Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
694
181
114
75
54
Contributors
328
252
122
76
71
Categories
726
700
220
196
148
Platforms
1,120
187
161
59
51
Products / Services
10,660
9,755
6,689
4,418
3,748
1,153
MITRE Techniques
699
428
360
209
197
CVEs
2
2
1
1
1
IDS Classtypes
4
3
1
1
IDS Protocols
8
This rule monitors the creation of new Azure Function Apps and identifies those that receive external, non-private network requests within 48 hours of their creation. This pattern may indicate the deployment of malicious or unauthorized serverless infrastructure for command-and-control, proxying, or automated tasks.
Detects high-impact configuration changes to Azure management groups or subscriptions (e.g., write/delete operations) that are performed by non-privileged accounts or outside of defined business change windows. This activity can indicate unauthorized privilege escalation, resource manipulation, or reconnaissance by an adversary.
This rule detects successful administrative actions related to the creation, deletion, or modification of Azure Management Groups, Subscriptions, and resources within them. Such actions can indicate unauthorized structural changes to the environment, potential privilege escalation, or attempts to modify tenant-level governance.
This rule detects successful administrative actions related to the creation, deletion, or modification of Azure Management Groups, Subscriptions, and resources within them. Such actions can indicate unauthorized structural changes to the environment, potential privilege escalation, or attempts to modify tenant-level governance.
This rule detects suspicious activities related to OAuth application consent and service principal operations originating from proxy infrastructure. Specifically, it looks for actions such as adding service principal credentials, granting OAuth2Permission, consenting to applications, adding delegated permission grants, or adding new service principals/applications, where the initiating IP address is identified as belonging to a proxy service. This combination of activities and source IP can indicate an adversary attempting to establish persistence or escalate privileges within an Azure AD environment.
Detects high-velocity queries to Graph API regarding transitiveRoleAssignments, a Tycoon 2FA post-compromise activity. This activity is indicative of reconnaissance for role assignments within Microsoft Graph, potentially by an adversary like Volt Typhoon (Tycoon 2FA).
Correlates a successful AAD sign-in from a new IP address immediately followed by the registration of a new FIDO2 or Authenticator device, a hallmark of AiTM persistence.
Detects Self-Service Password Reset (SSPR) activity followed by the deletion of authentication methods within a 1-hour window. This sequence of events can indicate an attacker attempting to maintain access or bypass multi-factor authentication after gaining initial access to an account, potentially executed by threat groups like Storm-2949.
Detects Key Vault access policy or role changes that grant secret-reading capabilities.
Detects deletion of a phishing-resistant authentication method followed by registration of a less secure phone or software token method for the same account.
Detects removal of registered authentication methods shortly after a password reset, a sequence that can prevent the legitimate user from recovering the account. This rule specifically looks for successful 'Delete user authentication method' or 'Remove authentication method' operations in AuditLogs.
Detects systematic enumeration of application registrations, owners, credentials, and permissions through Microsoft Graph. This rule identifies suspicious activity where a user or application makes a high volume of GET requests to various Microsoft Graph API endpoints related to application registrations within a short time frame (15 minutes). The specific endpoints monitored include those for listing applications, owners, password credentials, key credentials, and required resource access. A threshold of 40 requests within a 15-minute window triggers the alert, indicating potential reconnaissance or inventory collection by an adversary.
This rule identifies a suspicious sequence of events: a successful device code authentication immediately followed (within one hour) by a device registration event (PRT upgrade) for the same user. This pattern is indicative of a device code phishing attack where an attacker tricks a user into authenticating a device code, then registers their own device to gain persistent access.
Identifies the threat actor modifying Azure AD Cross-Tenant Access Policies to allow B2B collaboration with external attacker-controlled tenants.
Detects an SSPR (Self-Service Password Reset) event immediately followed by the registration of a new Microsoft Authenticator method for the same user. This sequence of events can indicate an attacker has compromised an identity, performed a password reset, and is attempting to establish a new MFA method for persistent access.
This rule detects potential OAuth token abuse by correlating credential consent grants with subsequent unusual cloud access patterns from different geographic locations. It looks for activities like adding a service principal, adding OAuth2 permission grants, or consenting to an application, followed by access to specific cloud applications (Salesforce, Drift, Slack, Microsoft 365, Workday) from an IP address that does not match the IP address from which the consent was granted. The rule aggregates these events and triggers if there are at least 4 related events within a 6-hour window.
Detects when a guest user (identified by '#EXT#' in their UPN) is assigned a sensitive role like 'Agent ID Administrator' or 'AgentAdministrator' in Entra ID. It also detects when any user, including guest users, performs modifications related to 'Agent' blueprints. This rule aims to identify potential privilege escalation or unauthorized administrative actions by external users within an Azure Active Directory environment.
Identifies device registration events where the user agent indicates script or automated frameworks (like axios, node, undici, node-fetch) rather than native registration clients. This behavior is associated with adversaries like Tycoon 2FA, which establishes device-bound persistence (PRT) that survives standard session revocation, making this a critical post-compromise detection.
Detects attempts to add credentials or secrets to a service principal to establish persistence independent of user accounts. This rule specifically looks for 'Add service principal credentials' or 'Update application - Certificates and secrets management' operations in Azure AuditLogs.
Detects deployment of the VMAccess extension via Azure Management plane, which can be abused by attackers to create local backdoor administrators on Azure Virtual Machines.
Detects extraction of Azure Storage account keys (ListKeys) used to facilitate programmatic, static-auth data exfiltration.
Page 32 of 55