Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,004 detections
Filters
Last updated
All Time
Detection languages
1,442
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,456
11,839
5,876
5,155
4,865
3,004
Platforms
1,199
673
623
512
218
Products / Services
880
726
311
257
229
MITRE Techniques
1,661
1,109
905
468
464
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
This rule detects multiple unauthorized access attempts (5 or more within an hour) to sensitive Active Directory objects such as 'Admin', 'krbtgt', or 'Domain Admins'. It leverages Windows Security Event ID 4662, which indicates an operation was performed on an object, and filters for specific sensitive object names. The rule then groups these attempts by object, IP address, and user, alerting when a threshold of attempts is met.
This rule detects an unusually high volume of file sharing events from a single user in OneDrive within a one-hour window. Specifically, it looks for five or more 'SharingSet' or 'AnonymousLinkCreated' operations by the same UserId within an hour, which could indicate data exfiltration or unauthorized sharing.
This rule detects an unusually high volume of SharePoint sharing invitation creations or sharing setting modifications by a single user within an hour. This could indicate an attacker attempting to exfiltrate data or broadly share sensitive information.
This rule detects when a Key Vault item is deleted in Azure. Monitoring deletions of sensitive items like those in Key Vaults is crucial for detecting potential data exfiltration, sabotage, or unauthorized access attempts by adversaries.
This rule detects when an OAuth application is granted tenant-wide administrative permissions within a Microsoft 365 environment. It specifically looks for HTTP POST requests to 'graph.microsoft.com' with the URI containing 'oauth2PermissionGrants'. This activity is indicative of a malicious OAuth app attempting to gain broad access to an organization's data and resources, often as a persistence mechanism.
Detects when a Network Security Group (NSG) rule is successfully deleted in Azure. This could indicate an attempt to bypass network access controls, potentially to enable unauthorized access or exfiltration.
This rule detects attempts to disable AWS CloudTrail logging via the AWS API. It specifically looks for HTTP requests to 'cloudtrail.amazonaws.com' with 'StopLogging' in the URI, indicating an attempt to stop CloudTrail from recording API activity.
This rule detects an unusually high volume (10 or more within an hour) of successful access control or role-related operations initiated by a single caller in Azure Activity logs. Such activity could indicate an adversary attempting to enumerate permissions, escalate privileges, or modify access to resources within an Azure environment.
This rule detects when a single caller performs five or more successful 'Create or Update Network Security Group' operations within a one-hour window in Azure Activity logs. This could indicate an attacker attempting to modify network access controls to facilitate lateral movement, C2, or data exfiltration, or a misconfigured automated process.
This rule detects an unusually high volume of file sharing events from a single user in OneDrive within a one-hour window. Specifically, it looks for five or more 'SharingSet' or 'AnonymousLinkCreated' operations by the same UserId within an hour, which could indicate data exfiltration or unauthorized sharing.
Detects high volume Google Cloud Storage (GCS) object listing and downloads, which can indicate reconnaissance of cloud storage contents or data exfiltration. The rule aggregates operations by identity, bucket, and project ID over a one-hour period and flags activity exceeding 50 total operations.
Slack Canvas External Access & Tampering
Cortex XDR
Detects external users accessing internal Slack canvases and suspicious canvas deletion or access level changes. Canvases can contain sensitive runbooks, credentials, and organizational data, making these actions critical to monitor for potential data exfiltration or unauthorized access.
This rule detects when a user successfully grants five or more OAuth2 permissions within a five-minute window, specifically looking for sensitive scopes such as 'Mail.Read', 'Calendar.Read', 'User.Read.All', or 'Directory.Read.All'. This behavior can indicate an adversary attempting to gain broad access to an organization's data through a compromised application or user account.
This rule detects multiple access attempts to administrative SMB shares (C$, D$, E$, ADMIN$, IPC$) from a single source IP address within a 5-minute window. This behavior can be indicative of lateral movement, reconnaissance, or ransomware activity attempting to spread across a network by accessing critical shares.
Detects the creation of multiple service principals with administrative or sensitive keywords in their names within a short timeframe, potentially indicating an attempt to establish persistence or escalate privileges in a cloud environment. The rule specifically looks for service principals containing 'admin', 'sync', 'backup', or 'audit' in their display names, created by users outside of Microsoft's internal domains.
Detects the creation of a new Global Administrator or Company Administrator account, which may occur after an attacker compromises an Intune administrator to establish persistence and cement full control over the tenant.
This rule detects the creation of a new service account key within Google Cloud Platform (GCP) via the 'iam.googleapis.com' API. Specifically, it looks for HTTP POST requests to URIs containing 'serviceAccounts' and 'keys'. This activity can be indicative of privilege escalation, where an attacker creates a new key for an existing service account to gain persistent access or elevate their privileges.
This rule detects attempts to access the ESXi Hypervisor Command Line Interface (CLI) via HTTPS. It specifically looks for HTTP requests to the '/sdk' and 'vim25' URIs on port 443, which are indicative of vSphere API or CLI interactions with an ESXi host.
This rule detects when a single user makes multiple changes to security groups within a short timeframe (binned hourly). Specifically, it looks for Event IDs 4752 (A security-enabled global group was changed), 4753 (A security-enabled local group was changed), or 4754 (A security-enabled universal group was changed). This could indicate an attempt to manipulate group memberships for privilege escalation or lateral movement.
This rule identifies suspicious activity within Microsoft Intune by focusing on sensitive operations, broad assignments, and actions performed by API actors (Service Principals) without an associated human User Principal Name (UPN). It specifically looks for operations like creating, adding, assigning, or updating DeviceManagementScripts, DeviceShellScripts, Win32LobApp, DeviceConfiguration, DeviceCompliancePolicy, EndpointSecurity, SecurityBaseline, ConfigurationPolicies, or GroupPolicyConfigurations. The rule also flags broad assignments targeting 'All Devices', 'All Users', 'allDevices', or 'allLicensedUsers'. The primary goal is to detect potential abuse of over-permissioned Graph API applications by attackers to bypass MFA and deploy malicious Mobile Device Management (MDM) commands or configurations.
Detects the creation of a new Global Administrator or Company Administrator account in Microsoft Entra ID (formerly Azure Active Directory). Adversaries may escalate privileges from compromised MDM administration roles (like Intune) to Entra ID Global Admin to cement full control over the tenant.
Page 83 of 144