Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
472 detections
Filters
Last updated
All Time
Detection languages
342
74
19
16
7
Contributors
91
90
77
52
35
Categories
182
148
81
66
60
Platforms
406
68
63
58
26
Products / Services
10,680
9,761
6,694
4,418
3,744
472
MITRE Techniques
180
121
96
78
71
CVEs
6
5
5
5
2
IDS Classtypes
2
1
1
1
1
IDS Protocols
6
KQL Query from file: Azure Storage Blob - Misconfiguration Check
KQL Query from file: CloudApp Privilege OAuth Grant
KQL Query
KQL Query
KQL Query from file: Azure AI Security Finding Report
KQL Query from file: Mitigating security risks in MCP implementations
KQL Query
KQL Query from file: Technique profile eDiscovery misuse detection
KQL Query from file: Malware C2 Comms over Azure Blob Metadata
KQL Query from file: KQL to check Azure API spray attacks
KQL Query from file: Check for Azure Outdated Security Protocols
KQL Query
KQL Query from file: Exposure Management - Slim's Metric (MaxCVSS-DAW)
KQL Query from file: CVE-2024-3094 with CVSS Score 10
KQL Query
KQL Query from file: Blob URI Unique Domain Count
KQL Query from file: Monthly Report Entra Eligible Role Activation
This detection leverages Azure Graph activity logs to identify when Graph APIs have been used to identify 10 or more service principals. This type of behavior is associated with tools such as Azure enumeration tools like AzureHound or ROADtools.
This detection identifies when an Azure Service Principal elevates privileges by adding itself to a new app role assignment. This activity is indicative of privilege escalation within an Azure Active Directory environment, where a service principal grants itself additional permissions.
'Discover all critical ports from a list having rules like 'Any' for sourceIp, which means that they are opened to everyone. Critial ports should not be opened to everyone, and should be filtered.'
'This hunting query looks in Azure Web Application Firewall data to find possible SpringShell Exploitation Attempt (CVE-2022-22965).
The Spring Framework is one of the most widely used lightweight open-source framework for Java. To exploit the vulnerability attackers can
send a specially crafted query to a web server running the Spring Core framework to change the target of logging facility and create a new
malicious JSP file in a location accessible by http requests. Attackers then make requests to the malicious backdoor to run system commands.
Reference: https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/'
The Spring Framework is one of the most widely used lightweight open-source framework for Java. To exploit the vulnerability attackers can
send a specially crafted query to a web server running the Spring Core framework to change the target of logging facility and create a new
malicious JSP file in a location accessible by http requests. Attackers then make requests to the malicious backdoor to run system commands.
Reference: https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/'
Page 19 of 23