Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,832 detections
Filters
Last updated
All Time
Detection languages
1,375
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,443
11,831
5,875
5,151
4,864
2,832
Platforms
1,449
916
693
670
264
Products / Services
994
701
613
469
216
MITRE Techniques
1,240
912
484
482
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects a suspicious sequence where a user completes a device-code authentication flow followed shortly by consenting to high-risk OAuth permissions. This pattern is characteristic of consent phishing and device-code phishing attacks, where an attacker leverages these methods to gain persistent access to a user's cloud resources via malicious application tokens.
Detects the creation of a new Entra ID application followed closely by high-privilege permission grants or consent. This is a common technique used by attackers to establish persistent access to cloud resources, such as mailboxes or sensitive data, via OAuth application backdoors.
Detects potential consent phishing attacks by identifying newly registered multi-tenant Azure AD applications that receive OAuth consent from end-users within a short timeframe (10 minutes) of application registration. The rule specifically flags consents requesting high-risk delegated scopes (e.g., Mail.Read, Mail.Send, Files.ReadWrite.All, offline_access) where the application has not been verified by a trusted publisher.
Detects the granting of elevated mailbox permissions (FullAccess, SendAs, SendOnBehalf, or broad folder access) by an OAuth application or service principal. This behavior is indicative of a compromise where an actor uses an App-only context to establish persistence and stage internal spearphishing, bypassing standard administrative monitoring controls.
This rule detects when an OAuth application is granted sensitive Exchange Online permissions, such as 'full_access_as_app', 'Mail.Read', 'Mail.ReadWrite', or 'Mail.Send'. Granting these permissions allows an application to access mailboxes across the tenant without requiring a signed-in user context, which is a common persistence and data exfiltration technique used in Business Email Compromise (BEC) and espionage campaigns.
Detects modifications to Microsoft Entra ID (formerly Azure AD) cross-tenant access settings where a new partner is added or inbound trust settings (such as MFA or device compliance) are enabled for an external tenant. This activity may indicate an attempt to establish a persistent backdoor or facilitate initial access into the environment via a compromised or malicious external identity provider.
Detects the creation or modification of Granular Delegated Administrative Privileges (GDAP) relationships, or the assignment of highly privileged (Tier 0) roles, when performed by an application identified as a partner provider or via delegated administration. This rule monitors for potential abuse of trusted partner relationships to escalate privileges or establish persistence within a tenant.
Detects the creation of high-cost, resource-intensive compute instances (such as GPU-enabled or large-scale VMs) within cloud regions that have not been previously utilized by the account, subscription, or project. This behavior is often indicative of unauthorized resource hijacking, such as crypto-mining or large-scale data processing by threat actors.
Detects the creation or modification of serverless functions (AWS Lambda, Azure Function Apps, GCP Cloud Functions) that exhibit high-risk configurations. These include functions assigned overly permissive IAM roles, configured for public or unauthenticated invocation, or tied to event triggers commonly abused for persistence in cloud environments.
Detects the initialization of an AWS CloudShell environment or session. Attackers often abuse CloudShell as a managed, agentless environment within the provider's infrastructure to stage tools, perform reconnaissance using the AWS CLI, and exfiltrate data while bypassing standard endpoint-based detection.
Detects unauthorized attempts to modify or delete AWS CloudTrail logs stored in S3, or changes to the S3 bucket lifecycle configuration that would shorten the log retention period. This activity is indicative of an adversary attempting to clear their tracks or hinder audit capabilities.
Detects instances where a principal utilizes the iam:PassRole permission to assign a role with higher privileges to a newly created or updated compute resource (Lambda or EC2), potentially allowing the principal to assume the identity and elevated permissions of the passed role.
Detects unauthorized or risky configuration changes in Google Cloud Storage or Azure Storage accounts that grant public access (e.g., allUsers/allAuthenticatedUsers or public blob access) specifically on storage resources identified as production or sensitive (PII/financial data).
Detects instances where an administrative user grants 'AllPrincipals' OAuth consent to a multi-tenant application that is unverified or lacks a trusted publisher. This behavior is indicative of an attacker tricking a global admin into granting broad permissions (e.g., Mail.Read, Files.ReadWrite.All) to a malicious application, bypassing per-user consent restrictions.
Detects the addition of a Service Principal to an Azure AD group that has the 'isAssignableToRole' property set to true. This behavior is a known privilege escalation technique where the service principal inherits the privileged roles assigned to that group, bypassing standard direct role-assignment monitoring.
This rule detects when new credentials (secrets or certificates) are added to an Azure Active Directory Service Principal. It flags this activity as suspicious if it occurs outside of typical business hours or if it exhibits signs of 'rapid re-keying', where multiple credentials are added to the same service principal within a 24-hour window. This behavior is a common indicator of persistence maintenance or credential rotation to support unauthorized access.
This rule detects scenarios where an external user is invited to an Azure AD tenant and subsequently granted a highly privileged role (such as Global Administrator or User Administrator) within a short window of time (1 hour). This pattern is indicative of potential persistence establishment or privilege escalation by an adversary using guest accounts.
Detects modifications to federated domain authentication, identity provider trusts, or federation settings in cloud environments (e.g., Entra ID, Okta). Unauthorized changes to these configurations can be used to establish persistence, enable SAML token forgery, or bypass Multi-Factor Authentication (MFA).
Detects OAuth2 permission consent events where a user grants a third-party or newly registered application access to high-risk scopes (such as Mail, Files, or Directory). This technique is commonly used to establish persistence and bypass MFA by gaining access to user accounts via malicious or compromised OAuth applications.
Detects anomalous sign-in activity for service principals (non-interactive accounts) where the same application authenticates from multiple distinct countries within a 24-hour window. This behavior often indicates the unauthorized use of compromised service principal credentials, such as client secrets or certificates, from distributed attacker-controlled infrastructure.
Detects potential abuse of Azure Cloud Shell backing storage (acsCloudShell) to stage or persist malicious scripts following an Azure AD session compromise. Adversaries may use this storage to blend in with legitimate engineering operations while maintaining persistent access to their tooling.
Page 7 of 135