Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,865 detections
Filters
Last updated
All Time
Detection languages
2,524
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,091
792
575
Platforms
39,932
7,263
6,535
3,865
3,643
Products / Services
1,755
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Detects a precursor pattern identified as JADEPUFFER, where a failed 'ListKeys' operation (indicating an attempt to discover or access keys for a non-existent storage account) is immediately followed by a burst of destructive delete operations on critical cloud resources (e.g., storage, databases, key vaults) by the same actor.
Detects a coordinated, rapid deletion of a Key Vault, Function App, and App Service plan within the same resource group and time window by the same caller. This pattern is indicative of targeted destructive activity, such as that seen in the JADEPUFFER campaign, while explicitly excluding scenarios where the entire resource group is deleted, which is typical of routine IaC teardowns.
Detects a coordinated, rapid deletion of a Key Vault, Function App, and App Service plan within the same resource group and time window by the same caller. This pattern is indicative of targeted destructive activity, such as that seen in the JADEPUFFER campaign, while explicitly excluding scenarios where the entire resource group is deleted, which is typical of routine IaC teardowns.
Detects a coordinated, rapid deletion of a Key Vault, Function App, and App Service plan within the same resource group and time window by the same caller. This pattern is indicative of targeted destructive activity, such as that seen in the JADEPUFFER campaign, while explicitly excluding scenarios where the entire resource group is deleted, which is typical of routine IaC teardowns.
Detects a coordinated, rapid deletion of a Key Vault, Function App, and App Service plan within the same resource group and time window by the same caller. This pattern is indicative of targeted destructive activity, such as that seen in the JADEPUFFER campaign, while explicitly excluding scenarios where the entire resource group is deleted, which is typical of routine IaC teardowns.
Detects a suspicious pattern often associated with Storm-3168 (JADEPUFFER) activity: prolonged, high-volume Azure resource enumeration by one service principal, followed shortly by a second service principal performing rapid, multi-subscription enumeration from the same source IP address.
Detects a suspicious pattern often associated with Storm-3168 (JADEPUFFER) activity: prolonged, high-volume Azure resource enumeration by one service principal, followed shortly by a second service principal performing rapid, multi-subscription enumeration from the same source IP address.
Detects a suspicious pattern often associated with Storm-3168 (JADEPUFFER) activity: prolonged, high-volume Azure resource enumeration by one service principal, followed shortly by a second service principal performing rapid, multi-subscription enumeration from the same source IP address.
Detects anomalous service principal activity characterized by multiple, rapidly issued, and overlapping OAuth tokens within a short time window. This pattern is associated with automated/agentic token orchestration (e.g., JADEPUFFER/Storm-3168 campaign) rather than standard manual operator activity, specifically when leveraging the python-requests user agent.
Detects anomalous service principal activity characterized by multiple, rapidly issued, and overlapping OAuth tokens within a short time window. This pattern is associated with automated/agentic token orchestration (e.g., JADEPUFFER/Storm-3168 campaign) rather than standard manual operator activity, specifically when leveraging the python-requests user agent.
Detects anomalous service principal activity characterized by multiple, rapidly issued, and overlapping OAuth tokens within a short time window. This pattern is associated with automated/agentic token orchestration (e.g., JADEPUFFER/Storm-3168 campaign) rather than standard manual operator activity, specifically when leveraging the python-requests user agent.
Detects instances where a user grants OAuth application permissions for high-risk scopes (e.g., mail access, offline access). The rule flags these grants, with higher risk scores assigned if the application publisher is unverified or unknown, helping identify potential illicit consent grant attacks often used to maintain long-term persistence in cloud environments.
Detects high-risk IAM policy modifications, specifically the attachment or creation of policies that grant wildcard permissions or full administrator access. The rule optionally correlates these permission changes with the recent creation of access keys or service account credentials for the same principal, indicating potential preparation for persistence or unauthorized access escalation.
Detects user-granted OAuth consent in Microsoft Entra ID (formerly Azure AD) involving high-risk scopes such as Mail.Read, Files.ReadWrite.All, or offline_access. This pattern is characteristic of illicit consent-grant phishing, where attackers entice users to authorize malicious applications to bypass multi-factor authentication (MFA) and establish persistent, programmatic access to sensitive mailbox and file resources.
Detects high-volume, diverse administrative and discovery activities in cloud environments, including SharePoint site enumeration, Azure AD user/identity discovery, and suspicious access to mail items via specific client applications, potentially indicating post-compromise reconnaissance or data harvesting.
Detects Azure AD sign-in events indicative of a session token replay attack. The rule identifies successful sign-ins where the traffic source originates from known residential proxy infrastructure (anonymizing services often used by attackers) and the authentication process lacks a fresh interactive MFA challenge, suggesting the use of a stolen, valid session token.
This rule detects internal users submitting potentially sensitive data to public generative AI applications (e.g., ChatGPT, Claude, Gemini) where Microsoft Purview DLP or a comparable inspection service has triggered a policy match. It correlates cloud application outbound signals with content inspection logs to identify high-risk exfiltration events while excluding sanctioned enterprise-licensed AI instances.
This rule detects potentially unauthorized device registration or Intune enrollment activity by monitoring Azure Sign-in logs. It specifically flags accounts that exhibit rapid, multiple device registration attempts (>= 2 in 5 minutes) combined with suspicious indicators such as scripted User Agents ('python-requests'), the presence of Primary Refresh Tokens (PRT), specific device naming patterns, or concurrent Intune enrollment activity. These behaviors are common indicators of automated adversary activity aiming to bypass conditional access policies by enrolling illicit devices.
Detects login attempts to source code repositories and developer tooling (GitHub, GitLab, Bitbucket, Azure DevOps, Slack, Visual Studio Code) originating from unmanaged or non-compliant devices, excluding traffic originating from known corporate network ranges.
Detects AI agent tooling (e.g., LangChain, Copilot, Claude Code) performing read operations on databases containing sensitive data patterns, or performing suspicious bulk data enumeration. The rule monitors Azure SQL Database security audit events for suspicious application name signatures and non-schema introspective queries.
Detects AI agent tooling (e.g., LangChain, Copilot, Claude Code) performing read operations on databases containing sensitive data patterns, or performing suspicious bulk data enumeration. The rule monitors Azure SQL Database security audit events for suspicious application name signatures and non-schema introspective queries.
Page 49 of 185