Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,866 detections
Filters
Last updated
All Time
Detection languages
2,525
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,091
792
575
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
1,755
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Detects sign-in events where a sign-in attempt is performed with a valid application ID but contains a blank application name, indicating potential spoofing of an OAuth client to bypass Conditional Access policies. The rule specifically monitors instances where Conditional Access status is recorded as 'notApplied'.
This KQL rule queries the IdentityInfo table to retrieve the most recent identity, risk, and criticality profile for a specific user account. It maps raw criticality data into a human-readable format and extracts key identity attributes such as department, job title, and assigned roles.
Detects the successful creation or update of an Azure Container Instance labeled with 'fortress' that utilizes a MongoDB image from a specific internal container registry.
This query hunts for suspicious cases where Warp Terminal or a Warp-related parent process spawns Unix-like shell interpreters such as sh, bash, zsh, fish, or dash, and executes commands using shell execution patterns like -c, /bin/sh, sh -c, or bash -c. It detects suspicious post-condition behavior consistent with exploitation attempts for CVE-2026-48703 and CVE-2026-48731
This rule detects authentication attempts to the 'Device Registration Service' in Entra ID where the User-Agent string contains 'python'. This is often indicative of automated scripts, such as those using libraries like msal, being used to interact with device management APIs, which may be associated with legitimate automation or adversary activity.
Detects new device registrations in Microsoft Entra ID where the device display name is prefixed with 'Forg365-', a pattern used by the Forg365 PhaaS (Phishing-as-a-Service) platform. This activity is indicative of an adversary establishing persistent, unmanaged device access to compromised Microsoft 365 accounts.
This rule serves as an investigation framework for Microsoft Entra ID sign-in events. It enables security analysts to filter, normalize, and inspect user authentication activities, including sign-in types (interactive/non-interactive), device management status, user risk levels, and conditional access status. The query is designed for incident response and forensic analysis rather than automated alerting.
This rule detects scenarios where a user's session originates from the 'Microsoft Authentication Broker' and another application (like 'OfficeHome' or 'One Outlook Web') within a short window (15 minutes), but from different source IP addresses. This indicates potential session hijacking or the use of stolen session cookies by an external actor.
Detects process command lines using curl to query the Azure Instance Metadata Service (IMDS) endpoint (169.254.169.254) for OAuth tokens. This behavior is indicative of an attacker attempting to leverage an Azure Managed Identity associated with a compromised virtual machine to obtain temporary security tokens for unauthorized access to other Azure resources.
Detects successful read operations of Azure role assignments where the response or properties involve the 'Contributor' role, potentially indicating reconnaissance of highly privileged access within the subscription.
Detects the restart action performed on a specific Azure container group named 'fr33m3' within the 'bialystok-rg' resource group. This monitors for lifecycle management activities that could be indicative of service manipulation or persistence resets.
Detects instances where an Azure Container Group is restarted within 30 minutes of a successful container image push to an Azure Container Registry in the same subscription. This pattern may indicate an automated or manual deployment process following a code update, which could be misused if unauthorized image pushes are occurring.
Detects anomalous, high-volume enumeration of Azure OAuth application IDs from a single IP address, indicative of an adversary attempting to map or verify OAuth applications, potentially leveraging spoofed client IDs for discovery or bypass attempts.
Detects high-volume, anomalous authentication failure patterns originating from a single IP address, characterized by a large number of distinct applications and users accessed within a one-hour window. This is indicative of potential automated credential-based attacks such as password spraying or brute force.
Detects a near-simultaneous correlation between a user registering a new FIDO2 authentication method and a login session from an unmanaged or non-compliant device. This behavioral pattern is often associated with adversary-in-the-middle or vishing attacks where an attacker tricks a user into registering an attacker-controlled security key to maintain persistent MFA access.
Detects use of 'az acr show' or 'az acr repository list' commands to enumerate Azure Container Registry security settings such as adminUserEnabled, anonymousPullEnabled, or networkRuleBypassOptions, indicating reconnaissance for misconfigurations.
Detects Microsoft Entra ID (formerly Azure AD) device registration, ownership assignment, or user assignment operations where the device display name matches a suspicious naming pattern, specifically 'GraphSpy-Device'. This naming convention is often associated with the GraphSpy tool, which is used by adversaries to enumerate and manipulate Entra ID resources, including registering rogue devices to bypass conditional access or MFA.
Detects high-frequency Resource Owner Password Credentials (ROPC) authentication requests targeting the OAuth token endpoint. Attackers use ROPC for brute-forcing, credential stuffing, or bypassing security controls by directly passing user credentials to the OAuth flow.
Detects high volumes of authentication failures (AADSTS50034) targeting non-existent or invalid usernames from a single source IP address, potentially indicating account enumeration or password spraying activity.
Detects multiple authentication failure attempts (error code 700016: Application not found in directory) originating from the same IP address against multiple user accounts. This pattern is indicative of an adversary attempting to find or exploit service principals or misconfigured applications across the tenant.
Detects login attempts using an Outlook/Office-specific User-Agent string where the application being accessed does not match common Microsoft 365 services (Outlook, Office, Exchange, Teams, OneDrive, SharePoint, ActiveSync, or Skype). This pattern is often indicative of programmatic attempts to bypass or spoof standard application signatures during credential stuffing or brute force campaigns.
Page 90 of 185