Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
472 detections
Filters
Last updated
All Time
Detection languages
342
74
19
16
7
Contributors
91
90
77
52
35
Categories
182
148
81
66
60
Platforms
406
68
63
58
26
Products / Services
10,680
9,761
6,694
4,418
3,744
472
MITRE Techniques
180
121
96
78
71
CVEs
6
5
5
5
2
IDS Classtypes
2
1
1
1
1
IDS Protocols
6
Detects a suspected EvilTokens attack sequence where a user clicks a phishing URL and subsequently initiates a browser session to the Microsoft device-code authorization page (devicelogin) within 15 minutes, with the phishing lure domain appearing in the browser context.
Detects successful self-service password reset (SSPR) activities within Azure Active Directory. This event signifies that a user has successfully changed or reset their password using the self-service mechanism.
Detects the assignment of high-privileged Entra ID roles to a user account shortly after that same account underwent a password reset or MFA method change initiated by a helpdesk-privileged account. This detection pattern is specifically designed to identify Scattered Spider (UNC3944) tactics where social engineering is used to manipulate helpdesk processes to compromise identities and escalate privileges.
Detects a multi-stage attack pattern against publicly exposed AI service endpoints. The detection correlates: (1) Enumeration of sensitive AI/MCP-related API endpoints (minimum 3 distinct hits) in a 10-minute window; (2) Subsequent POST requests to AI service endpoints within 15 minutes of the enumeration; and (3) A spike of 5 or more server errors (HTTP 5xx) within 10 minutes following the POST activity. This pattern suggests automated reconnaissance followed by attempted exploitation of exposed AI model interfaces or orchestration services. Covers T1595.002, T1190
Detects a multi-stage attack pattern against publicly exposed AI service endpoints. The detection correlates: (1) Enumeration of sensitive AI/MCP-related API endpoints (minimum 3 distinct hits) in a 10-minute window; (2) Subsequent POST requests to AI service endpoints within 15 minutes of the enumeration; and (3) A spike of 5 or more server errors (HTTP 5xx) within 10 minutes following the POST activity. This pattern suggests automated reconnaissance followed by attempted exploitation of exposed AI model interfaces or orchestration services. Covers T1595.002, T1190
This rule detects potential unauthorized access to Azure Key Vault secrets by correlating AI agent process execution on an endpoint with subsequent Key Vault API activity by the same user account. It tracks common AI coding/assistant tools running locally on a device and triggers an alert if the same identity accesses cloud-plane Key Vault operations within 5 minutes. Additionally, it identifies anomalous bulk secret enumeration patterns in Key Vault audit logs to detect potential automated exfiltration.
Detects potential embedding inversion or extraction attempts by identifying callers exhibiting abnormally high volumes of similarity or vector search queries against RAG-enabled vector stores or cognitive search APIs within a short timeframe.
Detects potential embedding inversion or extraction attempts by identifying callers exhibiting abnormally high volumes of similarity or vector search queries against RAG-enabled vector stores or cognitive search APIs within a short timeframe.
This rule monitors for indicators of compromise (IOCs) associated with the TrustSink rogue MFA provider, specifically tracking the domain 'trident-sip-filter.ngrok-free.dev' and its associated OIDC discovery path. It aggregates signals from sign-in logs, audit logs, DNS queries, and network proxy traffic to identify attempts to interact with this malicious infrastructure.
Detects anomalous, unauthorized access to machine learning model artifacts (e.g., .onnx, .pt, .h5) within object storage or model registries. The rule identifies suspicious patterns including high-volume file reads by non-ML team identities, lack of multi-factor authentication, or access from geolocations outside approved operating regions, indicative of potential model exfiltration or intellectual property theft.
Single-source Sigma proxy for the authentication-persistence stage of the multi-stage device-code-phishing-to-Graph-collection chain (see the companion KQL correlation rule "Passkey Persistence: Device-Code Phishing to MFA Takeover and Graph Collection" for the full, threshold-gated, cross-table detection). Sigma has no join, temporal-windowing, or aggregation support, so this rule fires on the authentication-persistence event alone and does NOT enforce the device-code sign-in precursor or the subsequent Graph-activity burst - both required by the full correlation. Scoped to the two highest-signal operations only (new security-info registration, and any admin-initiated registration on another user's account) to cut noise from routine self-service profile edits.
Detects modifications or creations of Azure DevOps pipelines and service connections, as well as pipeline executions performed outside of standard business hours (6 AM to 8 PM on weekdays). This activity is intended to identify potential unauthorized infrastructure or pipeline configuration changes that could indicate persistence or lateral movement via CI/CD pipelines.
Detects modifications or creations of Azure DevOps pipelines and service connections, as well as pipeline executions performed outside of standard business hours (6 AM to 8 PM on weekdays). This activity is intended to identify potential unauthorized infrastructure or pipeline configuration changes that could indicate persistence or lateral movement via CI/CD pipelines.
This rule detects potentially malicious interactions with Azure OpenAI deployments, specifically looking for prompts indicative of malware-authoring, safety filter bypass attempts, and abnormal volumes of requests from a single identity.
Detects unauthorized write or modification operations against machine learning training data, feature stores, and model registries. The rule identifies suspicious activity by flagging actions occurring outside established change windows, attempts by identities with no prior history of modifying the resource, or bulk data modifications that could indicate training data poisoning or model tampering.
This rule detects reconnaissance activity targeting Azure App Service instances, specifically looking for attempts to access web-shell-like files, WordPress administration paths, PHP-CGI endpoints, or LangFlow code validation paths. It identifies potential Storm-3168 actor infrastructure through known IOCs or through patterns of high-volume, path-diverse HTTP requests that deviate from typical noise, helping to distinguish targeted probing from common internet background scanning.
Detects user-granted OAuth consent in Microsoft Entra ID (formerly Azure AD) involving high-risk scopes such as Mail.Read, Files.ReadWrite.All, or offline_access. This pattern is characteristic of illicit consent-grant phishing, where attackers entice users to authorize malicious applications to bypass multi-factor authentication (MFA) and establish persistent, programmatic access to sensitive mailbox and file resources.
This rule detects potential unauthorized access to Azure Key Vault secrets by correlating AI agent process execution on an endpoint with subsequent Key Vault API activity by the same user account. It tracks common AI coding/assistant tools running locally on a device and triggers an alert if the same identity accesses cloud-plane Key Vault operations within 5 minutes. Additionally, it identifies anomalous bulk secret enumeration patterns in Key Vault audit logs to detect potential automated exfiltration.
This rule detects potential unauthorized access to Azure Key Vault secrets by correlating AI agent process execution on an endpoint with subsequent Key Vault API activity by the same user account. It tracks common AI coding/assistant tools running locally on a device and triggers an alert if the same identity accesses cloud-plane Key Vault operations within 5 minutes. Additionally, it identifies anomalous bulk secret enumeration patterns in Key Vault audit logs to detect potential automated exfiltration.
This rule detects potential unauthorized access to Azure Key Vault secrets by correlating AI agent process execution on an endpoint with subsequent Key Vault API activity by the same user account. It tracks common AI coding/assistant tools running locally on a device and triggers an alert if the same identity accesses cloud-plane Key Vault operations within 5 minutes. Additionally, it identifies anomalous bulk secret enumeration patterns in Key Vault audit logs to detect potential automated exfiltration.
This rule detects anomalous spikes in API request volume for Azure Cognitive Services resources by comparing the current hourly request count against a 7-day historical baseline for the same hour-of-day. Significant increases (defined by a spike ratio threshold of 3.0 and a minimum call count of 20) may indicate potential misuse, automated scraping, unauthorized resource consumption, or potential denial-of-service activity targeting the API endpoints.
Page 6 of 23