Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
694
181
114
75
54
Contributors
328
252
122
76
71
Categories
726
700
220
196
148
Platforms
1,120
187
161
59
51
Products / Services
10,643
9,755
6,688
4,418
3,745
1,153
MITRE Techniques
699
428
360
209
197
CVEs
2
2
1
1
1
IDS Classtypes
4
3
1
1
IDS Protocols
8
Identifies when a network security configuration in Azure is modified or deleted. This could indicate an adversary attempting to bypass security controls, establish persistence, or impact the availability of resources.
This rule identifies when a device or device configuration is modified or deleted within Azure. This activity is logged in Azure Activity Logs and can indicate administrative changes, potential misconfigurations, or malicious activity aimed at impacting the availability or integrity of cloud resources.
Identifies when an Azure Kubernetes CronJob or Job is created or modified in Azure Cloud. Adversaries may use Kubernetes CronJobs or Jobs for scheduling execution of malicious code that would run as a container in the cluster, establishing persistence or executing malicious tasks.
Identifies when an Azure Application Security Group is modified or deleted. This could indicate an attempt to alter network access controls, potentially to bypass security measures or disrupt services.
This rule detects when an end user grants consent to an application in Azure Active Directory (now Microsoft Entra ID). Specifically, it triggers when the 'ConsentContext.IsAdminConsent' field is 'false', indicating that the consent was given by a regular user rather than an administrator. This activity can be a precursor to adversaries stealing application access tokens by tricking users into authorizing malicious applications.
This rule identifies when an application is deleted in Azure. This could indicate an attempt by an adversary to remove traces of their activity, disrupt services, or impact the availability of applications.
Identifies when an Azure Network Firewall Policy is modified or deleted. This could indicate an attempt to bypass security controls or disrupt network segmentation.
This rule identifies when a new Azure Cloud Shell instance is created within the Azure portal. Cloud Shell provides a browser-based shell experience for managing Azure resources, and its creation could indicate administrative activity, or potentially, an attacker establishing a persistent command-line environment within a compromised Azure subscription.
This detection uses Azure Activity logs (Administrative category) to identify the deletion of an Azure AD Hybrid Health AD FS service instance in a tenant. A threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs. The health AD FS service can then be deleted after it is no longer needed via HTTP requests to Azure.
Identifies when an Azure Kubernetes Pod is deleted. This activity could indicate an attempt to disrupt services, evade detection, or remove evidence by an attacker. Monitoring these deletions is crucial for maintaining the integrity and availability of Kubernetes deployments.
This rule identifies when an Azure DNS zone is either modified or deleted. This activity is detected by monitoring Azure Activity Logs for operations starting with 'MICROSOFT.NETWORK/DNSZONES' and ending with '/WRITE' (for modifications) or '/DELETE' (for deletions). Such changes can indicate malicious activity aimed at redirecting traffic or disrupting services.
Detects when events are deleted in Azure Kubernetes. An adversary may delete events in Azure Kubernetes in an attempt to evade detection by removing forensic evidence.
Identifies when an Azure Firewall Rule Configuration is modified or deleted. This activity can indicate an adversary attempting to bypass network defenses or disrupt services.
Identifies when a service principal is created in Azure. This activity can be an indicator of an adversary establishing persistence or preparing for further actions within the Azure environment.
This rule detects when an application is granted delegated or app role permissions within Microsoft Graph, Exchange, SharePoint, or Azure AD. This activity can indicate an adversary attempting to establish persistence or elevate privileges by giving a malicious application access to sensitive resources.
This rule identifies when Azure Firewall Rule Collections (Application, NAT, and Network) are either modified or deleted. This activity can indicate an attempt to bypass network controls, potentially allowing unauthorized access or data exfiltration. Monitoring these operations is crucial for maintaining network security posture in Azure environments.
This rule identifies when an Azure Virtual Network or Virtual Network Gateway is modified or deleted. This activity is captured through Azure Activity Logs, specifically looking for 'MICROSOFT.NETWORK/VIRTUALNETWORKGATEWAYS/' or 'MICROSOFT.NETWORK/VIRTUALNETWORKS/' operations that end with '/WRITE' or '/DELETE'. Such actions can indicate unauthorized changes to network infrastructure, potentially leading to denial of service, network segmentation bypass, or other security incidents.
This rule identifies when a virtual network device in Azure, such as a network interface, network virtual appliance, virtual hub, or virtual router, is either modified or deleted. Monitoring these operations can help detect unauthorized changes or disruptions to network infrastructure.
Detects when a new owner is added to an application in Azure AD. This action grants the newly added account privileges to modify and configure the application, which could be abused by an attacker to maintain persistence, elevate privileges, or access sensitive data.
Detects when an administrator grants an application either application permissions (app roles) or highly privileged delegated permissions within an Azure environment. This action is logged in the Azure audit logs as 'Add app role assignment to service principal'. Such assignments can lead to persistence or privilege escalation if abused.
Identifies when a Point-to-site VPN is Modified or Deleted in Azure. This could indicate an attacker attempting to disrupt network access or cover their tracks by removing or altering VPN configurations.
Page 54 of 55