Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,864 detections
Filters
Last updated
All Time
Detection languages
2,523
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,448
1,199
1,091
792
575
Platforms
39,926
7,251
6,535
3,864
3,632
Products / Services
1,755
1,449
1,120
438
406
MITRE Techniques
1,888
1,391
913
814
726
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Detects the assignment of highly privileged Azure AD/Entra ID directory roles (e.g., Global Administrator, Application Administrator) to a service principal. Assigning such roles to service principals is a common persistence technique, as these identities can be used to bypass conditional access policies and MFA through non-interactive authentication methods like client credentials.
This rule detects the granting of sensitive, high-privilege Microsoft Graph API delegated or application permissions to an application or service principal in an Entra ID environment. Such permissions, including directory and user management or full application access, are frequently used by adversaries for persistence and privilege escalation within cloud environments.
This rule detects the granting of sensitive, high-privilege Microsoft Graph API delegated or application permissions to an application or service principal in an Entra ID environment. Such permissions, including directory and user management or full application access, are frequently used by adversaries for persistence and privilege escalation within cloud environments.
Detects mass-phishing consent campaigns by monitoring non-admin users consenting to multi-tenant or unverified-publisher applications requesting non-basic-profile OAuth scopes. The rule aggregates multiple consent events for the same application over a 1-hour window to identify potentially malicious consent-phishing activity.
Detects modifications to Microsoft Entra ID (formerly Azure AD) cross-tenant access settings. This rule alerts on changes that allow external tenants to interact with the environment, such as enabling inbound/outbound trusts, automatic redemption, or trusting MFA claims, which can be leveraged to establish persistence or facilitate lateral movement between tenants.
Detects anomalous sign-in activity for service principals (non-interactive accounts) where the same application authenticates from multiple distinct countries within a 24-hour window. This behavior often indicates the unauthorized use of compromised service principal credentials, such as client secrets or certificates, from distributed attacker-controlled infrastructure.
Detects anomalous sign-in activity for service principals (non-interactive accounts) where the same application authenticates from multiple distinct countries within a 24-hour window. This behavior often indicates the unauthorized use of compromised service principal credentials, such as client secrets or certificates, from distributed attacker-controlled infrastructure.
This rule detects instances where a user successfully activates a privileged role via Privileged Identity Management (PIM) in a cloud environment, despite the activation policy requiring approval. It flags cases where the 'Add member to role completed' event indicates that approval is required, but the 'approvalStatus' is absent, suggesting an attempt to bypass the formal approval workflow.
Detects the reactivation of a service principal by correlating the addition of new credentials followed by a successful login event for the same principal within a 7-day window. This behavior is indicative of potential persistence maintenance or account hijacking, especially when legacy or deprecated accounts are targeted.
Detects the addition of a federated identity credential to an Azure AD / Entra ID application. Adversaries may use this technique to establish persistent, secretless access to an application's service principal by configuring trust with an external OIDC issuer under their control (e.g., a malicious GitHub repository or personal OIDC provider).
Detects administrative actions in Azure that disable or modify diagnostic settings, which stops the flow of logs to services like Azure Sentinel/Log Analytics, or deletes policy assignments. Such actions are often performed by adversaries to blind security operations monitoring prior to lateral movement or further malicious activity.
This rule detects a correlation between a successful non-interactive authentication event (e.g., token-based sign-in) and a subsequent device registration event performed by the same user identity within a short time window. This sequence is a known pattern for attackers seeking to register an adversary-controlled device against a compromised account to establish durable persistence and potentially bypass conditional access policies (PRT persistence).
Detects successful authentication attempts using legacy (basic) protocols that do not enforce modern Conditional Access policies (e.g., MFA, device compliance). The rule specifically flags these events if the originating IP address or geographic location is not observed in historical sign-in activity for the specific user, which may indicate account compromise via credential theft.
Detects successful authentication attempts using legacy (basic) protocols that do not enforce modern Conditional Access policies (e.g., MFA, device compliance). The rule specifically flags these events if the originating IP address or geographic location is not observed in historical sign-in activity for the specific user, which may indicate account compromise via credential theft.
Detects impossible travel sign-in events where a user authenticates from geographically distant locations within a short time window. The rule specifically flags the second, suspicious event as having occurred via a non-interactive session or single-factor authentication, suggesting the use of a replayed or stale session token to bypass MFA.
Detects impossible travel sign-in events where a user authenticates from geographically distant locations within a short time window. The rule specifically flags the second, suspicious event as having occurred via a non-interactive session or single-factor authentication, suggesting the use of a replayed or stale session token to bypass MFA.
This rule detects administrative changes that weaken cloud identity security, specifically the disabling of Entra ID Security Defaults, per-user MFA enforcement, or tenant-wide authentication-methods policies. These actions remove critical second-factor authentication requirements, significantly increasing the risk of unauthorized access via password-spraying or credential-stuffing attacks.
This rule detects instances where a user successfully activates a privileged role via Privileged Identity Management (PIM) in a cloud environment, despite the activation policy requiring approval. It flags cases where the 'Add member to role completed' event indicates that approval is required, but the 'approvalStatus' is absent, suggesting an attempt to bypass the formal approval workflow.
Detects the reactivation of a service principal by correlating the addition of new credentials followed by a successful login event for the same principal within a 7-day window. This behavior is indicative of potential persistence maintenance or account hijacking, especially when legacy or deprecated accounts are targeted.
Detects the addition of a federated identity credential to an Azure AD / Entra ID application. Adversaries may use this technique to establish persistent, secretless access to an application's service principal by configuring trust with an external OIDC issuer under their control (e.g., a malicious GitHub repository or personal OIDC provider).
Detects potential abuse of Azure Cloud Shell backing storage (acsCloudShell) to stage or persist malicious scripts following an Azure AD session compromise. Adversaries may use this storage to blend in with legitimate engineering operations while maintaining persistent access to their tooling.
Page 29 of 184