Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
694
181
114
75
54
Contributors
328
252
122
76
71
Categories
726
700
220
196
148
Platforms
1,120
187
161
59
51
Products / Services
10,660
9,755
6,689
4,418
3,748
1,153
MITRE Techniques
699
428
360
209
197
CVEs
2
2
1
1
1
IDS Classtypes
4
3
1
1
IDS Protocols
8
Detects an unusually high volume of successful operations related to Azure App Services originating from a single caller within a one-hour window. This could indicate automated activity, reconnaissance, or a misconfigured application.
This rule detects the successful execution of the 'Run Command' action on Azure virtual machines outside of defined business hours (8 AM to 6 PM). Run Command allows the execution of arbitrary scripts on a VM, which can be leveraged for administrative tasks but also by attackers for post-exploitation activities, persistence, or lateral movement. Monitoring these operations during off-hours may indicate unauthorized use or anomalous administrative activity.
This rule detects potential cloud resource hijacking (e.g., cryptojacking) by monitoring for a sudden spike in the deployment of Azure virtual machines by a single user. It triggers if a user creates five or more virtual machines in a 10-minute window, specifically looking for deployments in regions where the user has not recently created VMs, or deployments utilizing high-compute SKUs commonly targeted for cryptocurrency mining.
This rule detects suspicious activity involving the creation or update of managed identities and the assignment of highly privileged roles (Contributor, Owner, User Access Administrator) to them. It specifically looks for multiple such assignments within a one-hour window to managed identities associated with automation, runbook, or function resources, indicating potential privilege escalation or malicious access.
This rule detects when a user successfully grants five or more OAuth2 permissions within a five-minute window, specifically looking for sensitive scopes such as 'Mail.Read', 'Calendar.Read', 'User.Read.All', or 'Directory.Read.All'. This behavior can indicate an adversary attempting to gain broad access to an organization's data through a compromised application or user account.
Detects rogue device registration with default naming conventions commonly used by threat actors (DESKTOP-[0-9A-F]{6,8}). This pattern is often observed in device code phishing attacks where adversaries register new devices with generic names to maintain persistence or access.
This rule detects the successful execution of the 'Run Command' action on Azure virtual machines outside of defined business hours (8 AM to 6 PM). Run Command allows the execution of arbitrary scripts on a VM, which can be leveraged for administrative tasks but also by attackers for post-exploitation activities, persistence, or lateral movement. Monitoring these operations during off-hours may indicate unauthorized use or anomalous administrative activity.
Detects registration of potentially malicious OAuth applications in Azure AD
This rule detects suspicious administrative activities in Azure AD, Microsoft Graph, SharePoint, Exchange, or Teams when performed by accounts that are not explicitly identified as 'admin' or 'service' accounts. It looks for a combination of at least 5 operations and 2 unique operation types within a 2-hour window, targeting group, application, or service principal related resources. This could indicate an attacker using compromised non-privileged accounts to perform administrative actions or escalate privileges.
Detects a spike in successful operations related to Azure Storage Account Keys by a single caller within a one-hour window. This could indicate an adversary attempting to enumerate, access, or exfiltrate storage account keys, or a legitimate user performing multiple key management activities.
Detects access to Azure portal for cloud service dashboard discovery
Detects the writing and subsequent deletion of Azure SQL firewall rules, a technique used to enable remote access and evade defenses. This behavior could indicate an adversary attempting to open up network access to an Azure SQL server and then remove the evidence of the rule change.
Detects modification of Azure Storage Account network access rules, specifically when the 'networkAcls' property is changed. This could indicate an attempt to enable public access from specific IP addresses, potentially exposing the storage account to unauthorized access.
This rule detects an unusual spike in 'Export' or 'Download' operations within Azure Activity logs by a single caller. It triggers when a user performs 5 or more such operations within an hour, which could indicate data exfiltration attempts or suspicious data access patterns.
This rule detects when a Key Vault item is deleted in Azure. Monitoring deletions of sensitive items like those in Key Vaults is crucial for detecting potential data exfiltration, sabotage, or unauthorized access attempts by adversaries.
Detects unauthorized access to manufacturing process historian databases (OSIsoft PI, Honeywell PHD, Aspen IP.21) by non-engineering accounts from unexpected workstations. The rule correlates audit logs showing access to historian systems with sign-in logs for specific applications, identifying users with a high volume of access within a short timeframe.
This rule detects repeated successful operations related to public access or firewall configuration changes within Azure Activity Logs. A high count (3 or more) of such operations by the same caller within an hour could indicate malicious activity, such as an attacker attempting to open up network access to compromised resources or exfiltrate data.
Detects the creation of multiple service principals with administrative or sensitive keywords in their names within a short timeframe, potentially indicating an attempt to establish persistence or escalate privileges in a cloud environment. The rule specifically looks for service principals containing 'admin', 'sync', 'backup', or 'audit' in their display names, created by users outside of Microsoft's internal domains.
Detects abuse of the microsoft.Web/sites/publishxml/action operation to retrieve application publishing profiles and basic auth credentials.
This rule detects when a Key Vault item is deleted in Azure. Monitoring deletions of sensitive items like those in Key Vaults is crucial for detecting potential data exfiltration, sabotage, or unauthorized access attempts by adversaries.
Detects when a Network Security Group (NSG) rule is successfully deleted in Azure. This could indicate an attempt to bypass network access controls, potentially to enable unauthorized access or exfiltration.
Page 33 of 55