Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,004 detections
Filters
Last updated
All Time
Detection languages
1,442
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,443
11,831
5,875
5,151
4,864
3,004
Platforms
1,199
673
623
512
218
Products / Services
880
726
311
257
229
MITRE Techniques
1,661
1,109
905
468
464
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
Detects when a user account that has exhibited anomalous or risky sign-in behavior subsequently grants mailbox delegation, full-access, or Send-As permissions to another user (who is not the mailbox owner). This activity is indicative of a compromised account being used to establish persistence or facilitate email exfiltration and spoofing by expanding access to sensitive mailboxes.
This rule detects anomalous Privileged Identity Management (PIM) or Just-in-Time (JIT) role activation events. It identifies when a user activates a privileged role following suspicious activity such as a risky sign-in, during unusual (off-hours) time windows, or from an unfamiliar source IP address, potentially indicating session hijacking or credential abuse.
Detects sign-in events to high-privileged cloud management consoles (e.g., Azure Portal, Microsoft Entra, Intune, Okta, AWS, GCP) originating from sessions with elevated risk or anomalous characteristics. The detection monitors for factors such as the use of anonymized IP addresses, unmanaged devices, sessions marked as 'atRisk' by identity providers, or non-interactive service-based access to management APIs that deviate from standard administrative workflow patterns.
Detects 'Add member to role' operations in Entra ID where high-privileged directory roles are assigned to a user or service principal. This pattern is often a critical indicator of privilege escalation in account compromise scenarios where an attacker attempts to elevate their own or a secondary account's permissions within the tenant.
Detects the addition of new client secrets or certificates to existing applications or service principals in Azure AD. This activity is a common method for adversaries to establish persistence in a cloud environment by ensuring they maintain MFA-exempt application-level access even if compromised user accounts or session cookies expire.
Detects the modification or attachment of IAM policies to users or roles that contain wildcard 'Allow' permissions for all actions and resources. This behavior is indicative of privilege escalation where an identity is granted full administrative control over the AWS account.
This rule detects the initialization of an AWS CloudShell environment or session where Multi-Factor Authentication (MFA) was not explicitly recorded in the event data. Unauthorized access to CloudShell can provide an adversary with a command-line interface to interact with AWS APIs, potentially facilitating further malicious activities.
Detects unauthorized attempts to disable, suppress, or modify security monitoring services in AWS, including GuardDuty, Security Hub, and AWS Config. This rule monitors for API calls that effectively reduce cloud visibility or detection capabilities, explicitly excluding actions performed by authorized security-engineering roles.
Detects a rapid burst of read-only IAM and STS API enumeration calls originating from a single source IP address within a one-minute window. This behavior is indicative of automated reconnaissance tools (e.g., enumerate-iam, Pacu) used in the early stages of a cloud attack to identify permissions and potential targets for privilege escalation.
Detects the creation or modification of inbox rules in Office 365 that exhibit suspicious characteristics, such as external forwarding, automatic deletion/moving of sensitive emails (e.g., security alerts, junk), or rules containing keywords related to fraud. The rule optionally correlates this activity with recent anomalous sign-in attempts by the same user to identify potential account compromise.
Detects a cluster of Windows Event IDs 4740 (Account Lockout) or 4724 (Password Reset) targeting the local 'Administrator' account across multiple hosts within a short time window. This activity is indicative of automated or mass account manipulation often associated with ransomware payloads or centralized GPO-based credential tampering.
Detects Microsoft Windows Event ID 4662 (Object Access) where specific GUIDs associated with sensitive Active Directory rights (specifically, those related to DCSync or sensitive extended rights) are accessed. The rule filters out events originating from Domain Controllers to identify potentially anomalous access patterns from non-DC endpoints.
Detects AWS CloudTrail and Azure Active Directory (Entra ID) privilege-escalation actions (e.g., attaching policies, creating access keys, adding roles) performed by principals from rare source IPs or associated with low-frequency administrative actions, indicating potentially compromised or unauthorized account activity.
Detects when the Google Cloud Config Connector (KCC) service account is granted highly privileged roles (roles/owner or roles/resourcemanager.organizationAdmin) at the Organization scope. This pattern is indicative of a potential 'ConfigConfusion' confused-deputy attack, where a compromised Kubernetes namespace with IAMPolicyMember creation rights could be used to escalate privileges to Organization Owner.
Detects 'kubectl exec' or 'kubectl attach' requests targeting pods configured with dangerous security contexts (privileged, hostPID, or hostNetwork). The rule filters out known CI/CD service accounts to focus on potentially malicious manual or unauthorized programmatic access, which often serves as a precursor to container breakout or host-level compromise.
Detects unauthorized usage of the DS-Replication-Get-Changes and DS-Replication-Get-Changes-All extended rights, which are required for the DCSync technique. The rule monitors for Windows Event ID 4662 (Object Access) where a non-domain controller account attempts these replication operations, typically indicative of credential dumping and domain compromise.
Detects the granting of OAuth application permissions or app role assignments in Azure AD/Entra ID that include high-privilege scopes such as Mail.Read, Directory.ReadWrite.All, or offline_access. This behavior is characteristic of consent phishing attacks, where adversaries trick users into granting permissions to a malicious application to maintain persistent access to resources like email or tenant directories.
Detects potential AWS IAM privilege escalation attempts by identifying suspicious modifications to IAM policies, roles, or trust relationships, as well as unauthorized role assumption events. This rule monitors for activities such as attaching high-privilege policies (e.g., AdministratorAccess), creating new policy versions, and modifying trust policies to allow unexpected principals, which are common indicators of post-compromise activity designed to expand access within an AWS environment.
Detects the execution of high-privilege administrative, firewall, or file-system commands by processes identified as autonomous agent runtimes (e.g., LangChain, AutoGPT) or Robotic Process Automation (RPA) tools. This rule surfaces potential unauthorized infrastructure changes or automated abuse by agents when direct change management validation is absent.
Detects the creation of a new Windows service (EventID 7045) where the binary path references the ADMIN$ share, contains known remote execution tool artifacts (e.g., PSEXESVC, PAExec), or uses a randomized/GUID-like naming convention. This pattern is indicative of classic SMB-based lateral movement where an adversary performs remote code execution via service installation following credential compromise.
Detects unauthorized Active Directory replication requests (DCSync) by monitoring Event ID 4662 for specific directory replication GUIDs originating from computers not identified as domain controllers or by accounts not pre-approved for replication tasks.
Page 24 of 144