Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,866 detections
Filters
Last updated
All Time
Detection languages
2,525
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,091
792
575
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
1,755
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
This rule monitors for security alerts related to Azure AI services, specifically detecting credential theft attempts and LLM jailbreak attempts that have been blocked or detected by Azure's built-in content filtering mechanisms.
Detects anomalous account enumeration attempts by monitoring Azure AD Sign-in logs for a high volume of '50034' error codes (invalid username) originating from a single IP address within a short time window. This behavior is often indicative of an adversary attempting to identify valid user accounts within the environment.
Detects HTTP requests to Gitea instances containing the X-WEBAUTH-USER header, which facilitates user impersonation when Gitea is misconfigured with 'REVERSE_PROXY_TRUSTED_PROXIES = *' in a Docker environment. This vulnerability (CVE-2026-20896) allows an unauthenticated attacker to impersonate any user, including administrators.
Detects unauthenticated POST requests directed at the '/accessv2' endpoint of an Azure Application Gateway originating from non-internal IP addresses. This behavior is associated with the exploitation of vulnerabilities like CVE-2026-8037.
Detects instances where a user or service principal is assigned to high-privilege roles (e.g., Global Administrator, Owner) without utilizing the Microsoft Entra Privileged Identity Management (PIM) service. This is indicated by the absence of 'PIM' in the LoggedByService field for a successful 'Add member to role' operation, which could signify an attempt to bypass established access controls and gain unauthorized elevated persistence.
Detects the presence of the 'x-ms-RefreshTokenCredential' cookie in requests directed to 'login.microsoftonline.com' originating from a client that does not identify as Windows. This behavioral pattern is associated with session hijacking techniques where an attacker uses a tool (e.g., Device Code Lab) to inject a session cookie into a browser, allowing for unauthorized access to Microsoft 365 services.
Detects the creation or update of Azure Network Security Group (NSG) rules that allow inbound traffic from the entire internet (0.0.0.0/0 or *) to management ports (RDP 3389 or SSH 22). This behavior often indicates an attempt to expose administrative services to the public internet.
Detects high frequency administrative modifications, such as user creation/deletion, password resets, or group membership changes, performed by service accounts associated with Azure AD Connect or Microsoft Entra Connect. This behavior may indicate account compromise where a service principal is being abused to perform bulk identity management operations.
This rule detects when a user or administrator grants consent to an Azure AD or Office 365 application for permissions that provide significant access to mail, files, contacts, or directory data. This activity is a common vector for illicit OAuth consent attacks, where adversaries gain persistent access to sensitive data without requiring direct user credentials.
This rule detects a potential MFA fatigue attack by identifying users who experienced a high volume of denied MFA requests (5 or more) followed by at least one successful authentication within a 15-minute window across Okta and Azure Active Directory platforms.
This rule detects anomalous Azure AD sign-in behavior where a single user account authenticates from two or more distinct subnets (class C) within a 10-minute window. It specifically focuses on non-interactive logins or token issuance (e.g., refresh tokens) that are successful (resultType 0) and ignores service principal activity, which may indicate account compromise, session hijacking, or automated credential misuse.
Detects successful assignment of highly privileged roles (Global Administrator, Privileged Role Administrator, Security Administrator, Exchange Administrator) to a user in Microsoft Entra ID (formerly Azure AD). This is often a sign of privilege escalation or persistence establishment by an attacker.
This rule detects successful authentication attempts directed at network devices from sources not explicitly marked as authorized management systems. It identifies users or systems that are not recognized service accounts authenticating against network infrastructure and flags activity that involves multiple unique destination targets as high risk.
Detects when an application or service principal is assigned an app role containing sensitive permissions in Azure AD/Microsoft Entra ID. Such assignments can grant an application elevated access to mail, directory, or user management, which is a common tactic for persistence and privilege escalation in cloud environments.
This rule detects successful or failed logon attempts originating from IP addresses identified by threat intelligence as associated with botnets, command and control (C2) infrastructure, or proxies. The rule specifically looks for 'LogOn' or 'FailedLogOn' activity types where the source IP's threat intelligence indicator type is 'Botnet', 'C2', or 'Proxy', and where activity insights are available.
Detects Microsoft Device Code grant type authentications in Entra ID sign-in logs, consistent with the EvilTokens phishing kit abusing the OAuth device code flow to steal tokens without capturing passwords. Flags DeviceCode protocol sign-ins from browser-based clients, which is atypical for legitimate device code usage.
Detects updates or deletions of Azure Active Directory (Entra ID) Conditional Access policies that occur outside of typical business hours (Monday-Friday 08:00-18:00 UTC). Such modifications can be an indicator of an adversary attempting to circumvent security controls or maintain persistent, unauthorized access.
Detects anomalous credential access behavior in Azure Key Vault where a single identity performs more than 20 secret, key, or certificate read/list operations within a 5-minute window. This behavior is indicative of potential unauthorized reconnaissance or exfiltration of secrets stored in Key Vaults, excluding known automation service principals.
Detects Azure Privileged Identity Management (PIM) role activations that occur outside of standard business hours (before 07:00 or after 19:00 UTC, or on weekends) or involve high-privilege roles (e.g., Global Administrator, Privileged Role Administrator, Security Administrator).
This rule detects potentially malicious reconnaissance or enumeration activity by identifying a high volume of Microsoft Graph API requests (GET requests) to sensitive directory endpoints (users, groups, directoryRoles, servicePrincipals) from a single application identity (AppId) and IP address within a short time window.
Detects high frequency of denied Multi-Factor Authentication (MFA) requests for a specific user and IP address, indicating potential 'MFA fatigue' or 'MFA bombing' attacks where an adversary attempts to force a user to approve a push notification or code verification.
Page 96 of 185