Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,004 detections
Filters
Last updated
All Time
Detection languages
1,442
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,443
11,831
5,875
5,151
4,864
3,004
Platforms
1,199
673
623
512
218
Products / Services
880
726
311
257
229
MITRE Techniques
1,661
1,109
905
468
464
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
Detects the creation of GCP compute instances that are attached to service accounts with broad 'cloud-platform' scope permissions. This activity is monitored to ensure that only authorized automation service accounts (e.g., IaC pipelines) are performing these actions, as creating instances with highly privileged service accounts can be a technique used to escalate privileges or establish persistence.
Detects the modification of an Azure Storage account configuration to enable public access (allowBlobPublicAccess: true). This activity is often associated with attackers attempting to facilitate anonymous data exfiltration by enabling public access to blobs and subsequently reading them.
Detects the creation or modification of inbox rules in Microsoft 365 Exchange environments that perform suspicious actions such as forwarding, redirecting, moving, or deleting emails. This rule specifically monitors for rule configurations that target potentially sensitive keywords, indicating a likely attempt to exfiltrate data, hide security alerts, or intercept communications.
Detects MFA or security information registration, updates, or deletions within Entra ID AuditLogs that occur within two hours of a sign-in event flagged as risky, impossible travel, or involving a new device. This sequence is a common indicator of post-compromise identity persistence.
Detects mass device management actions (e.g., remote wipe, retire, or delete) performed via the Microsoft Intune console by a user who has simultaneously exhibited risky sign-in behavior, potentially indicating a compromised administrative account.
Detects the creation or modification of Exchange Online inbox rules that configure automatic email forwarding or redirection to an external domain. The rule specifically flags if the action also involves deleting or hiding the message, which is a common persistence and exfiltration technique used in Business Email Compromise (BEC) attacks. The detection also incorporates correlation with recent high-risk sign-in activity for the associated user account.
Detects potential Pass-the-Hash (PtH) activity by monitoring for NTLM network logons (Logon Type 3) that are associated with a blank WorkstationName, often indicating spoofing. This pattern is correlated with the assignment of special privileges (EventID 4672) to capture scenarios where stolen NTLM hashes are replayed for lateral movement into a system.
Detects configuration changes to AAA/TACACS+ settings or the creation of local administrative accounts on network devices executed over SSH or Telnet sessions. This behavior is associated with malicious activity by groups such as Salt Typhoon, involving the compromise of telecommunications infrastructure.
Detects unauthorized attempts to delete or purge critical Salesforce audit logs, including the Setup Audit Trail, Login History, and Event Monitoring log files. This behavior is indicative of anti-forensic activity, often utilized by threat actors such as ShinyHunters to destroy audit evidence following unauthorized access, data export, or credential manipulation.
Detects administrative IAM operations such as user, role, or access key creation performed by an identity containing 'agent' in its ARN or username. This behavior is intended to flag unauthorized privilege escalation or persistence mechanisms initiated by automated service identities that should not be modifying IAM configurations.
This rule identifies potential prompt injection attempts against Microsoft Copilot and Azure OpenAI services by monitoring CloudAppEvents for specific adversarial markers, encoded instruction blocks, or hidden text patterns. It flags recurring attempts from a single user as suspicious probing activity.
Detects instances where a user account consents to an OAuth application requesting high-privilege or sensitive scopes such as Mail.Read, Files.ReadWrite.All, or offline_access. This behavior is a common indicator of consent phishing attacks, where adversaries trick users into granting persistent access to their cloud resources via malicious OAuth applications.
Detects high-risk administrative activity on VMware ESXi or vCenter servers that is consistent with pre-ransomware staging, such as disabling lockdown mode, disabling syslog forwarding, mass deletion or modification of virtual machine files (.vmdk/.vmx), or shell command execution related to encryption tool staging.
Detects anomalous or potentially malicious LDAP queries on Domain Controllers, utilizing Event ID 1644 to monitor query filters. The rule identifies patterns commonly associated with reconnaissance and enumeration activities, including Kerberoasting (SPN enumeration), AS-REP roasting, delegation abuse, Active Directory Certificate Services (AD CS) enumeration, BloodHound collection, and bulk user, group, or computer discovery.
Detects an abnormally high volume of configuration changes (15 or more within a 10-minute window) occurring on network appliances such as firewalls or security gateways, originated by a single source user or IP address. This behavior may indicate unauthorized administrative activity, mass policy updates, or malicious tampering.
Detects the creation, update, or activation of an external Identity Provider (IdP) or federated trust configuration within the Okta environment. This activity may indicate an attempt to establish a rogue federation trust, which allows an adversary to perform cross-tenant impersonation and authenticate as any user by minting assertions signed by attacker-controlled keys.
Detects the creation of a new Entra ID application followed closely by high-privilege permission grants or consent. This is a common technique used by attackers to establish persistent access to cloud resources, such as mailboxes or sensitive data, via OAuth application backdoors.
Detects the granting of elevated mailbox permissions (FullAccess, SendAs, SendOnBehalf, or broad folder access) by an OAuth application or service principal. This behavior is indicative of a compromise where an actor uses an App-only context to establish persistence and stage internal spearphishing, bypassing standard administrative monitoring controls.
This rule detects when an OAuth application is granted sensitive Exchange Online permissions, such as 'full_access_as_app', 'Mail.Read', 'Mail.ReadWrite', or 'Mail.Send'. Granting these permissions allows an application to access mailboxes across the tenant without requiring a signed-in user context, which is a common persistence and data exfiltration technique used in Business Email Compromise (BEC) and espionage campaigns.
Detects modifications to Microsoft Entra ID (formerly Azure AD) cross-tenant access settings where a new partner is added or inbound trust settings (such as MFA or device compliance) are enabled for an external tenant. This activity may indicate an attempt to establish a persistent backdoor or facilitate initial access into the environment via a compromised or malicious external identity provider.
Detects the creation or modification of Granular Delegated Administrative Privileges (GDAP) relationships, or the assignment of highly privileged (Tier 0) roles, when performed by an application identified as a partner provider or via delegated administration. This rule monitors for potential abuse of trusted partner relationships to escalate privileges or establish persistence within a tenant.
Page 9 of 144