Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,832 detections
Filters
Last updated
All Time
Detection languages
1,375
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,443
11,831
5,875
5,151
4,864
2,832
Platforms
1,449
916
693
670
264
Products / Services
994
701
613
469
216
MITRE Techniques
1,240
912
484
482
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects the addition of suspicious redirect URIs, such as those containing wildcards, non-HTTPS protocols, or known URL-shortening services, to an OAuth application registration. Such configurations can be exploited by attackers to perform OAuth authorization code or token interception (e.g., through adversary-controlled endpoints).
Detects suspicious modifications to Google Cloud Platform compute instance metadata, specifically the enabling of serial ports or the addition of startup scripts, which can be leveraged to execute arbitrary commands on a virtual machine. This rule also monitors for the initiation of GCP Cloud Shell environments, which may be used as a platform for further administrative activity.
Detects modifications to application secrets or certificates in Azure that are performed by a user who is not the registered owner of the application, or when a new credential is added to an application that already has credentials configured, potentially indicating persistent access establishment.
This rule detects administrative actions in GCP that involve modifying or deleting Cloud Logging sinks, or disabling specific services, with a specific focus on disabling the logging service itself. Adversaries may perform these actions to tamper with audit trails and evade detection of malicious activities.
Detects suspicious modifications to Google Cloud Platform compute instance metadata, specifically the enabling of serial ports or the addition of startup scripts, which can be leveraged to execute arbitrary commands on a virtual machine. This rule also monitors for the initiation of GCP Cloud Shell environments, which may be used as a platform for further administrative activity.
This rule detects modifications to AWS EC2 Snapshot or AMI (Image) attributes that result in the resource becoming publicly accessible ('all') or shared with an unapproved AWS account ID. Such activities are often precursors to data exfiltration or unauthorized access to sensitive disk images.
Detects instances where an IAM user or role attempts to assume a role in a different AWS account (Cross-Account) without providing a valid ExternalID. This often indicates unauthorized attempts to access or abuse cross-account trust relationships, which is a common technique for lateral movement or privilege escalation in cloud environments.
Detects the assignment of high-privilege directory roles (e.g., Global Administrator) to a user account, where the initiator's sign-in session is identified as anomalous. Anomalous indicators include non-interactive sign-in, unknown/untrusted device state, elevated risk score, or activity occurring outside of configured business hours.
Detects the assignment of high-privilege directory roles (e.g., Global Administrator) to a user account, where the initiator's sign-in session is identified as anomalous. Anomalous indicators include non-interactive sign-in, unknown/untrusted device state, elevated risk score, or activity occurring outside of configured business hours.
This rule correlates a risky or compromised sign-in event in Entra ID (Azure AD) with a subsequent OAuth consent grant by the same user within 60 minutes. It specifically looks for grants that request sensitive permissions such as Mail.Read, Mail.ReadWrite, Files.ReadWrite.All, or offline_access, which are commonly associated with consent phishing and persistence tactics.
Detects instances where a user account identified as high or medium risk, or marked as 'at risk' by Azure AD Identity Protection, performs an OAuth application consent action within one hour of the risky sign-in event. This correlation targets potential illicit application consent attacks where a compromised account is used to grant permissions to a malicious application.
Detects instances where a user or administrator grants consent to an OAuth application in Azure AD requesting highly sensitive delegated or application permissions, such as Mail.Read, Mail.ReadWrite, offline_access, or directory-wide read/write scopes. Attackers often use these consents to maintain persistent, silent access to a user's mailbox and cloud resources even after primary session tokens are revoked.
Detects mailbox items being accessed or bound by an OAuth-based application (app-only context) in Microsoft 365, filtering out expected interactive client signatures like Outlook or OWA. This behavior is indicative of potential post-compromise mailbox enumeration or data harvesting by malicious applications using stolen or illicitly granted OAuth access tokens.
Detects modifications to IAM role trust policies (UpdateAssumeRolePolicy) or the creation of new roles (CreateRole) where the Principal is configured with a wildcard or generic open access. This configuration enables any AWS account to assume the role, representing a significant risk for privilege escalation and persistence establishment by attackers.
Detects the mass creation of high-performance compute instances (GPU or high-memory variants) in an AWS environment. By filtering out legitimate service-linked roles associated with auto-scaling, the rule isolates potentially unauthorized manual provisioning, often indicative of cryptojacking or resource hijacking.
Detects unauthorized attempts to stop, delete, modify, or change event selectors for AWS CloudTrail logs. This activity is indicative of an attacker attempting to disable audit logging to evade detection while performing further malicious actions in the environment.
Detects 'CreateAccessKey' API calls in AWS CloudTrail where the principal making the request is different from the target IAM user. This pattern is commonly associated with persistence mechanisms where an attacker creates additional access keys on legitimate administrator accounts to maintain stealthy access.
Detects potential persistence mechanisms in AWS by monitoring the creation of new IAM users or roles, the issuance of long-lived credentials (access keys or login profiles), or the creation of roles with permissive cross-account trust policies. This rule specifically excludes known legitimate automation roles to reduce noise.
Detects the modification of EBS snapshot or AMI attributes to add createVolumePermission or launchPermission, which enables sharing the resource with an external AWS account. This action is a common precursor to cross-account data exfiltration or extortion via snapshot/AMI hijacking.
Detects a suspicious sequence of events where a user performs a device-code authentication flow from a previously unseen application, followed within a two-hour window by sensitive account activities such as OAuth application consent/registration or mailbox-related administrative operations. This behavior is characteristic of passkey-phishing campaigns designed to steal access tokens and achieve persistence or data access via malicious OAuth applications.
This rule detects potentially malicious OAuth application consent grants where a user authorizes an application with high-privilege scopes (such as mail or directory access). The detection flags consent grants for applications that are either unverified by the publisher or newly created within the last 30 days, and correlates these events with suspicious sign-in activity (high/medium risk or failures) for the same user within a two-hour window.
Page 13 of 135