Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,864 detections
Filters
Last updated
All Time
Detection languages
2,523
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,448
1,199
1,091
792
575
Platforms
39,931
7,261
6,535
3,864
3,642
Products / Services
1,755
1,449
1,120
438
406
MITRE Techniques
1,888
1,391
913
814
726
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Detects modifications to Microsoft Entra ID (formerly Azure AD) Conditional Access policies that lower security posture. This includes disabling an active policy, removing users or groups from enforcement scopes, or removing MFA requirements. Such actions are typical of an adversary attempting to maintain persistent access or evade authentication controls.
This rule detects scenarios where an Azure application's permissions (scopes) are upgraded to high-risk levels after an initial period, a technique known as 'incremental consent'. This is often used by attackers to avoid triggering high-risk consent alerts during the initial application authorization process, subsequently escalating privileges over time.
Detects modifications to Microsoft Entra ID (formerly Azure AD) Conditional Access policies that lower security posture. This includes disabling an active policy, removing users or groups from enforcement scopes, or removing MFA requirements. Such actions are typical of an adversary attempting to maintain persistent access or evade authentication controls.
This rule detects scenarios where an Azure application's permissions (scopes) are upgraded to high-risk levels after an initial period, a technique known as 'incremental consent'. This is often used by attackers to avoid triggering high-risk consent alerts during the initial application authorization process, subsequently escalating privileges over time.
Detects the creation of a new application secret or credential in a cloud environment followed by an immediate authentication attempt using that credential from an IP address that has not been observed performing successful authentication within the specified lookback window. This behavior is indicative of potential unauthorized persistence or the use of compromised credentials by an adversary.
Detects malicious attempts to delete or modify the access control settings of centralized cloud audit log storage, such as S3 buckets, Azure Log Analytics workspaces, or GCP log buckets. These actions aim to impair visibility into an adversary's activities, a common step in anti-forensics and data destruction workflows.
This rule detects administrative changes to cloud storage configurations (AWS S3, Azure Blob, and GCP Storage) that result in public or anonymous read/write access to buckets or containers, which could lead to unauthorized data exposure.
Detects the creation of programmatic API credentials or service principal keys by highly privileged cloud identities across AWS, Azure, and GCP. Specifically monitors AWS Root, Azure AD Global/Company Administrators, and GCP Organization Owners, whose roles generally do not require long-term API access.
Detects successful cloud console login events across AWS, Azure, and GCP where multi-factor authentication (MFA) was not utilized, combined with impossible travel indicators (login from different countries within an 8-hour window for the same principal).
This rule detects the assignment of sensitive Microsoft Graph API application roles to a service principal, which can be an indicator of an adversary establishing a directory-wide backdoor in an Azure/Entra ID environment. This technique is often used to escalate privileges following an initial compromise of a low-privilege application registration.
Detects instances where a non-administrative user grants OAuth application permissions for high-risk Microsoft Graph delegated scopes. This activity is a common indicator of 'consent phishing' campaigns, where an attacker tricks a user into authorizing a malicious application, granting persistent access to the user's data and resources via API tokens, even after password resets.
Detects unauthorized modifications to federation trust configurations, such as IssuerUri, federationMetadataUrl, or signing certificate thumbprints, on a federated domain. Adversaries may manipulate these settings to establish credential-independent persistence or to forge SAML tokens (Golden SAML) by repointing the federation metadata to attacker-controlled infrastructure.
Detects OAuth application consent events where an application is granted a combination of 'offline_access' (allowing refresh token issuance) and email-read permissions. This pattern is commonly used by adversaries to establish persistent, long-term access to user mailboxes for data exfiltration or Business Email Compromise (BEC) activities, surviving password changes until the consent is explicitly revoked.
Detects instances where an administrator has granted tenant-wide consent to an OAuth application requesting highly privileged Microsoft Graph permissions. This activity is a significant indicator of potential persistence or privilege escalation, as it allows the application to perform sensitive operations across the organization without requiring individual user interaction.
Detects modifications to the Active Directory Federation Services (AD FS) token-signing certificate on a federated domain. This activity is a critical precursor to Golden SAML attacks, where an attacker replaces the legitimate signing certificate with one they control to forge SAML assertions and bypass authentication mechanisms. The rule excludes modifications initiated by applications identified as federation services.
Detects when a service principal is added as an owner to an application or another service principal. This activity indicates a potential privilege escalation or persistence attempt, where a compromised application gains administrative control over other identities or resources within the Azure environment.
Detects instances where an Entra ID (Azure AD) application is registered and subsequently granted consent by the same user within 30 minutes, specifically when the activity occurs outside of typical business hours (7 AM - 7 PM) or from disparate IP addresses. This behavior pattern is indicative of potential malicious OAuth application registration and subsequent token-granting by an attacker to maintain persistent access to an environment.
This rule detects administrative changes to Conditional Access (CA) policies in Entra ID (Azure AD), specifically monitoring for the disabling of policies, transitioning them to report-only mode, or the removal of critical security grant controls such as MFA or Compliant Device requirements. It also alerts on the outright deletion of any CA policy, which could indicate an adversary attempting to bypass security controls or maintain persistent access.
Detects instances where a user grants OAuth consent or assigns roles to an application that lacks a verified publisher and requests broad permissions across multiple sensitive categories (e.g., Mail, Files, and Directory). This behavior is characteristic of consent-phishing campaigns designed to harvest data from cloud environments.
This rule detects when a new password credential (client secret) is added to an existing Azure AD Service Principal or application. This activity is a common method for adversaries to establish persistence in a cloud environment that survives password resets or MFA enforcement on the original administrative account.
Detects the deletion of Azure Monitor diagnostic settings or log profiles that export subscription-level Activity Logs. This action disables logging, effectively blinding security visibility into tenant operations, and is often used by adversaries as a defense-evasion technique before conducting further malicious activities.
Page 25 of 184