Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,832 detections
Filters
Last updated
All Time
Detection languages
1,375
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,443
11,831
5,875
5,151
4,864
2,832
Platforms
1,449
916
693
670
264
Products / Services
994
701
613
469
216
MITRE Techniques
1,240
912
484
482
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects a privilege escalation sequence where a principal uses 'PassRole' to attach an IAM role to a newly created compute resource (Lambda, EC2, or CloudFormation stack), followed shortly by that compute resource performing privileged API calls. This behavior indicates a potential attempt to gain unauthorized elevated permissions by executing actions from an over-privileged service identity.
Detects the creation of GCP compute instances that are attached to service accounts with broad 'cloud-platform' scope permissions. This activity is monitored to ensure that only authorized automation service accounts (e.g., IaC pipelines) are performing these actions, as creating instances with highly privileged service accounts can be a technique used to escalate privileges or establish persistence.
Detects modifications to application secrets or certificates in Azure that are performed by a user who is not the registered owner of the application, or when a new credential is added to an application that already has credentials configured, potentially indicating persistent access establishment.
Detects modifications to Google Cloud Storage bucket IAM policies that grant access to 'allUsers' or 'allAuthenticatedUsers'. This activity indicates a potential misconfiguration or an attempt by an attacker to stage or exfiltrate data by making bucket contents publicly accessible.
Detects the modification of an Azure Storage account configuration to enable public access (allowBlobPublicAccess: true). This activity is often associated with attackers attempting to facilitate anonymous data exfiltration by enabling public access to blobs and subsequently reading them.
Detects the creation of new AWS IAM access keys where the actor initiating the request is distinct from the target user associated with the key. This behavior often indicates an adversary attempting to establish persistent access to a compromised account by creating additional, long-lived credentials.
Detects suspicious modifications to AWS Organization structure, specifically the moving of accounts out of protected organizational units (e.g., security, quarantine, guardrail), accounts leaving the organization, or the detachment of policies, which may indicate an attempt to evade security controls or organizational guardrails.
This rule detects the creation of new, potentially long-lived service account keys for GCP service accounts that possess highly privileged roles, such as Project Owner, Project Editor, or broad custom roles. The creation of such keys for privileged accounts can be a technique used by adversaries to establish persistent, stealthy access within a GCP environment.
Detects instances where an IAM user or role attempts to assume a role in a different AWS account (Cross-Account) without providing a valid ExternalID. This often indicates unauthorized attempts to access or abuse cross-account trust relationships, which is a common technique for lateral movement or privilege escalation in cloud environments.
Detects mailbox permission changes (FullAccess, SendAs) or abnormally high volume of mailbox item access events occurring shortly after a risky, non-interactive, or unusual location sign-in. This pattern indicates a potential follow-on activity from a successful session hijacking or token theft attack.
Detects mailbox permission changes (FullAccess, SendAs) or abnormally high volume of mailbox item access events occurring shortly after a risky, non-interactive, or unusual location sign-in. This pattern indicates a potential follow-on activity from a successful session hijacking or token theft attack.
Detects a user account adding a new client secret or certificate to an Azure AD application/service principal, followed by a sign-in event from that same service principal originating from an IP address not observed in the prior 14 days. This behavior is indicative of potential persistent access creation by an adversary using newly generated credentials.
This rule correlates a risky or compromised sign-in event in Entra ID (Azure AD) with a subsequent OAuth consent grant by the same user within 60 minutes. It specifically looks for grants that request sensitive permissions such as Mail.Read, Mail.ReadWrite, Files.ReadWrite.All, or offline_access, which are commonly associated with consent phishing and persistence tactics.
Detects non-interactive sign-in events (including refresh-token or PRT-based authentication) where the originating device is not managed by Intune/Jamf, not marked as compliant, and lacks a registered trust type. This behavior is indicative of potential stolen session token replay or unauthorized access using intercepted artifacts.
Detects instances where a risky Azure AD sign-in (e.g., token replay or confirmed compromise) is closely followed (within 24 hours) by sensitive application or service principal credential modifications by the same user account. This behavior is indicative of potential persistence establishment via account manipulation.
Detects Microsoft Entra ID (formerly Azure AD) PIM or Just-In-Time role activations that occur without a proper approval workflow, are self-approved, or coincide with identified risky sign-in signals.
Detects non-interactive sign-in events (including refresh-token or PRT-based authentication) where the originating device is not managed by Intune/Jamf, not marked as compliant, and lacks a registered trust type. This behavior is indicative of potential stolen session token replay or unauthorized access using intercepted artifacts.
Detects anomalous authentication behavior where a single session identifier is used to access three or more distinct SaaS applications within a one-hour window. This behavior often indicates the unauthorized use of a stolen session cookie or OAuth token (Pass-the-Cookie) across multiple SSO-integrated platforms.
Detects instances where a risky Azure AD sign-in (e.g., token replay or confirmed compromise) is closely followed (within 24 hours) by sensitive application or service principal credential modifications by the same user account. This behavior is indicative of potential persistence establishment via account manipulation.
Detects Microsoft Entra ID (formerly Azure AD) PIM or Just-In-Time role activations that occur without a proper approval workflow, are self-approved, or coincide with identified risky sign-in signals.
This rule detects potentially compromised accounts by correlating suspicious authentication activity (such as risky sign-ins, impossible travel, or malicious OAuth/Mail-rule configurations) with a subsequent spike in SharePoint or OneDrive file access, downloads, or external link sharing within a one-hour window. This behavior is indicative of an adversary performing cloud-based data exfiltration after gaining unauthorized access to an account.
Page 25 of 135