rule identifies sign-ins from previously unseen geographic locations or IP ranges (ASN) for a specific user, or detects a potential tenant-wide phishing campaign where multiple users are performing device-code authentications in a short timeframe, which is characteristic of 'device code phishing' (a form of OAuth consent phishing).
Detects modifications to Microsoft Entra ID (formerly Azure AD) cross-tenant access settings where a new partner is added or inbound trust settings (such as MFA or device compliance) are enabled for an external tenant. This activity may indicate an attempt to establish a persistent backdoor or facilitate initial access into the environment via a compromised or malicious external identity provider.
This rule detects anomalous activity involving cloud-based shell services (AWS CloudShell, Azure Cloud Shell, GCP Cloud Shell). It triggers on two main conditions: (1) First-time usage of these shell environments by a principal within the detection window, and (2) The execution of commands associated with data staging, ingress tool transfer, or exfiltration (e.g., curl, wget, storage copy commands).
Detects unauthorized sharing, copying, or exporting of EBS, disk, or database snapshots to external cloud accounts, subscriptions, or projects that are not present in the defined trusted allow-list for AWS, Azure, or GCP environments.
Detects the creation of new programmatic credentials (AWS access keys, Azure AD service principal credentials, or GCP service account keys) where the identity creating the credential differs from the identity for which the credential is being issued. This behavior is often indicative of persistence mechanisms or credential abuse where an attacker with sufficient permissions creates secondary credentials for other accounts.
This rule detects the creation or modification of recurring cloud automation tasks (AWS EventBridge rules, Azure Automation Runbooks/Logic Apps, and GCP Cloud Scheduler jobs). Adversaries leverage these features to establish persistent access to a cloud environment by ensuring malicious code or scripts execute automatically, even after initial compromised credentials have been revoked.
Detects modifications to cloud-based IAM trust policies or resource policies that grant access to an external account, tenant, or project. This activity can indicate an attacker attempting to establish persistent backdoor access via cross-account trust relationships, bypassing standard identity controls.
Detects modifications to cloud security guardrails including AWS Service Control Policies (SCPs), Azure Policy assignments/exemptions, and GCP Organization Policies. These actions may indicate an attempt to disable security controls or weaken organizational policy enforcement.
Detects successful cloud console login events across AWS, Azure, and GCP where multi-factor authentication (MFA) was not utilized, combined with impossible travel indicators (login from different countries within an 8-hour window for the same principal).
Detects sign-in activity using refresh tokens from device details (deviceId, browser, OS) that have not been previously observed for the user. This pattern is indicative of session token theft, often associated with Adversary-in-the-Middle (AiTM) phishing kits where attackers replay stolen session or refresh tokens to bypass multi-factor authentication.
This rule detects scenarios where a new credential (password or key) is added to a service principal or application, followed by an authentication event using that service principal within a short window (1 hour). This pattern is indicative of potential credential injection or persistence attempts, where an attacker adds a secret and immediately leverages it to establish access.
This rule detects scenarios where a new credential (password or key) is added to a service principal or application, followed by an authentication event using that service principal within a short window (1 hour). This pattern is indicative of potential credential injection or persistence attempts, where an attacker adds a secret and immediately leverages it to establish access.
Detects OAuth application consent events where an application is granted a combination of 'offline_access' (allowing refresh token issuance) and email-read permissions. This pattern is commonly used by adversaries to establish persistent, long-term access to user mailboxes for data exfiltration or Business Email Compromise (BEC) activities, surviving password changes until the consent is explicitly revoked.
This rule identifies potential account compromise through the detection of non-interactive Azure AD sign-ins originating from geographically distant locations within a short, travel-implausible timeframe. Such activity is highly indicative of the theft and export of a Primary Refresh Token (PRT) from a legitimate endpoint, which is subsequently replayed by an adversary from external infrastructure to gain unauthorized access to cloud resources.
Detects the addition of certificate-type credentials (AsymmetricX509Cert, usage=Verify) to Microsoft Entra ID (Azure AD) applications or service principals. This behavior is indicative of an attacker adding an adversary-controlled certificate to impersonate an application or service principal to achieve persistent, long-lived access.
Detects the suspicious sequence of adding a domain or changing federation settings followed rapidly by a configuration update to the federated domain. This pattern is indicative of an adversary establishing a covert federated backdoor for persistent, delegated authentication, allowing bypass of standard credential rotation mechanisms.
Detects modifications to Microsoft Entra ID (formerly Azure AD) cross-tenant access policies or B2B synchronization settings. Specifically, this rule monitors for the addition of new external partner tenants to trust lists or the relaxation of security controls such as MFA and compliant device requirements for external partner access.
Detects modifications to Microsoft Entra ID (formerly Azure AD) applications, service principals, or Application Proxy configurations that could be indicative of an adversary establishing persistent external access. This includes updates to external URLs, SSO settings, and authentication types, which are frequently used to facilitate persistence via malicious cloud application configurations.
This rule detects administrative changes to Conditional Access (CA) policies in Entra ID (Azure AD), specifically monitoring for the disabling of policies, transitioning them to report-only mode, or the removal of critical security grant controls such as MFA or Compliant Device requirements. It also alerts on the outright deletion of any CA policy, which could indicate an adversary attempting to bypass security controls or maintain persistent access.
Detects Azure Activity Log events where a Storage Account is modified to enable public network access, public blob access, or container-level public access. Such misconfigurations can lead to unauthorized data exposure and exfiltration by internet-based actors.
This rule detects suspicious activities targeting cloud management hierarchy, specifically identifying attempts to remove AWS accounts from organizations, disable policy enforcement, create rogue accounts, or hijack Azure subscriptions through unauthorized transfers or tenant changes. Such actions are often used by adversaries to bypass security guardrails, remove organizational visibility, or establish persistent unauthorized access within a cloud environment.
Page 16 of 184