Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,864 detections
Filters
Last updated
All Time
Detection languages
2,523
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,448
1,199
1,091
792
575
Platforms
39,921
7,246
6,535
3,864
3,627
Products / Services
1,755
1,449
1,120
438
406
MITRE Techniques
1,888
1,391
913
814
726
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Detects high-risk operations performed by the Entra ID/AAD Connect synchronization service account (e.g., Sync_* or ADToAADSyncServiceAccount). This account, which often holds broad directory permissions, is a prime target for attackers to gain persistence or escalate privileges within the cloud directory. The rule monitors for unauthorized sign-ins, sensitive configuration changes (such as modifications to federation trust, authentication policies, or directory synchronization settings), and password resets targeting the sync account itself.
Detects sign-in activity originating from a known suspicious VPN/proxy IP range targeting critical Microsoft 365 applications. The rule specifically monitors for instances where multi-factor authentication (MFA) enforcement appears to be absent or failed, suggesting a potential account compromise and subsequent data access attempt via a proxy/VPN.
Detects credential stuffing in Entra ID sign-in logs: one source IP failing against many distinct accounts within an hour, then succeeding on a small number of them.
Detects anomalous account behavior where a single user account authenticates to three or more distinct applications within a 60-minute window while originating from at least two different IP addresses. This pattern is indicative of a successful account compromise followed by rapid reconnaissance or data exfiltration across multiple cloud services.
This rule identifies successful sign-in events using the Azure CLI application where multi-factor authentication (MFA) was not enforced. This is a potential indicator of a misconfiguration where sensitive cloud management interfaces are accessible via single-factor authentication, or a sign of an adversary attempting to leverage a less secure authentication pathway.
Detects Microsoft Entra ID (formerly Azure AD) sign-in attempts that use the specific, hardcoded User-Agent string associated with the TeamFiltration tool. This tool is frequently used for mass credential testing against Microsoft 365 environments. The detection looks for a suspicious and outdated combination of Teams, Electron, and Chrome versions that would not be present in legitimate, modern Microsoft Teams client traffic.
This analytic detects the execution of the ConvertTo-AADIntBackdoor command via PowerShell Script Block Logging.
The ConvertTo-AADIntBackdoor command is part of the AADInternals toolkit, which is used primarily for security testing and administrative tasks in Azure Active Directory (Azure AD) environments.
This particular command is designed to create a "backdoor" in a federated Azure AD domain.
When executed, ConvertTo-AADIntBackdoor modifies the federation settings of a domain by adding or changing the federation configuration to allow an attacker to control the authentication process.
This manipulation enables the creation of security tokens that can impersonate any user within the Azure AD tenant.
Consequently, this allows an attacker to bypass Multi-Factor Authentication (MFA), escalate privileges, and maintain persistent access to the Azure AD environment.
The ConvertTo-AADIntBackdoor command is part of the AADInternals toolkit, which is used primarily for security testing and administrative tasks in Azure Active Directory (Azure AD) environments.
This particular command is designed to create a "backdoor" in a federated Azure AD domain.
When executed, ConvertTo-AADIntBackdoor modifies the federation settings of a domain by adding or changing the federation configuration to allow an attacker to control the authentication process.
This manipulation enables the creation of security tokens that can impersonate any user within the Azure AD tenant.
Consequently, this allows an attacker to bypass Multi-Factor Authentication (MFA), escalate privileges, and maintain persistent access to the Azure AD environment.
Detects high-volume retrieval of secrets by a single principal within a one-hour window across AWS Secrets Manager, Azure Key Vault, and Google Cloud Secret Manager. This behavior is indicative of bulk credential harvesting or automated sensitive data exfiltration following unauthorized access or privilege escalation in cloud environments.
This rule monitors for network and user interaction with known phishing domains that impersonate Microsoft, Outlook, or Teams services. It aggregates data from DNS queries, device network connections, inbound email URL links, and web URL click events to identify potential phishing attempts using a community-sourced watchlist from phishunt.io.
This rule detects potential privilege escalation in cloud environments (AWS, Azure, GCP) by identifying the attachment or update of overly permissive policies (e.g., wildcard permissions or administrative roles) followed by rapid execution of high-privilege actions (like creating new users, keys, or profiles) by the same actor within 15 minutes.
Detects instances where a user account registers or modifies MFA authentication methods (such as phone numbers or apps) for a different user account. This behavior is indicative of an attacker with administrative privileges attempting to establish persistence on a target account by adding their own MFA device.
Detects high-frequency, short-duration UDP flow activity on NetScaler VPN ports (443/4433) indicative of volumetric or malformed DTLS handshake probing, potentially associated with exploitation attempts like CVE-2026-88772.
Detects credential stuffing in Entra ID sign-in logs: one source IP failing against many distinct accounts within an hour, then succeeding on a small number of them.
Detects credential stuffing in Entra ID sign-in logs: one source IP failing against many distinct accounts within an hour, then succeeding on a small number of them.
Detects potential scanning and exploitation attempts against Oracle PeopleSoft Environment Management Hub (PSEMHUB) endpoints, specifically targeting CVE-2026-35273. The rule monitors Azure Application Gateway logs for suspicious HTTP methods (PUT, DELETE, OPTIONS, TRACE) or parameters (e.g., directory traversal strings, command injection indicators) combined with high-frequency sequential probing patterns.
This rule detects potentially malicious reuse of an existing Entra ID (Azure AD) refresh or session token (via UniqueTokenIdentifier) across multiple, distinct device IDs, IP addresses, or user-agent strings within a short period (default 4 hours). It specifically flags instances where the authentication was completed via a non-interactive token claim, suggesting the adversary is bypassing MFA by hijacking an active session.
This rule identifies successful sign-in events using the Azure CLI application where multi-factor authentication (MFA) was not enforced. This is a potential indicator of a misconfiguration where sensitive cloud management interfaces are accessible via single-factor authentication, or a sign of an adversary attempting to leverage a less secure authentication pathway.
Detects modifications to Microsoft Entra ID (formerly Azure AD) authentication methods policy where a new external authentication method is configured using a non-approved discovery URL. This could indicate an adversary attempting to configure a malicious identity provider to facilitate authentication bypass or unauthorized access.
Detects instances where an identity associated with AI or automated agents (service accounts, service principals, bots, or assistants) is assigned to highly privileged administrative roles or security groups in the directory. This behavior potentially indicates an attempt to escalate privileges using a compromised or improperly configured agent identity.
This rule detects potentially compromised accounts by correlating risky Entra ID sign-ins to Citrix NetScaler with subsequent VPN session establishment followed by rapid, high-volume outbound connection activity from the source IP address. This pattern is indicative of a threat actor using compromised credentials to gain access via VPN and immediately perform internal network scanning or data staging.
This rule detects potential password spraying activity by monitoring for a single source IP address that targets multiple distinct user accounts with failed authentication attempts. It specifically identifies 'low-and-slow' patterns that may attempt to evade standard lockout thresholds, and flags cases where legacy authentication protocols are utilized, a technique commonly employed to bypass Multi-Factor Authentication (MFA).
Page 6 of 184