Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
472 detections
Filters
Last updated
All Time
Detection languages
342
74
19
16
7
Contributors
91
90
77
52
35
Categories
182
148
81
66
60
Platforms
406
68
63
58
26
Products / Services
10,680
9,761
6,694
4,418
3,744
472
MITRE Techniques
180
121
96
78
71
CVEs
6
5
5
5
2
IDS Classtypes
2
1
1
1
1
IDS Protocols
6
This rule detects when Azure Monitor Diagnostic Settings are deleted. It specifically looks for HTTP DELETE requests to 'management.azure.com' with 'diagnosticSettings' in the URI. This activity could indicate an attacker attempting to evade detection by removing logging configurations.
Azure REST API Command Execution
Suricata
This rule detects HTTP POST requests to the Azure management API (management.azure.com). A high volume of such requests (20 within 10 seconds from the same source) could indicate automated activity, potentially related to command execution or resource manipulation within an Azure environment.
Detects OAuth bearer tokens being reused from unexpected IP addresses
This rule detects a high volume of HTTP GET requests to Azure Blob Storage, specifically targeting '.blob.core.windows.net' domains. A threshold of 50 requests within 60 seconds from a single source IP address triggers the alert, indicating a potential bulk data download activity. This could be indicative of data exfiltration or unauthorized access to cloud storage.
This rule detects repeated HTTP requests to 'management.azure.com' with the URI '/resources', indicating an attempt to enumerate Azure resource groups. The threshold of 10 requests within 30 seconds from the same source is set to identify potential scanning or reconnaissance activities.
This rule detects a high frequency (3 or more within an hour) of command-line executions containing keywords like 'antivirus', 'defense', or 'endpoint' on a Windows system. This activity could indicate an adversary attempting to interact with, disable, or tamper with security software to evade detection.
This rule detects a high frequency (3 or more within an hour) of command-line executions containing keywords like 'antivirus', 'defense', or 'endpoint' on a Windows system. This activity could indicate an adversary attempting to interact with, disable, or tamper with security software to evade detection.
This rule detects a high frequency (3 or more within an hour) of command-line executions containing keywords like 'antivirus', 'defense', or 'endpoint' on a Windows system. This activity could indicate an adversary attempting to interact with, disable, or tamper with security software to evade detection.
This rule detects suspicious activity involving API key rotation followed by high usage. It correlates audit logs for API key operations (rotate, update, create) with cloud application events showing API requests or token usage. Specifically, it looks for instances where an API key is rotated, updated, or created, and then subsequently used more than 50 times within a day by the same actor. This could indicate an adversary gaining access to an API key and then rapidly utilizing it for malicious purposes.
This rule detects an abnormal volume of large file downloads or exports from cloud applications, excluding SharePoint, OneDrive, and Teams. It identifies instances where a single account downloads or exports more than 3 files with an average size greater than 10 MB within an hour from a specific application and IP address. This behavior could indicate data exfiltration or unauthorized data access.
This rule detects potential command and control (C2) beaconing activity by monitoring network events for specific URL patterns and user agent strings associated with known C2 frameworks like AzureVeil and Adaptix. It identifies beaconing if multiple devices communicate with the same remote IP address using these indicators within a 15-minute window, with more than 5 beacon counts and more than 1 distinct device.
Detects indicators associated with the MiniUpdate RAT deployed by the threat group Screening Serpens. This rule identifies network connections to known C2 domains, the creation of a persistence scheduled task named 'WindowsSecurityUpdate', and the dropping of specific RAT module DLLs ('UpdateChecker.dll', 'InitInstall.dll', 'Updater.dll') in common user-writable directories. The file event detection is tuned to require multiple generic DLLs or the presence of 'InitInstall.dll' to reduce false positives.
This rule detects HTTP POST requests to 'management.azure.com' with a URI containing 'bastionHosts'. This pattern indicates an attempt to establish a direct VM connection via Azure Bastion, which could be used for lateral movement within an Azure environment.
Detects network connections to Azure App Services domains containing healthcare or service-themed keywords originating from non-browser processes. Obsidian Sandstorm utilizes these tailored subdomains for C2 communications to blend in with legitimate enterprise network traffic.
This rule detects suspicious activity involving API key rotation followed by high usage. It correlates audit logs for API key operations (rotate, update, create) with cloud application events showing API requests or token usage. Specifically, it looks for instances where an API key is rotated, updated, or created, and then subsequently used more than 50 times within a day by the same actor. This could indicate an adversary gaining access to an API key and then rapidly utilizing it for malicious purposes.
This rule identifies potential network scanning or high-volume communication by detecting a large number of connections (50 or more) between a single source IP and a single destination IP within a 5-minute time window. It aggregates connection details such as total connections, sent bytes, and received bytes from the CommonSecurityLog.
Flags Intune assignments to “All Devices” or “All Users,” which attackers may abuse for mass deployment.
This rule detects anomalous mass device wipe or deletion activity in Microsoft Intune by comparing current activity against an actor's historical behavior. It identifies four patterns: first-time wipers with high volume, known actors statistically far above their norm (Z-score), thin-history actors exceeding their personal peak, and time-compressed bursts of wipes. The rule calculates a severity based on the volume and rate of wipes.
Detects attempts by non-Azure Arc agent processes to access '.key' files within the Azure Arc Tokens directory. This activity could indicate an attempt to exploit CVE-2026-26117 or other credential access techniques targeting Azure Arc service principal tokens.
Detects attempts by non-Azure Arc agent processes to access '.key' files within the Azure Arc Tokens directory. This activity could indicate an attempt to exploit CVE-2026-26117 or other credential access techniques targeting Azure Arc service principal tokens.
This rule detects anomalous mass device wipe or deletion activity in Microsoft Intune by comparing current activity against an actor's historical behavior. It identifies four patterns: first-time wipers with high volume, known actors statistically far above their norm (Z-score), thin-history actors exceeding their personal peak, and time-compressed bursts of wipes. The rule calculates a severity based on the volume and rate of wipes.
Page 16 of 23