Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,004 detections
Filters
Last updated
All Time
Detection languages
1,442
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,443
11,831
5,875
5,151
4,864
3,004
Platforms
1,199
673
623
512
218
Products / Services
880
726
311
257
229
MITRE Techniques
1,661
1,109
905
468
464
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
Detects the creation or modification of serverless functions (AWS Lambda, Azure Function Apps, GCP Cloud Functions) that exhibit high-risk configurations. These include functions assigned overly permissive IAM roles, configured for public or unauthenticated invocation, or tied to event triggers commonly abused for persistence in cloud environments.
This rule detects the creation or modification of identity federation trust configurations across multiple cloud platforms (AWS, Azure AD, GCP). Attackers often modify trust relationships to establish persistence, forge credentials, or escalate privileges by introducing malicious identity providers (SAML/OIDC) that grant unauthorized access to the environment.
Detects the initialization of an AWS CloudShell environment or session. Attackers often abuse CloudShell as a managed, agentless environment within the provider's infrastructure to stage tools, perform reconnaissance using the AWS CLI, and exfiltrate data while bypassing standard endpoint-based detection.
Detects modifications to cloud storage configurations in Azure and GCP that grant public access to containers or blobs. Attackers may leverage this to expose sensitive data stored in cloud environments by changing permissions to be publicly readable.
Detects instances where a principal utilizes the iam:PassRole permission to assign a role with higher privileges to a newly created or updated compute resource (Lambda or EC2), potentially allowing the principal to assume the identity and elevated permissions of the passed role.
Detects instances where an administrative user grants 'AllPrincipals' OAuth consent to a multi-tenant application that is unverified or lacks a trusted publisher. This behavior is indicative of an attacker tricking a global admin into granting broad permissions (e.g., Mail.Read, Files.ReadWrite.All) to a malicious application, bypassing per-user consent restrictions.
Detects the addition of suspicious, attacker-controlled URLs (such as webhook.site, ngrok.io, or pipedream.net) as valid redirect URIs in an OAuth application's configuration. This technique can be used by an adversary to intercept OAuth authorization codes or tokens by luring users through a malicious authorization link, enabling persistent unauthorized access without further consent.
Detects the addition of a Service Principal to an Azure AD group that has the 'isAssignableToRole' property set to true. This behavior is a known privilege escalation technique where the service principal inherits the privileged roles assigned to that group, bypassing standard direct role-assignment monitoring.
This rule detects when new credentials (secrets or certificates) are added to an Azure Active Directory Service Principal. It flags this activity as suspicious if it occurs outside of typical business hours or if it exhibits signs of 'rapid re-keying', where multiple credentials are added to the same service principal within a 24-hour window. This behavior is a common indicator of persistence maintenance or credential rotation to support unauthorized access.
This rule detects scenarios where an external user is invited to an Azure AD tenant and subsequently granted a highly privileged role (such as Global Administrator or User Administrator) within a short window of time (1 hour). This pattern is indicative of potential persistence establishment or privilege escalation by an adversary using guest accounts.
Detects high-risk activities related to SAML token-signing certificates, including certificate export from Active Directory Federation Services (AD FS) or Active Directory Certificate Services (AD CS) and unauthorized configuration changes to enterprise application certificate management. These activities are potential precursors to Golden SAML attacks, where an adversary attempts to forge authentication tokens.
Detects administrative actions in Azure that disable or modify diagnostic settings, which stops the flow of logs to services like Azure Sentinel/Log Analytics, or deletes policy assignments. Such actions are often performed by adversaries to blind security operations monitoring prior to lateral movement or further malicious activity.
Detects instances where an IAM user or role attempts to assume a role in a different AWS account (Cross-Account) without providing a valid ExternalID. This often indicates unauthorized attempts to access or abuse cross-account trust relationships, which is a common technique for lateral movement or privilege escalation in cloud environments.
Detects the creation or modification of Microsoft 365/Exchange inbox rules that suggest malicious staging or exfiltration activities. This includes rules configured for external email auto-forwarding, automatic deletion of messages, or movement of emails into hidden/system folders (e.g., RSS Subscriptions, Archive) which may be filtered based on sensitive keywords related to financial or credential theft (e.g., invoice, wire, payment).
This rule detects potentially malicious bulk mailbox exfiltration operations (such as New-MailboxExportRequest, New-ComplianceSearch, or Search-Mailbox) performed by an account within 24 hours of experiencing a high or medium-risk sign-in event, suggesting post-compromise data harvesting.
Detects the creation or modification of mailbox inbox rules that configure forwarding or redirection to external addresses, or rules that automatically delete or move messages based on sensitive keyword filters (e.g., 'invoice', 'password'). It specifically looks for indicators of mailbox hiding (hidden rules) which are frequently used by attackers to maintain persistence and conceal activity, particularly following unauthorized access or token theft.
Detects AWS CloudTrail events where an actor performs identity or session token manipulation, specifically through the use of sts:GetFederationToken or sts:AssumeRole, or by modifying MFA configurations such as DeactivateMFADevice or CreateVirtualMFADevice on privileged accounts. This activity may indicate an attempt to gain persistent access, bypass security controls, or masquerade as a legitimate principal.
Detects the addition of a new client secret or certificate to an application or service principal by a user account. This activity is correlated with recent high-risk or suspicious sign-in events. Adversaries often perform this action following account takeover to establish durable, MFA-immune persistence in the cloud tenant.
Detects instances where a file is downloaded or exfiltrated, followed by the deletion or alteration of its version history within a 7-day window. This behavior is consistent with post-theft activities aimed at obfuscating access logs or sanitizing stolen data by removing original versioning markers, often observed in insider threat or compromised account scenarios.
The following analytic identifies cloud instances being modified by users who have not previously modified them. It leverages data from the Change data model, focusing on successful modifications of EC2 instances. This activity is significant because it can indicate unauthorized or suspicious changes by potentially compromised or malicious users. If confirmed malicious, this could lead to unauthorized access, configuration changes, or potential disruption of cloud services, posing a significant risk to the organization's cloud infrastructure.
The following analytic detects modifications to the Access Control List (ACL) of the AdminSDHolder object in a Windows domain, specifically the addition of new rules. It leverages EventCode 5136 from the Security Event Log, focusing on changes to the nTSecurityDescriptor attribute. This activity is significant because the AdminSDHolder object secures privileged group members, and unauthorized changes can allow attackers to establish persistence and escalate privileges. If confirmed malicious, this could enable an attacker to control domain-level permissions, compromising the entire Active Directory environment.
Page 10 of 144