Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,004 detections
Filters
Last updated
All Time
Detection languages
1,442
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,456
11,839
5,876
5,155
4,865
3,004
Platforms
1,199
673
623
512
218
Products / Services
880
726
311
257
229
MITRE Techniques
1,661
1,109
905
468
464
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
Detects the clearing of Windows Security and System event logs, or Defender XDR audit logs, indicating potential adversary activity to remove traces of their actions.
Detects when a single user account performs 3 or more Privileged Identity Management (PIM) role activations within a 30-minute window. This behavior may indicate an attacker who has compromised a privileged account and is rapidly assuming multiple roles to perform lateral movement or privilege escalation.
Detects the addition of secrets or certificates to Azure service principals during non-business hours (before 7 AM or after 7 PM, or on weekends). This behavior may indicate an adversary attempting to establish persistence in a cloud environment by adding their own credentials to an existing service principal.
Detects the creation or modification of an email compliance or forwarding rule containing the specific typo "Patroit". This indicator is associated with the UNC6508 threat actor's data exfiltration activities via silently BCC-forwarding sensitive emails.
Inbox Rule Notification Suppression
Cortex XDR
Detects the creation or modification of inbox rules designed to hide security and MFA notifications by deleting, marking as read, or moving them to hidden folders. This technique is commonly used post-compromise to suppress alerts about rogue device enrollment, sign-ins, or password changes, preventing the victim from discovering an account takeover. It is a frequent persistence technique in Business Email Compromise (BEC) and Account Takeover (ATO) attacks.
Detects suspicious sequences of AWS CloudTrail API calls originating from non-console or non-service-account sources (CLI, curl, etc.). The rule flags scenarios where reconnaissance via 'GetCallerIdentity' is immediately followed by sensitive IAM modifications (CreateUser, CreateAccessKey) or privilege escalation attempts (AssumeRole), which may indicate the use of exfiltrated credentials.
Detects specific malicious activity patterns associated with the Miasma/Mini Shai-Hulud campaign targeting GitHub repositories. The rule monitors for unauthorized workflow creation, specific suspicious commit messages, and the use of orphan branches that impersonate dependabot or mimic specific campaign indicators.
Detects attempts to inject attacker-controlled credentials into Entra ID Agent Blueprints via the Microsoft Graph addPassword endpoint. This activity is identified by monitoring Microsoft Graph activity logs for 'addPassword' requests and correlating with Audit Logs for 'Add password' operations targeting resources containing 'blueprint' or 'Blueprint', or where modified properties include 'Blueprint Secret', 'passwordCredential', 'addPassword', or the actor has the 'Agent ID Administrator' role.
This rule detects modifications to Group Policy Objects (GPOs) that involve sensitive attributes such as logon scripts, startup/shutdown scripts, or file system paths, particularly when performed by service accounts or non-administrator users. This activity is a common indicator of persistence mechanisms or lateral movement via GPO abuse.
This rule detects when a user or administrator grants consent to an Azure AD or Office 365 application for permissions that provide significant access to mail, files, contacts, or directory data. This activity is a common vector for illicit OAuth consent attacks, where adversaries gain persistent access to sensitive data without requiring direct user credentials.
This rule detects suspicious use of sudo, modification of the sudoers file, or privilege escalation patterns specifically targeting edge network appliances (e.g., pfSense, Synology, Egnyte). It monitors for commands like sudo tee, sudo -l for permission enumeration, or the introduction of NOPASSWD entries, which are common indicators of persistence or privilege escalation attempts by service accounts.
Detects potential DCSync attacks by monitoring for Windows Event ID 4662 (Object Access) related to Directory Replication (DS-Replication-Get-Changes or DS-Replication-Get-Changes-All GUIDs) originating from non-domain controller accounts. This identifies unauthorized attempts to replicate Active Directory password data.
Detects execution of Azure Automation runbook jobs by managed identities that have recently been assigned high-privilege roles (Owner, Contributor, or User Access Administrator). This behavior is indicative of potential privilege escalation or abuse of existing high-privilege identities to execute unauthorized automation tasks.
This rule detects potentially compromised accounts by correlating successful device code authentication events that exhibit anomalous characteristics (such as first-time usage, high/medium risk scores, or non-compliant/unmanaged device status) with highly sensitive Azure AD/Graph API administrative operations occurring within 30 minutes of the sign-in.
Detects execution of Azure Automation runbook jobs by managed identities that have recently been assigned high-privilege roles (Owner, Contributor, or User Access Administrator). This behavior is indicative of potential privilege escalation or abuse of existing high-privilege identities to execute unauthorized automation tasks.
This rule detects potentially compromised accounts by correlating successful device code authentication events that exhibit anomalous characteristics (such as first-time usage, high/medium risk scores, or non-compliant/unmanaged device status) with highly sensitive Azure AD/Graph API administrative operations occurring within 30 minutes of the sign-in.
This rule detects the addition of new certificates or client secrets to Azure App Registrations or Service Principals by a user who is not recorded as an owner of that application in the last 90 days. This behavior is a common persistence and privilege escalation technique used by attackers to maintain access to cloud environments.
This rule detects indicators of the DCShadow attack technique by monitoring for the creation of nTDSDSA objects (which define domain controllers) or the addition of suspicious Service Principal Names (SPNs) often used in DCShadow simulations (GC/ or E3514235-4B06) to computer accounts. These indicators suggest an attacker is attempting to register a rogue Domain Controller to manipulate Active Directory data.
Detects a sequence of events within a 30-minute window for a single user, specifically capturing MFA configuration changes (reset/enrollment), authentication, and device registration, occurring outside of typical business hours (20:00 - 06:00). This behavioral pattern is often indicative of an adversary establishing persistence or account takeover after gaining access to a valid account.
This rule monitors for two distinct behaviors: direct modification of Group Policy Object (GPO) containers within Active Directory and suspicious execution of GPO management tools (gpupdate.exe or gpedit.msc) across multiple hosts in a short timeframe. AD modification events are flagged as critical, while elevated tool execution patterns are flagged as high or medium risk based on host prevalence.
Detects when a user account is added to a security-enabled global, local, or universal group in Active Directory. This behavior is captured by monitoring Security Events 4728 (global group), 4732 (local group), and 4756 (universal group). The rule flags actions performed by user accounts (excluding system accounts) and aggregates them by the source account performing the modification.
Page 70 of 144