Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,832 detections
Filters
Last updated
All Time
Detection languages
1,375
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,443
11,831
5,875
5,151
4,864
2,832
Platforms
1,449
916
693
670
264
Products / Services
994
701
613
469
216
MITRE Techniques
1,240
912
484
482
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects potential backdoored persistence in AWS Lambda functions. The rule monitors for two patterns: 1) A Lambda function creation followed by granting cross-account 'lambda:InvokeFunction' permissions to an untrusted or wildcard principal. 2) A privilege escalation event (such as attaching policies) followed by a 'lambda:UpdateFunctionCode' operation on the same function by the same principal, which may indicate an attempt to inject malicious code into a serverless function.
Detects instances where a long-dormant Entra ID (Azure AD) service principal is reactivated shortly after having a new credential added or a new app role assigned. This activity is a potential persistence technique where an attacker repurposes a legitimate, high-privileged, but unused service principal to blend in as legacy automation.
Detects instances where an administrative user grants 'AllPrincipals' OAuth consent to a multi-tenant application that is unverified or lacks a trusted publisher. This behavior is indicative of an attacker tricking a global admin into granting broad permissions (e.g., Mail.Read, Files.ReadWrite.All) to a malicious application, bypassing per-user consent restrictions.
Detects the addition of a new client secret or certificate to an existing Microsoft Entra ID (formerly Azure AD) application or service principal. This behavior is often used by adversaries to establish persistence following the compromise of an existing identity with administrative permissions, allowing continued access even if the original compromised credentials are revoked.
Detects when a user is added as an owner to an Azure AD Application or Service Principal, specifically highlighting instances where the new owner does not currently hold a privileged directory role. This pattern is often used as a persistence mechanism to maintain long-term access to an environment without requiring high-level administrative credentials.
Detects the addition of secrets or certificates to service principals by identities that are not currently registered as owners of those applications, or modifications occurring outside of standard business hours. This behavior is often indicative of an adversary with compromised administrative privileges (e.g., Application Administrator) attempting to establish persistent, lateral access without alerting legitimate application owners.
Detects a potential Business Email Compromise (BEC) persistence chain where a user grants an OAuth application mail-read or mail-write permissions, followed by the creation of a malicious inbox rule designed to forward, move, or delete sensitive email threads. This combination enables persistent exfiltration and stealth, bypassing password resets as the OAuth token remains active.
This rule detects non-interactive sign-in events using AzureAD tokens from unmanaged devices. This pattern is indicative of potential session or refresh token hijacking, where an adversary replays a stolen session token from their own environment. While a single event is not definitive for impossible travel, it serves as a high-confidence seed for identifying compromised sessions when combined with other indicators.
Detects unauthorized or suspicious modifications to Azure Active Directory (Azure AD) Conditional Access Policies. This includes deleting a policy, disabling an enabled policy, narrowing the scope of users or groups targeted by a policy, or removing MFA requirements from existing policies.
Detects instances where a user grants consent to an Azure AD application with highly sensitive permissions (such as ReadWrite access to Directory, Roles, or Applications). This pattern is commonly used in OAuth consent phishing attacks to maintain persistence or escalate privileges by authorizing a malicious application to act on behalf of the user or the entire directory.
Detects OAuth application consent events in Azure Active Directory where the application is from an unverified publisher, requests high-risk scopes (specifically offline_access plus at least two others like Mail, Files, Contacts, or Directory), and potentially indicates a mass-campaign if multiple users consent to the same application.
Detects the reactivation of a Microsoft Entra ID (Azure AD) service principal that has been inactive for 90 or more days, specifically flagging those that perform privileged Graph API operations after their return. This rule helps identify potentially compromised or stale service principals being leveraged by adversaries for persistent access.
This rule monitors Office 365 management logs for device registration or join events in Azure Active Directory where the resulting device state is flagged as both non-compliant and unmanaged, despite having a 'Workplace' or 'AzureAd' trust type. It further aggregates these events by user to identify potential suspicious patterns, such as bulk registrations or rapid activity within a 30-minute window, which may indicate account compromise or unauthorized device enrollment.
Detects the reactivation of a Microsoft Entra ID (Azure AD) service principal that has been inactive for 90 or more days, specifically flagging those that perform privileged Graph API operations after their return. This rule helps identify potentially compromised or stale service principals being leveraged by adversaries for persistent access.
Detects modifications to an Azure Active Directory application where a new Redirect URI is added, particularly when the URI points to localhost, a raw IP address, or a non-corporate domain. The rule additionally correlates this change with recent OAuth grant activities to identify potential adversary attempts to hijack tokens or maintain persistent access via malicious application configurations.
Detects instances where a user grants an OAuth application consent to high-risk scopes (such as mail reading, file access, or directory reading) without administrator oversight. This behavior is a common indicator of OAuth abuse where an attacker lures a user into granting excessive permissions to a malicious application, providing the attacker persistent access to the user's data.
Detects the addition of new credentials (secrets or certificates) to an existing service principal or application within a cloud environment. This behavior is often associated with persistence or privilege escalation tactics in cloud identity platforms. The rule flags activity from potentially non-automated accounts and can correlate with recent administrative role assignments.
Detects when a new owner is added to an Azure/Entra ID enterprise application or service principal. This activity is a common persistence technique used by adversaries to gain long-term, high-privilege access, such as modifying application credentials or API permissions, without requiring directory administrator roles.
Detects OAuth application consent grants where the application requests both 'offline_access' (enabling refresh tokens for long-term access) and sensitive mailbox permission scopes (such as Mail.Read, Mail.ReadWrite, Mail.Send, or IMAP.AccessAsUser.All). This combination is indicative of consent phishing attacks designed to establish persistent, silent access to user email accounts, bypassing password resets and multi-factor authentication.
This rule detects the granting of sensitive, high-privilege Microsoft Graph API delegated or application permissions to an application or service principal in an Entra ID environment. Such permissions, including directory and user management or full application access, are frequently used by adversaries for persistence and privilege escalation within cloud environments.
Detects mass-phishing consent campaigns by monitoring non-admin users consenting to multi-tenant or unverified-publisher applications requesting non-basic-profile OAuth scopes. The rule aggregates multiple consent events for the same application over a 1-hour window to identify potentially malicious consent-phishing activity.
Page 22 of 135