Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
694
181
114
75
54
Contributors
328
252
122
76
71
Categories
726
700
220
196
148
Platforms
1,120
187
161
59
51
Products / Services
10,650
9,755
6,688
4,418
3,745
1,153
MITRE Techniques
699
428
360
209
197
CVEs
2
2
1
1
1
IDS Classtypes
4
3
1
1
IDS Protocols
8
Identifies when the same privilege role has multiple activations by the same user, which could indicate an attempt to bypass time-based access restrictions or an adversary repeatedly activating a role for malicious purposes. This alert is triggered by the 'sequentialActivationRenewalsAlertIncident' risk event type in Azure PIM.
Detects when a user without the necessary permissions attempts to invite a guest user in an Azure environment, indicated by a failed 'Invite external user' operation in the audit logs. This could signify an attempt at unauthorized access, privilege escalation, or persistence.
This rule detects the successful creation of a new administrative account within an Azure environment. It specifically looks for audit log entries indicating both 'Add user' and 'Add member to role' actions occurring successfully, which signifies a user being created and then assigned a privileged role.
This rule detects changes to an application's Uniform Resource Identifier (URI) configuration within Azure. Such changes can include modifications to domain names, protocol usage (e.g., switching from HTTPS), the introduction of wildcards, or URIs pointing to uncontrolled domains. These types of modifications can be indicative of an attacker attempting to redirect traffic, establish persistence, or facilitate other malicious activities by altering how an application is accessed or interacts with external resources.
Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.
This analytic detects suspicious data transfer activities involving the use of the `split` syscall with the `-b` option, which specifies the size of each output file. This technique can be used by attackers to evade detection by breaking large files into smaller parts, bypassing size-based security controls, and facilitating covert exfiltration of sensitive data. By monitoring for unusual or unauthorized use of the `split` syscall with a specified block size, this analytic helps identify potential data exfiltration attempts.
KQL Query
This analytic identifies the bulk creation of ransomware notes (e.g., .txt, .html, .hta files) on an infected machine. It leverages Sysmon EventCode 11 to detect multiple instances of these file types being created within a short time frame (10 seconds). A detection is triggered if 15 or more unique readme paths are observed. This activity is a strong indicator of an active ransomware attack, where the attacker is notifying the victim of the encryption. If confirmed malicious, this behavior could lead to widespread data encryption, rendering critical files inaccessible and potentially causing significant operational disruption.
This analytic identifies the modification of the SourceAnchor (ImmutableId) attribute for an Azure Active Directory user. This detection leverages Azure AD audit logs, specifically monitoring the "Update user" operation and changes to the SourceAnchor attribute. This activity is significant as it is a step in setting up an Azure AD identity federation backdoor, allowing an adversary to establish persistence. If confirmed malicious, the attacker could impersonate any user, bypassing password and MFA requirements, leading to unauthorized access and potential data breaches.
The following analytic detects suspicious attempts to find credentials stored in password stores, indicating a potential attacker's effort to access sensitive login information. Password stores are critical repositories that contain valuable credentials, and unauthorized access to them can lead to significant security breaches. By monitoring for unusual or unauthorized activities related to password store access, this analytic helps identify potential credential theft attempts, allowing security teams to respond promptly and prevent unauthorized access to critical systems and data.
Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.
Detects the creation or update of an Azure Sentinel analytics rule. This can indicate administrative activity related to security monitoring configuration. Monitoring these changes is crucial for detecting potential tampering with detection capabilities or the introduction of malicious rules.
Number of VM creations or deployment activities occur in Azure via the azureactivity log.
This KQL query analyzes Microsoft Entra ID (formerly Azure AD) sign-in and audit logs to identify potentially risky multi-factor authentication (MFA) registration events. It works by checking for MFA registrations initiated from a new, previously unseen IP address.
The query joins historical sign-in data with recent MFA-related events. It calculates how many unique days an IP address has been used by a specific user over the last 30 days. It then flags any MFA registration event from the last 24 hours where the IP address is a new IP (seen zero days before). The final results are filtered to exclude events from new user accounts (created in the last 60 days) to focus on more established accounts.
The query joins historical sign-in data with recent MFA-related events. It calculates how many unique days an IP address has been used by a specific user over the last 30 days. It then flags any MFA registration event from the last 24 hours where the IP address is a new IP (seen zero days before). The final results are filtered to exclude events from new user accounts (created in the last 60 days) to focus on more established accounts.
Detects potential abuse of Microsoft Actor tokens for cross-tenant impersonation attacks targeting Entra ID tenants. This rule identifies suspicious audit log entries that may indicate exploitation of CVE-2025-55241, a critical vulnerability in Azure AD Graph API that allowed attackers to impersonate any user across Entra ID tenants using malicious Actor tokens.
Detects a user password change synced from on-premises Active Directory, immediately followed by the same user registering a new MFA method. This sequence is highly suspicious for existing privileged accounts and was used by the threat actor Storm-0501 to compromise a Global Administrator account that previously lacked MFA.
This rule identifies statistically unusual or first-time Azure operations performed by a principal (user or service principal). It uses a risk-based alerting model, assigning a higher risk score to operations defined as high-risk. The rule establishes a baseline of normal activity over 30 days and alerts when current activity significantly deviates from this baseline or when an operation is observed for the very first time for a given identity.
This analytic detects the configuration of TFTP services on Cisco IOS devices that could be used to exfiltrate sensitive configuration files. Threat actors like Static Tundra have been observed configuring TFTP servers to make device configuration files accessible for exfiltration after gaining initial access. The detection specifically looks for commands that expose critical configuration files such as startup-config, running-config, and other sensitive system information through TFTP. This activity is particularly concerning as it may represent an attempt to steal credentials, network topology information, and other sensitive data stored in device configurations.
Detects activity related to the PromptLock ransomware, which leverages the Ollama AI API and is written in Go. This rule looks for network connections to the Ollama service (port 11434) and related process executions, specifically identifying processes like go.exe, curl.exe, wget.exe, python.exe, powershell.exe making connections or processes with 'ollama' in their command line.
The analytic detects the creation or update of a new Azure Automation Runbook within an Azure tenant. It leverages Azure Audit events, specifically the Azure Activity log category, to identify when this operation occurs. This activity is significant because adversaries with privileged access can use Runbooks to maintain persistence, escalate privileges, or execute malicious code. If confirmed malicious, this could lead to unauthorized actions such as creating Global Administrators, executing code on VMs, and compromising the entire Azure environment.
The analytic detects the creation of a new Azure Automation account within an Azure tenant. It leverages Azure Audit events, specifically the Azure Activity log category, to identify when an account is created or updated. This activity is significant because Azure Automation accounts can be used to automate tasks and orchestrate actions across Azure and on-premise environments. If an attacker creates an Automation account with elevated privileges, they could maintain persistence, execute malicious runbooks, and potentially escalate privileges or execute code on virtual machines, posing a significant security risk.
Page 42 of 55