Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,004 detections
Filters
Last updated
All Time
Detection languages
1,442
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,456
11,839
5,876
5,155
4,865
3,004
Platforms
1,199
673
623
512
218
Products / Services
880
726
311
257
229
MITRE Techniques
1,661
1,109
905
468
464
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
This rule detects the creation of Okta API tokens with broad administrative scopes (okta.users.manage, okta.factors.manage, or okta.apps.manage) by the same user multiple times within a one-hour window. This behavior can indicate an attempt to establish persistent access or bypass multi-factor authentication.
Identifies the specific Start-Process -Verb RunAs pattern invoked by the underlying dropping mechanism, specifically looking for PowerShell executing this command in conjunction with a cmd.exe process running 'vvvv.cmd'. This pattern is associated with the UnregStealer malware for privilege escalation.
Detects the creation or modification of an email compliance or forwarding rule containing the specific typo "Patroit". This indicator is associated with the UNC6508 threat actor's data exfiltration activities via silently BCC-forwarding sensitive emails.
Identifies Azure Active Directory (AAD) logins from new or unusual locations followed immediately by the creation of inbox rules designed to delete incoming emails. This behavior is indicative of an attacker gaining access to an email account and attempting to disrupt communication or hide their activities by automatically deleting legitimate emails.
This rule detects an unusually high volume of operations related to GitHub Enterprise repositories, such as adding users, creating teams, pushing to repositories, or changing permissions, within a short timeframe. This could indicate a compromised account or automated malicious activity targeting source code repositories.
This rule monitors GitHub audit logs for potentially malicious activities in repository management and CI/CD workflows. It detects suspicious commits by specific maintainers, impersonation of the Dependabot bot, usage of non-standard snapshot branch naming conventions, execution of unauthorized workflows, and specific commit message patterns indicative of unauthorized system modifications or testing.
Identifies the threat actor modifying Azure AD Cross-Tenant Access Policies to allow B2B collaboration with external attacker-controlled tenants.
Detects device registration attempts mapping a refresh token to the Device Registration Service (ms-drs) for persistence. This activity can be indicative of an adversary attempting to maintain access or bypass conditional access policies by registering a new device.
Detects the creation or modification of an inbox rule in Microsoft 365 where the rule's name consists entirely of special characters. This behavior can be indicative of an adversary attempting to evade detection by obscuring malicious inbox rules.
Detects Tycoon 2FA operator recon assessing mailbox forwarding rules, auto-replies, and timezones. This KQL query identifies actions related to 'mailboxSettings' within 'Microsoft Graph' events, which can indicate an adversary enumerating user mailbox configurations.
Detects when a guest user (identified by '#EXT#' in their UPN) is assigned a sensitive role like 'Agent ID Administrator' or 'AgentAdministrator' in Entra ID. It also detects when any user, including guest users, performs modifications related to 'Agent' blueprints. This rule aims to identify potential privilege escalation or unauthorized administrative actions by external users within an Azure Active Directory environment.
Detects attempts to invoke 'sudo' for privilege escalation or enumeration from non-interactive contexts such as scripts, scripting language interpreters, or web/application service processes. It also identifies 'sudo -l' or '--list' commands used for privilege enumeration.
Detects an administrative forwarding, redirect, BCC, or content compliance rule change when Defender for Cloud Apps identifies attributes that are uncommon for the account. UNC6508 replayed harvested credentials to access an administrator account before creating its covert exfiltration rule. The anomaly requirement increases confidence while preserving coverage for infrastructure that is not recognised as a proxy.
Detects bursts of Microsoft Graph API calls hitting multiple distinct reconnaissance endpoints within a 60-second window. This behavior can indicate an adversary performing rapid enumeration or discovery within a Microsoft 365 environment.
Detects attempts to add credentials or secrets to a service principal to establish persistence independent of user accounts. This rule specifically looks for 'Add service principal credentials' or 'Update application - Certificates and secrets management' operations in Azure AuditLogs.
Detects deployment of the VMAccess extension via Azure Management plane, which can be abused by attackers to create local backdoor administrators on Azure Virtual Machines.
Detects Graph API queries targeting getResourceTenants, identifying lateral movement preparation. This activity can be indicative of an adversary attempting to enumerate tenant relationships within Microsoft Graph to understand the environment and potentially identify targets for further compromise or lateral movement.
Detects anomalous access to Privileged Access Management (PAM) platforms (e.g., CyberArk, BeyondTrust, Delinea, HashiCorp Vault, Thycotic, ARCON PAM). The rule identifies successful sign-ins occurring outside typical business hours (7 AM to 7 PM) that also exhibit either a high volume of sign-ins (more than 5 per hour per user/app) or access from multiple new IP addresses (more than 2 unique IPs per hour per user/app). This behavior is indicative of potential abuse of privileged accounts, possibly by threat actors like Silk Typhoon (HAFNIUM).
Detects bulk Azure AD group membership enumeration via Graph API
Detects an unusually high volume of successful operations related to Azure App Services originating from a single caller within a one-hour window. This could indicate automated activity, reconnaissance, or a misconfigured application.
This rule detects attempts by user-mode utilities to interact with the loaded EnCase driver via DeviceIoControl, specifically targeting paths containing 'EEDbg' or 'EnCase'. This activity is indicative of a Bring Your Own Vulnerable Driver (BYOVD) attack, where an EDR killer utility leverages a legitimate driver's functionality to execute arbitrary ring-0 commands, potentially bypassing security controls.
Page 80 of 144