Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,864 detections
Filters
Last updated
All Time
Detection languages
2,523
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,448
1,199
1,091
792
575
Platforms
39,931
7,261
6,535
3,864
3,642
Products / Services
1,755
1,449
1,120
438
406
MITRE Techniques
1,888
1,391
913
814
726
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
This rule identifies when sensitive ClusterRoles or Roles are being modified, deleted, or when their permissions are being escalated or bound in Azure Kubernetes Service (AKS). These operations can indicate an attempt to gain elevated privileges or disrupt access within the Kubernetes cluster.
This rule detects successful user logins where the user's termination date is in the past, indicating a login from a terminated employee. This could signify unauthorized access or a failure in account deprovisioning processes. The rule requires a context data source that provides user termination dates, such as Azure AD Context or Workday.
This rule detects suspicious activity following a successful login to the Azure AD PowerShell application. Specifically, it looks for a user performing multiple administrative actions within a short timeframe after logging in. These actions include adding or updating applications, adding delegated permission grants, or managing certificates and secrets for applications. This behavior is indicative of an attacker attempting to establish persistence or escalate privileges within an Entra ID environment after initial access.
Identifies when a service account in Azure Kubernetes Service is modified or deleted. This could indicate an adversary attempting to disrupt services, remove access, or manipulate accounts for persistence or privilege escalation within the Kubernetes cluster.
Detects the modification or deletion of Kubernetes RoleBindings or ClusterRoleBindings within Azure Kubernetes Service. These actions can indicate an adversary attempting to escalate privileges, maintain persistence, or disrupt services by altering access control configurations.
This rule identifies rare subscription-level operations in Azure, specifically focusing on actions that involve listing keys for various Azure resources (DocumentDB, Maps, Media, Cognitive Services, Storage) or writing snapshots and network security groups. It aims to detect when these sensitive operations are performed from a previously unseen source IP address, indicating potential unauthorized access or credential compromise.
This rule identifies when an Azure Kubernetes network policy is modified or deleted. Network policies control the traffic flow between pods/namespaces and to/from external network endpoints. Unauthorized modification or deletion of these policies can lead to security vulnerabilities, such as allowing unauthorized network access to sensitive services or disrupting legitimate communication within the cluster, potentially leading to a denial of service or data exfiltration.
This rule detects when a user is added to an administrative role within Office 365. While adding users to administrative roles is not inherently malicious, it is a sensitive action that warrants validation due to the elevated privileges granted. The rule specifically looks for the 'Add member to role.' event type within Office 365 and requires the role to be present in a predefined watchlist of sensitive roles.
Detects when an Azure Kubernetes Cluster is created or deleted. This activity can indicate significant infrastructure changes, either legitimate or malicious. Monitoring these operations is crucial for maintaining the security and integrity of containerized environments.
Detects strong indicators of a successful device code phishing attack. This rule correlates email events containing Microsoft device login URLs with subsequent Microsoft Entra ID authentication attempts that result in a specific error code (50199 or 0), indicating the user was prompted to confirm the application. The time window for correlation is set to 16 minutes, accounting for the typical 15-minute expiration of device codes.
Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.
Detect multiple user logins from multiple states or countries using Chronicle GeoIP enrichment.
Once a user authenticates to the Azure AD PowerShell application, if they take multiple admin actions indicative of establishing their own persistence with an Entra ID application within a portion of the access token time, alert for additional investigation
Allowed Logins from Terminated Employees
Identifies when a Azure Kubernetes network policy is modified or deleted.
Detects when an account successfully recovers a Local Administrator Password Solution (LAPS) password from Microsoft Entra ID. This activity is logged in Azure audit logs under the 'Device' category with the activity type 'Recover device local administrator password' and additional details indicating 'Successfully recovered local credential by device id'. This event can signify an attacker attempting to gain elevated privileges or maintain persistence by obtaining local administrator credentials.
Detects when a Container Registry is created or deleted.
Detects when a Azure Kubernetes Cluster is created or deleted.
Identifies when ClusterRoles/Roles are being modified or deleted.
Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.
Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.
Page 171 of 184