Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
694
181
114
75
54
Contributors
328
252
122
76
71
Categories
726
700
220
196
148
Platforms
1,120
187
161
59
51
Products / Services
10,647
9,755
6,688
4,418
3,745
1,153
MITRE Techniques
699
428
360
209
197
CVEs
2
2
1
1
1
IDS Classtypes
4
3
1
1
IDS Protocols
8
This rule detects administrative changes to cloud storage configurations (AWS S3, Azure Blob, and GCP Storage) that result in public or anonymous read/write access to buckets or containers, which could lead to unauthorized data exposure.
Detects instances where a non-administrative user grants OAuth application permissions for high-risk Microsoft Graph delegated scopes. This activity is a common indicator of 'consent phishing' campaigns, where an attacker tricks a user into authorizing a malicious application, granting persistent access to the user's data and resources via API tokens, even after password resets.
Detects unauthorized modifications to federation trust configurations, such as IssuerUri, federationMetadataUrl, or signing certificate thumbprints, on a federated domain. Adversaries may manipulate these settings to establish credential-independent persistence or to forge SAML tokens (Golden SAML) by repointing the federation metadata to attacker-controlled infrastructure.
Detects modifications to the Active Directory Federation Services (AD FS) token-signing certificate on a federated domain. This activity is a critical precursor to Golden SAML attacks, where an attacker replaces the legitimate signing certificate with one they control to forge SAML assertions and bypass authentication mechanisms. The rule excludes modifications initiated by applications identified as federation services.
Detects when a service principal is added as an owner to an application or another service principal. This activity indicates a potential privilege escalation or persistence attempt, where a compromised application gains administrative control over other identities or resources within the Azure environment.
Detects instances where an Entra ID (Azure AD) application is registered and subsequently granted consent by the same user within 30 minutes, specifically when the activity occurs outside of typical business hours (7 AM - 7 PM) or from disparate IP addresses. This behavior pattern is indicative of potential malicious OAuth application registration and subsequent token-granting by an attacker to maintain persistent access to an environment.
This rule detects administrative changes to Conditional Access (CA) policies in Entra ID (Azure AD), specifically monitoring for the disabling of policies, transitioning them to report-only mode, or the removal of critical security grant controls such as MFA or Compliant Device requirements. It also alerts on the outright deletion of any CA policy, which could indicate an adversary attempting to bypass security controls or maintain persistent access.
Detects instances where a user grants OAuth consent or assigns roles to an application that lacks a verified publisher and requests broad permissions across multiple sensitive categories (e.g., Mail, Files, and Directory). This behavior is characteristic of consent-phishing campaigns designed to harvest data from cloud environments.
This rule detects when a new password credential (client secret) is added to an existing Azure AD Service Principal or application. This activity is a common method for adversaries to establish persistence in a cloud environment that survives password resets or MFA enforcement on the original administrative account.
Detects the deletion of Azure Monitor diagnostic settings or log profiles that export subscription-level Activity Logs. This action disables logging, effectively blinding security visibility into tenant operations, and is often used by adversaries as a defense-evasion technique before conducting further malicious activities.
This rule detects the use of browser-based cloud shells (AWS CloudShell, Azure Cloud Shell) as an entry point for post-exploitation activities, specifically tracking when these sessions are followed by object storage operations (S3 PutObject/GetObject or equivalent Azure Blob operations) within the same session context. This pattern is indicative of attackers using ephemeral cloud shells to stage stolen data or download offensive tooling, thereby bypassing host-based EDR monitoring.
This rule detects the use of browser-based cloud shells (AWS CloudShell, Azure Cloud Shell) as an entry point for post-exploitation activities, specifically tracking when these sessions are followed by object storage operations (S3 PutObject/GetObject or equivalent Azure Blob operations) within the same session context. This pattern is indicative of attackers using ephemeral cloud shells to stage stolen data or download offensive tooling, thereby bypassing host-based EDR monitoring.
Detects administrative actions intended to disable, modify, or suppress logging and alerting capabilities within AWS and Azure, specifically targeting services like Amazon GuardDuty, AWS Security Hub, AWS Config, and Microsoft Defender for Cloud. Such actions are frequently observed as a precursor to unauthorized activity to hide malicious actions from detection systems.
Detects the deployment of virtual machines with public IP addresses (in Azure) or compute instances with external IP addresses (in GCP) by a single principal within a 15-minute window. This behavior is indicative of a newly-privileged identity or an compromised account establishing externally-accessible infrastructure for further malicious activity.
Detects potential abuse of Cloud Shell to persist access in cloud environments. For GCP, it monitors the injection of SSH keys into instance or project metadata from a Cloud Shell session. For Azure, it detects a pattern involving Cloud Shell storage provisioning followed by a subsequent VM run-command or SSH public key update, indicating potential unauthorized management of virtual machines.
Detects attempts to disable, degrade, or bypass cloud-native security monitoring services in GCP and Azure. This includes disabling GCP Security Command Center, creating broad mute configurations for security findings, downgrading Azure Defender for Cloud pricing tiers, or deleting Azure security automation workflows. These actions are common indicators of defense evasion during an incident.
Detects unauthorized modifications to trust relationships, including Azure AD cross-tenant access policy updates, federation settings, or multi-tenant application credential changes, and GCP Workload/Workforce Identity Federation pool policy updates, when the external entity is not on the approved allow-list.
Detects instances where a long-dormant Entra ID (Azure AD) service principal is reactivated shortly after having a new credential added or a new app role assigned. This activity is a potential persistence technique where an attacker repurposes a legitimate, high-privileged, but unused service principal to blend in as legacy automation.
Detects instances where an administrative user grants 'AllPrincipals' OAuth consent to a multi-tenant application that is unverified or lacks a trusted publisher. This behavior is indicative of an attacker tricking a global admin into granting broad permissions (e.g., Mail.Read, Files.ReadWrite.All) to a malicious application, bypassing per-user consent restrictions.
Detects the addition of a new client secret or certificate to an existing Microsoft Entra ID (formerly Azure AD) application or service principal. This behavior is often used by adversaries to establish persistence following the compromise of an existing identity with administrative permissions, allowing continued access even if the original compromised credentials are revoked.
Detects changes to federation settings on an Entra ID domain, including modifications to IssuerUri, ActiveLogOnUri, MetadataExchangeUri, or SigningCertificate, as well as transitions between Managed and Federated authentication types. Such changes can facilitate 'Golden SAML' attacks by allowing an adversary to forge authentication tokens for the tenant.
Page 9 of 55