Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
694
181
114
75
54
Contributors
328
252
122
76
71
Categories
726
700
220
196
148
Platforms
1,120
187
161
59
51
Products / Services
10,650
9,755
6,688
4,418
3,745
1,153
MITRE Techniques
699
428
360
209
197
CVEs
2
2
1
1
1
IDS Classtypes
4
3
1
1
IDS Protocols
8
This rule detects when a Conditional Access (CA) policy is deleted in Azure Active Directory (now Microsoft Entra ID). This activity is critical to monitor as the removal of a CA policy can significantly weaken an organization's security posture by bypassing multi-factor authentication, device compliance checks, or other access controls. The rule specifically looks for the 'Delete conditional access policy' message in the Azure Audit Logs. While the rule's title suggests identifying actions by 'non-approved actors', the current detection logic only identifies the deletion event itself, not the actor's approval status. Further enrichment or correlation would be needed to determine if the actor is unauthorized.
This rule detects when a user is removed from a group that has Conditional Access (CA) policy modification access within Azure Active Directory. Such groups are critical for managing access to resources, and unauthorized removal of members could indicate an attempt to evade detection, disrupt security controls, or prepare for further malicious activity. Monitoring these removals helps identify potential privilege escalation, defense evasion, or persistence attempts.
This rule detects the addition of a new conditional access policy within an Azure environment. Conditional Access policies are critical security controls that determine when and how users can access resources. Unauthorized or unexpected changes to these policies could indicate an attacker attempting to establish persistence, bypass existing security controls (like MFA), or gain unauthorized access by modifying access conditions.
This rule detects when a Conditional Access policy is updated within an Azure environment. It aims to identify unauthorized or suspicious modifications to these critical security policies, which could lead to privilege escalation, credential access, or defense evasion. The rule specifically looks for the message 'Update conditional access policy' in audit logs. Further investigation would involve checking if the actor initiating the change is approved and comparing the old versus new policy values.
This rule detects when guest users are invited to the tenant by individuals who are not on an approved list of inviters. This helps identify unauthorized or suspicious external user invitations that could lead to unauthorized access or compromise.
This rule identifies instances where a user has been assigned a privileged role within Azure Active Directory (now Microsoft Entra ID) but is not actively using that role. This is detected by monitoring 'redundantAssignmentAlertIncident' risk events from the Azure PIM (Privileged Identity Management) service. Such alerts can indicate over-privileged accounts, potential misconfigurations, or accounts that could be targeted for privilege escalation if compromised.
Detects the addition of a new root certificate authority to an Azure AD tenant. This action can be performed by an attacker to establish persistence and enable certificate-based authentication for unauthorized access, potentially bypassing traditional password-based authentication mechanisms. This is a critical security event as it can lead to privilege escalation and persistent access within the Azure AD environment.
This rule detects the creation of virtual machines or the deployment of resources within an Azure environment. Monitoring these activities can help identify unauthorized resource provisioning, which could indicate an attacker establishing persistence, escalating privileges, or preparing for further malicious actions. The rule specifically looks for 'write' operations related to virtual machines and resource deployments in Azure activity logs.
Detects when a user account is created and subsequently deleted within a short period. This behavior can indicate an adversary attempting to establish temporary persistence, perform actions, and then remove traces of their activity to evade detection. It could also be related to privilege escalation attempts where an account is created for a specific task and then removed.
This rule detects when a user is added to a group that has permissions to modify Conditional Access (CA) policies within Azure Active Directory. Such an action could indicate an attempt to escalate privileges, bypass existing security controls, or establish persistence by altering authentication processes.
Detects malicious ASP.NET webshell activity associated with the CL0P Ransomware Gang exploiting CVE-2023-34362. The rule looks for specific HTTP headers used by the webshell, indicators of Azure Blob Storage interaction, or SQL injection attempts.
The following analytic detects the use of default or publicly known named pipes associated with Cobalt Strike. It leverages Sysmon EventID 17 and 18 to identify specific named pipes commonly used by Cobalt Strike's Artifact Kit and Malleable C2 Profiles. This activity is significant because Cobalt Strike is a popular tool for adversaries to conduct post-exploitation tasks, and identifying its named pipes can reveal potential malicious activity. If confirmed malicious, this could indicate an active Cobalt Strike beacon, leading to unauthorized access, data exfiltration, or further lateral movement within the network.
Detects when certificate-based authentication has been enabled in an Azure Active Directory tenant. This change can be an indicator of an adversary establishing a new authentication method for persistence or privilege escalation, or preparing for such activities.
This rule identifies when an admission controller is executed in Azure Kubernetes. Admission controllers intercept and potentially modify requests to the Kubernetes API server. Adversaries can leverage admission webhooks (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) for persistence, such as injecting malicious containers into pods or intercepting API requests to steal credentials and sensitive information.
This rule detects when a user registers security information, which indicates a change to their authentication method. This could be an attacker adding an authentication method to a compromised account to maintain persistent access.
This rule monitors and alerts when a user is added to the 'Global Administrator' or 'Device Administrator' roles within Azure Active Directory. These roles grant highly elevated privileges, making this activity critical for detecting potential persistence, privilege escalation, or initial access attempts by adversaries. The detection logic specifically looks for 'Add member to role' operations within the RoleManagement category, targeting the unique identifiers for these two sensitive administrative roles.
Detects when a configuration change is made to an application's AppID URI in Azure Active Directory (now Microsoft Entra ID). This change can be indicative of an adversary attempting to modify an application's identity to facilitate malicious activities such as phishing, unauthorized access, or maintaining persistence.
Detects when a user is removed from a privileged role in Azure AD. Bulk changes should be investigated as they could indicate an adversary attempting to remove legitimate administrators or clean up their tracks after gaining access.
Detects when a user successfully resets their own password within Azure Active Directory. This rule specifically looks for 'UserManagement' category events with a 'Success' status, initiated by a 'UPN' (User Principal Name) and targeting a 'UPN' with an 'ActivityType' containing 'Password reset'.
Identifies when an account in a privileged role has not signed in for a specified number of days, indicating a potentially stale or unused privileged account. Such accounts can be a security risk if compromised, as they might not be actively monitored.
Detects when a user is added to a privileged role in Azure AD. This could indicate an attempt to escalate privileges or establish persistence within the cloud environment.
Page 41 of 55