Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
472 detections
Filters
Last updated
All Time
Detection languages
342
74
19
16
7
Contributors
91
90
77
52
35
Categories
182
148
81
66
60
Platforms
406
68
63
58
26
Products / Services
10,680
9,761
6,694
4,418
3,744
472
MITRE Techniques
180
121
96
78
71
CVEs
6
5
5
5
2
IDS Classtypes
2
1
1
1
1
IDS Protocols
6
Detects impossible travel authentication patterns where a user logs in from two geographically distant locations within a short time frame, while specifically filtering for sessions that reuse existing refresh or session tokens instead of performing fresh interactive authentication.
Detects the multi-stage Microsoft cloud identity compromise chain reported by Microsoft Security Research (September 2026): a victim completes a successful Entra ID device-code sign-in (often induced by passkey-themed device-code phishing), the same identity's authentication/security info is registered or changed (MFA/passkey persistence) within 60 minutes (deduplicated to the earliest such event per sign-in), followed within 120 minutes by a burst of at least 25 successful, delegated-context Microsoft Graph API calls (Scopes claim populated, i.e. user-delegated permissions rather than pure application/client-credential access) spanning at least 3 distinct resource paths, exhibiting reconnaissance (>=5 requests against /users, /groups, /directoryRoles, /roleManagement, /applications, /servicePrincipals, /organization) and/or collection (>=10 requests against /messages, /mailFolders, /attachments, /drive, /drives, /sites, /lists, /search) patterns. Restricting to delegated (Scopes-bearing) Graph calls and requiring resource-path breadth removes the two largest false-positive sources: service-principal/application-only automation jobs (Roles-only tokens) and single-endpoint polling tools. Pure behavioral correlation across SigninLogs, AuditLogs, and MicrosoftGraphActivityLogs - no static IOCs. Flags whether Graph activity originated from an IP different from the original device-code sign-in IP as a strong pivot/session-reuse indicator.
This rule detects administrative or user activity within Azure via AzureActivity logs and web request patterns in AppServiceHTTPLogs that originate from a predefined list of known malicious IP addresses.
Detects activity from known Storm-3168 (JADEPUFFER) campaign IP addresses across Azure control-plane, sign-in, and App Service logs. The rule monitors for malicious indicators in Azure Activity logs, Azure Sign-in logs, and Service Principal sign-ins, as well as specific sensitive URI paths (e.g., shells, admin login paths) within App Service HTTP logs.
Detects activity from known Storm-3168 (JADEPUFFER) campaign IP addresses across Azure control-plane, sign-in, and App Service logs. The rule monitors for malicious indicators in Azure Activity logs, Azure Sign-in logs, and Service Principal sign-ins, as well as specific sensitive URI paths (e.g., shells, admin login paths) within App Service HTTP logs.
This rule monitors for indicators of compromise (IOCs) associated with the TrustSink rogue MFA provider, specifically tracking the domain 'trident-sip-filter.ngrok-free.dev' and its associated OIDC discovery path. It aggregates signals from sign-in logs, audit logs, DNS queries, and network proxy traffic to identify attempts to interact with this malicious infrastructure.
Detects modifications to Microsoft Entra ID applications or service principals involving the addition or configuration of 'externalauthprovider' redirect URIs or properties. This behavior is indicative of an attacker attempting to establish a malicious federated identity or persistence mechanism by manipulating application configuration to use an adversary-controlled authentication provider.
Detects the multi-stage Microsoft cloud identity compromise chain reported by Microsoft Security Research (September 2026): a victim completes a successful Entra ID device-code sign-in (often induced by passkey-themed device-code phishing), the same identity's authentication/security info is registered or changed (MFA/passkey persistence) within 60 minutes (deduplicated to the earliest such event per sign-in), followed within 120 minutes by a burst of at least 25 successful, delegated-context Microsoft Graph API calls (Scopes claim populated, i.e. user-delegated permissions rather than pure application/client-credential access) spanning at least 3 distinct resource paths, exhibiting reconnaissance (>=5 requests against /users, /groups, /directoryRoles, /roleManagement, /applications, /servicePrincipals, /organization) and/or collection (>=10 requests against /messages, /mailFolders, /attachments, /drive, /drives, /sites, /lists, /search) patterns. Restricting to delegated (Scopes-bearing) Graph calls and requiring resource-path breadth removes the two largest false-positive sources: service-principal/application-only automation jobs (Roles-only tokens) and single-endpoint polling tools. Pure behavioral correlation across SigninLogs, AuditLogs, and MicrosoftGraphActivityLogs - no static IOCs. Flags whether Graph activity originated from an IP different from the original device-code sign-in IP as a strong pivot/session-reuse indicator.
Detects activity from known Storm-3168 (JADEPUFFER) campaign IP addresses across Azure control-plane, sign-in, and App Service logs. The rule monitors for malicious indicators in Azure Activity logs, Azure Sign-in logs, and Service Principal sign-ins, as well as specific sensitive URI paths (e.g., shells, admin login paths) within App Service HTTP logs.
Detects anomalous, unauthorized access to machine learning model artifacts (e.g., .onnx, .pt, .h5) within object storage or model registries. The rule identifies suspicious patterns including high-volume file reads by non-ML team identities, lack of multi-factor authentication, or access from geolocations outside approved operating regions, indicative of potential model exfiltration or intellectual property theft.
Detects suspicious HTTP requests directed at SharePoint applications containing a malformed Register directive. The rule identifies attempts to leverage the 'publishingribbon' Tagprefix combined with unauthorized namespaces (e.g., System.Xaml, System.Windows.Data) to bypass the EditingPageParser.InitializeRegisterTable safelist check, a common technique for SharePoint remote code execution.
Detects the addition of service principal credentials by a user who is not explicitly listed as an owner of the application. This activity is monitored to identify potential persistence or privilege escalation attempts where an unauthorized account adds its own authentication method to an existing cloud application or service principal.
Detects instances where an administrator or user grants an application consent with highly sensitive permissions in Azure AD (Microsoft Entra ID). This activity is often associated with OAuth application phishing, where an adversary lures a user into granting excessive permissions to a malicious application, potentially leading to long-term persistence or unauthorized access to directory data and conditional access policies.
This rule detects when a non-privileged user adds a new owner to an Azure AD Application or Service Principal, followed by a suspicious modification (such as adding credentials or permissions) to that same application within 30 minutes. This behavior is indicative of an adversary attempting to gain persistent, elevated access to an application's service principal to manipulate its configuration or permissions.
This rule detects when a non-privileged user adds a new owner to an Azure AD Application or Service Principal, followed by a suspicious modification (such as adding credentials or permissions) to that same application within 30 minutes. This behavior is indicative of an adversary attempting to gain persistent, elevated access to an application's service principal to manipulate its configuration or permissions.
Detects the addition of new service principal credentials (passwords or certificates) to Azure AD applications occurring outside of typical business hours. This behavior may indicate an attacker attempting to establish persistence or maintain unauthorized access to cloud resources through an existing application identity.
Detects the creation of new programmatic credentials (AWS access keys, Azure AD service principal credentials, or GCP service account keys) where the identity creating the credential differs from the identity for which the credential is being issued. This behavior is often indicative of persistence mechanisms or credential abuse where an attacker with sufficient permissions creates secondary credentials for other accounts.
Detects OAuth application consent events where an application is granted a combination of 'offline_access' (allowing refresh token issuance) and email-read permissions. This pattern is commonly used by adversaries to establish persistent, long-term access to user mailboxes for data exfiltration or Business Email Compromise (BEC) activities, surviving password changes until the consent is explicitly revoked.
Detects instances where a user or administrator grants consent to an OAuth application in Azure AD requesting highly sensitive delegated or application permissions, such as Mail.Read, Mail.ReadWrite, offline_access, or directory-wide read/write scopes. Attackers often use these consents to maintain persistent, silent access to a user's mailbox and cloud resources even after primary session tokens are revoked.
This rule detects potential unauthorized access to Azure Key Vault secrets by correlating AI agent process execution on an endpoint with subsequent Key Vault API activity by the same user account. It tracks common AI coding/assistant tools running locally on a device and triggers an alert if the same identity accesses cloud-plane Key Vault operations within 5 minutes. Additionally, it identifies anomalous bulk secret enumeration patterns in Key Vault audit logs to detect potential automated exfiltration.
Detects activity from known Storm-3168 (JADEPUFFER) campaign IP addresses across Azure control-plane, sign-in, and App Service logs. The rule monitors for malicious indicators in Azure Activity logs, Azure Sign-in logs, and Service Principal sign-ins, as well as specific sensitive URI paths (e.g., shells, admin login paths) within App Service HTTP logs.
Page 3 of 23