Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,866 detections
Filters
Last updated
All Time
Detection languages
2,525
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,091
792
575
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
1,755
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
This rule detects potential unauthorized access to Azure Storage Blobs following the retrieval of storage account access keys. It correlates 'ListKeys' API events with subsequent blob access activities from either unrecognized IP addresses or via Shared Access Signature (SAS) tokens, indicating potential credential misuse.
Detects instances where a user or service principal is assigned to high-privilege roles (e.g., Global Administrator, Owner) without utilizing the Microsoft Entra Privileged Identity Management (PIM) service. This is indicated by the absence of 'PIM' in the LoggedByService field for a successful 'Add member to role' operation, which could signify an attempt to bypass established access controls and gain unauthorized elevated persistence.
Detects AzureHound or roadtx bulk enumeration of Microsoft Graph API endpoints using tokens obtained via CVE-2025-0309 CA policy bypass, characterized by high-frequency GET requests to /v1.0/users, /v1.0/groups, /v1.0/devices, /v1.0/servicePrincipals from Edge client IDs (f44b1140-bc5e-48c6-8dc0-5cf5a53c0e34 or 22098786-6e16-43cc-a27d-191a01a1e3b5) with password-only amr claim and no MFA.
This rule detects network activity indicating a potential modification or interaction with Microsoft Entra ID (Azure AD) multifactor authentication (MFA) settings. Specifically, it looks for POST requests to the Microsoft Graph API targeting authentication methods (e.g., phoneAuthenticationMethod), which may be indicative of an attacker modifying MFA settings to bypass security controls or register rogue authentication devices.
Detects the successful deletion of diagnostic settings in Azure, which may be an attempt by an adversary to impair logging and hide malicious activity.
Detects Azure Privileged Identity Management (PIM) role activations that occur outside of standard business hours (before 07:00 or after 19:00 UTC, or on weekends) or involve high-privilege roles (e.g., Global Administrator, Privileged Role Administrator, Security Administrator).
Detects Server-Side Template Injection (SSTI) attempts targeting the Floci API Gateway, specifically looking for Velocity Template Language (VTL) payloads intended to trigger Remote Code Execution via 'java.lang.ProcessBuilder', along with indicators of an IAM credential scope bypass.
Detects high-frequency enumeration of privileged roles or role assignments within Azure AD (Entra ID) by a single user or IP address within a short time window. This activity often precedes more targeted attacks aimed at compromising highly privileged identities.
Detects high volumes of sign-in failures or instances where Conditional Access policies are not applied, particularly for unregistered devices, indicating potential attempts to bypass security controls or perform brute-force attacks against cloud authentication.
Detects anomalous account enumeration attempts by monitoring Azure AD Sign-in logs for a high volume of '50034' error codes (invalid username) originating from a single IP address within a short time window. This behavior is often indicative of an adversary attempting to identify valid user accounts within the environment.
Detects OAuth application consent grants or modifications where the application is granted sensitive permissions including Mail.Read, Directory.Read.All, or User.Read.All. These permissions can be abused by attackers to exfiltrate email data or map the organization's directory.
Detects high frequency of denied Multi-Factor Authentication (MFA) requests for a specific user and IP address, indicating potential 'MFA fatigue' or 'MFA bombing' attacks where an adversary attempts to force a user to approve a push notification or code verification.
Detects successful assignment of highly privileged roles (Global Administrator, Privileged Role Administrator, Security Administrator, Exchange Administrator) to a user in Microsoft Entra ID (formerly Azure AD). This is often a sign of privilege escalation or persistence establishment by an attacker.
This rule detects successful configuration modifications to diagnostic settings or storage services where the destination resource is identified as being outside of the organization's trusted subscriptions or expected storage naming conventions. This activity may indicate an adversary attempting to exfiltrate logs or data to an attacker-controlled storage account.
Detects bulk enumeration of Microsoft Graph API endpoints (users, groups, devices, service principals) characteristic of tools like AzureHound or roadtx. The detection focuses on high-frequency GET requests originating from known Edge browser client IDs associated with CA policy bypass (CVE-2025-0309) where tokens lack MFA claims, indicating unauthorized reconnaissance in an Azure/Entra ID environment.
This rule detects potential token theft or MFA bypass by correlating successful MFA-satisfied interactive sign-ins with subsequent non-interactive sign-ins (token refreshes) occurring within a 60-minute window from different IP addresses for the same user. This pattern is indicative of an attacker stealing a session token (e.g., via session cookie theft or AiTM phishing) and using it to authenticate from a different location.
Detects instances where a user successfully authenticates using Multi-Factor Authentication (MFA) from one location, followed by a Single-Factor Authentication (SFA) logon from a different location within a 10-minute window. This behavior is indicative of potential session hijacking or session cookie theft where an attacker reuses an authenticated session or manipulates the authentication flow to bypass MFA requirements.
This rule detects the addition of new certificates or client secrets to Azure App Registrations or Service Principals by a user who is not recorded as an owner of that application in the last 90 days. This behavior is a common persistence and privilege escalation technique used by attackers to maintain access to cloud environments.
Detects the modification of an Azure Storage account's encryption settings to use a Key Vault for Customer-Managed Keys (CMK). This activity can be indicative of ransomware attacks where adversaries switch to an attacker-controlled key and then delete it, rendering all data in the storage account inaccessible.
Detects high frequency administrative modifications, such as user creation/deletion, password resets, or group membership changes, performed by service accounts associated with Azure AD Connect or Microsoft Entra Connect. This behavior may indicate account compromise where a service principal is being abused to perform bulk identity management operations.
Detects successful Microsoft 365 user authentications where Conditional Access (CA) policies were bypassed, resulting in single-factor authentication. This pattern is indicative of attackers using compromised edge network appliances—which are often configured as trusted network locations—to proxy authentication requests and circumvent security controls.
Page 99 of 185