Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,866 detections
Filters
Last updated
All Time
Detection languages
2,525
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,091
792
575
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
1,755
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
This KQL detects potential Microsoft Defender tampering via PowerShell, including attempts to disable real-time or behavior monitoring and add Defender exclusions. It enriches results with tamper type, suspicious PowerShell flags, and confidence level to help prioritize medium/high-confidence activity.
Detects potential username enumeration attempts against Microsoft Entra ID (Azure AD) by monitoring for the 'AADSTS50034' error code, which occurs when a sign-in attempt is made with a username that does not exist in the directory. This behavior is often associated with adversary reconnaissance to identify valid user accounts.
Detects high-frequency Resource Owner Password Credentials (ROPC) authentication attempts originating from a single IP address against multiple different user accounts within a 15-minute window. This behavior is indicative of a password spraying or brute force campaign targeting cloud authentication services.
This KQL detects activity associated with network traffic to known C2 infrastructure (45.146.252.17), suspicious Node/NPM execution chains and dropped payload/marker files. Also looks for indicators of remote control, clipboard access, screenshot/desktop-control packages, Socket.IO C2 traffic, and file/browser/wallet data exfiltration behavior.
Detects when the administrative user is enabled for an Azure Container Registry (ACR). Enabling this account provides a static username and password, which may bypass more secure authentication methods like Azure Active Directory-based access and increase the risk of credential exposure.
Detects the execution of tasks within Azure Container Registry that involve sensitive strings or potential credential-related patterns in the task configuration, such as 'secret-task', 'acb_step_0', or specific flag references, which may indicate testing or exploitation of container build pipelines.
Detects anomalous discovery behavior in Azure where a principal performs multiple 'read' operations against both Container Registry and Role Assignments within a short timeframe. This pattern is consistent with an adversary attempting to map the cloud environment, identify accessible resources, and understand permission structures.
Detects high-frequency authentication attempts or broad user targeting originating from scripts using the 'python-requests' library. This behavior is indicative of programmatic password spraying or automated credential stuffing attacks.
This rule monitors the Microsoft 365 AuditLogs to retrieve and investigate all actions taken by or against a specific user account. It expands the TargetResources field to extract the TargetUPN and filters for a specific account, providing a timeline of operations, the actor who initiated the action, and the result of the operation.
This rule detects potential OAuth Device Code Flow phishing attacks where users are directed to malicious lure pages on romnor[.]ca to enter a Microsoft device code. It also alerts on authentication activity associated with a specific malicious OAuth client ID (d3590ed6-52b3-4102-aeff-aad2292ab01c) known to be used by a phishing backend to poll and claim OAuth tokens.
Detects the execution of 'az role assignment list' using the Azure CLI. This command is commonly used by adversaries to enumerate existing role assignments in an Azure environment, aiding in permission discovery and identifying potential targets for privilege escalation.
This rule monitors container logs for attempts to access the Azure Instance Metadata Service (IMDS) via the 169.254.169.254 endpoint to request OAuth tokens or access Azure Key Vault secrets. Such activity within a containerized environment is often indicative of credential theft or discovery attempts by an adversary attempting to escalate privileges using the container's managed identity.
Detects 'docker login' commands targeting an Azure Container Registry (.azurecr.io) that explicitly include username and password flags in the command line string. This behavior may indicate credential usage for registry authentication.
Detects GET requests to the Microsoft Graph API 'organization' endpoint, often used by malicious tools to validate a tenant environment or gather metadata before initiating C2 communication or secondary stages of an attack.
Detects when the administrative user account for an Azure Container Registry (ACR) is enabled. Enabling the admin user creates a static username and password for registry access, which may bypass modern identity-based access controls like Microsoft Entra ID (formerly Azure AD) and increase the risk of credential-based attacks.
This rule detects 'Push', 'Put', or 'PutManifest' operations on the 'mongo' repository using specific tags ('mongofr', 'latest'), which may indicate an attempt to overwrite or inject a malicious container image into a critical database registry.
Detects outbound TLS traffic directed toward ngrok.io infrastructure originating from Azure Container Instances. Ngrok is frequently used by adversaries to establish reverse proxies and tunnels to maintain persistent command-and-control access to compromised cloud-hosted containers.
Detects repeated sign-in attempts using unrecognized, malformed, or blank Application IDs (AppId). This often indicates automated reconnaissance or brute-force attempts targeting applications or service principals within the Azure Active Directory environment.
Detects anomalous, automated data exfiltration cycles in Microsoft 365 environments consistent with the Helix threat group. The rule identifies a pattern of successful sign-ins followed within 6 hours by new MFA registration, suspicious SharePoint enumeration, and a high-frequency, non-human-paced burst of file downloads.
Detects suspicious use of the OAuth 2.0 device code authentication flow. The rule identifies potential token harvesting and phishing attempts by flagging device code sign-ins that originate from unusual user agents, unknown IP addresses or ASNs, unrecognized applications, or for users who have not previously utilized device code authentication. Legitimate, first-party applications like Azure CLI and Azure PowerShell are explicitly excluded to minimize noise.
Detects high volumes of sign-in failures originating from the same IP address, specifically those returning error codes associated with invalid users or incorrect passwords, which is indicative of credential stuffing or user enumeration attacks targeting Entra ID.
Page 89 of 185