Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,004 detections
Filters
Last updated
All Time
Detection languages
1,442
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,443
11,831
5,875
5,151
4,864
3,004
Platforms
1,199
673
623
512
218
Products / Services
880
726
311
257
229
MITRE Techniques
1,661
1,109
905
468
464
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
Detects a suspicious pattern often associated with Storm-3168 (JADEPUFFER) activity: prolonged, high-volume Azure resource enumeration by one service principal, followed shortly by a second service principal performing rapid, multi-subscription enumeration from the same source IP address.
Detects the creation of new Group Policy Objects (GPOs), linking of GPOs at the domain root level, or modifications to existing GPOs that include 'Firewall' in their configuration settings. These activities are common precursors or indicators of persistence mechanisms and defensive bypass attempts by adversaries seeking to weaken security controls or maintain unauthorized access.
This rule detects the creation or modification of mailbox rules (forwarding, redirection, or deletion) that occurs within two hours of a sign-in event flagged as high-risk, specifically those indicative of AiTM or token-replay attacks. It further filters for rules involving sensitive keywords, suggesting an attempt to intercept or hide specific categories of emails post-compromise.
Detects the creation, update, or activation of an external Identity Provider (IdP) or federated trust configuration within the Okta environment. This activity may indicate an attempt to establish a rogue federation trust, which allows an adversary to perform cross-tenant impersonation and authenticate as any user by minting assertions signed by attacker-controlled keys.
Detects the creation or modification of Network Address Translation (NAT) rules, port forwarding settings, or virtual IP configurations across various enterprise firewall vendors. This could indicate an adversary attempting to establish persistent inbound access to an internal network segment, bypass network egress controls, or perform reconnaissance on accessible services.
Detects when high-privilege application permissions (e.g., Directory.ReadWrite.All, Application.ReadWrite.All) are granted to a service principal via admin consent. This behavior can be used by attackers to gain persistent, stealthy administrative access to a Microsoft Entra ID tenant.
This rule detects when a user registers or adds a new device in Entra ID within a short timeframe (two hours) of experiencing a risky sign-in or a password reset. It specifically flags registrations involving potentially unmanaged, non-compliant, or unusually trusted devices, which may indicate an attempt to establish persistent access or bypass Conditional Access policies.
Detects the registration of a new MFA authentication method on an Entra ID account from an unrecognized IP or device, occurring in close temporal proximity to a password reset or a risky sign-in event. This behavior is indicative of an adversary establishing persistence via self-service MFA registration after compromising user credentials.
Detects the addition of service principal credentials by a user who is not explicitly listed as an owner of the application. This activity is monitored to identify potential persistence or privilege escalation attempts where an unauthorized account adds its own authentication method to an existing cloud application or service principal.
Detects instances where an administrator or user grants an application consent with highly sensitive permissions in Azure AD (Microsoft Entra ID). This activity is often associated with OAuth application phishing, where an adversary lures a user into granting excessive permissions to a malicious application, potentially leading to long-term persistence or unauthorized access to directory data and conditional access policies.
This rule detects when a non-privileged user adds a new owner to an Azure AD Application or Service Principal, followed by a suspicious modification (such as adding credentials or permissions) to that same application within 30 minutes. This behavior is indicative of an adversary attempting to gain persistent, elevated access to an application's service principal to manipulate its configuration or permissions.
This rule detects when a non-privileged user adds a new owner to an Azure AD Application or Service Principal, followed by a suspicious modification (such as adding credentials or permissions) to that same application within 30 minutes. This behavior is indicative of an adversary attempting to gain persistent, elevated access to an application's service principal to manipulate its configuration or permissions.
Detects the addition of new service principal credentials (passwords or certificates) to Azure AD applications occurring outside of typical business hours. This behavior may indicate an attacker attempting to establish persistence or maintain unauthorized access to cloud resources through an existing application identity.
Detects modifications to Microsoft Entra ID (formerly Azure AD) cross-tenant access settings where a new partner is added or inbound trust settings (such as MFA or device compliance) are enabled for an external tenant. This activity may indicate an attempt to establish a persistent backdoor or facilitate initial access into the environment via a compromised or malicious external identity provider.
Detects the creation of new programmatic credentials (AWS access keys, Azure AD service principal credentials, or GCP service account keys) where the identity creating the credential differs from the identity for which the credential is being issued. This behavior is often indicative of persistence mechanisms or credential abuse where an attacker with sufficient permissions creates secondary credentials for other accounts.
This rule detects the creation or modification of recurring cloud automation tasks (AWS EventBridge rules, Azure Automation Runbooks/Logic Apps, and GCP Cloud Scheduler jobs). Adversaries leverage these features to establish persistent access to a cloud environment by ensuring malicious code or scripts execute automatically, even after initial compromised credentials have been revoked.
Detects modifications to cloud security guardrails including AWS Service Control Policies (SCPs), Azure Policy assignments/exemptions, and GCP Organization Policies. These actions may indicate an attempt to disable security controls or weaken organizational policy enforcement.
Detects the addition of certificate-type credentials (AsymmetricX509Cert, usage=Verify) to Microsoft Entra ID (Azure AD) applications or service principals. This behavior is indicative of an attacker adding an adversary-controlled certificate to impersonate an application or service principal to achieve persistent, long-lived access.
Detects the suspicious sequence of adding a domain or changing federation settings followed rapidly by a configuration update to the federated domain. This pattern is indicative of an adversary establishing a covert federated backdoor for persistent, delegated authentication, allowing bypass of standard credential rotation mechanisms.
Detects modifications to Microsoft Entra ID (formerly Azure AD) cross-tenant access policies or B2B synchronization settings. Specifically, this rule monitors for the addition of new external partner tenants to trust lists or the relaxation of security controls such as MFA and compliant device requirements for external partner access.
Detects modifications to Microsoft Entra ID (formerly Azure AD) applications, service principals, or Application Proxy configurations that could be indicative of an adversary establishing persistent external access. This includes updates to external URLs, SSO settings, and authentication types, which are frequently used to facilitate persistence via malicious cloud application configurations.
Page 12 of 144