Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,832 detections
Filters
Last updated
All Time
Detection languages
1,375
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,456
11,839
5,876
5,155
4,865
2,832
Platforms
1,449
916
693
670
264
Products / Services
994
701
613
469
216
MITRE Techniques
1,240
912
484
482
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects a multi-stage attack where an adversary reads local AWS credentials or configuration files (e.g., .aws/credentials, mcp.json) on a developer workstation and subsequently performs unauthorized AWS API calls from the same source IP. The rule correlates initial credential access on the endpoint with a sequence of AWS CloudTrail events starting with identity verification (GetCallerIdentity) followed by enumeration and potentially high-impact API calls (e.g., RunInstances, AssumeRole).
Detects a sequence of events where a developer utility (e.g., npm, git) is executed on an endpoint, followed shortly by suspicious cloud API calls originating from the same source IP address. This pattern potentially indicates credential theft or misuse where keys or configuration files were exfiltrated or abused to authenticate against AWS services.
Detects assignment of high-privileged cloud admin roles for persistence
This rule detects enumeration of directory roles (specifically targeting privileged roles like Global Administrators) in Azure AD/Microsoft Entra ID, correlated with sign-in activity originating from IP addresses outside of defined corporate network ranges. This behavior is indicative of reconnaissance activities by an adversary who has gained initial access via a compromised identity.
Detects the execution of remote commands on cloud virtual machines (Azure RunCommand or AWS SSM SendCommand) during defined off-hours (18:00 to 06:00). This rule identifies potentially unauthorized administrative or management activity occurring outside of standard business hours across cloud environments.
Detects potential exploitation of CVE-2025-0309, where the Intune Company Portal application identifier is used to acquire Microsoft Graph tokens via a password grant mechanism while bypassing Multi-Factor Authentication (MFA). This technique typically relies on exploiting misconfigured Conditional Access policies that exclude the Intune resource from mandatory MFA enforcement.
This rule detects potential automated credential stuffing attempts followed by successful authentication and subsequent access to sensitive/privileged APIs within Azure/Entra ID environments. It correlates multiple failed login attempts for service-oriented account names (e.g., svc, api, bot) with a successful login from the same user shortly thereafter, followed by privileged API operations (e.g., KeyVault secret access, user management) within a short time window.
Detects the export of Microsoft Teams messages, transcripts, recordings, and chat retrieval activities, particularly when performed via the Graph API. This rule identifies suspicious activity by looking for specific operation names in SaaS audit logs and flags potentially malicious user agents commonly associated with automation tools (e.g., python-requests, axios, go-http, curl, wget, powershell, httpx, aiohttp, node). It also categorizes user agents by risk level (HIGH, MEDIUM, NONE) and extracts relevant details like device IDs, IP addresses, and chat information. This activity can indicate post-compromise attackers using stolen tokens to silently export chat history.
This rule identifies potential account compromise by detecting successful logins to at least two different SaaS applications monitored by Microsoft Cloud App Security (MCAS) within a 2-hour window, originating from geolocations separated by more than 500 kilometers. This behavior is indicative of credential sharing or account hijacking where an adversary accesses multiple cloud services rapidly from geographically distant locations.
Detects when a new federated identity credential is successfully added to an Azure Active Directory (Entra ID) application. This activity is a common method for attackers to establish persistent access to cloud resources by bypassing password-based authentication.
This rule detects suspicious activities related to OAuth application consent and service principal operations originating from proxy infrastructure. Specifically, it looks for actions such as adding service principal credentials, granting OAuth2Permission, consenting to applications, adding delegated permission grants, or adding new service principals/applications, where the initiating IP address is identified as belonging to a proxy service. This combination of activities and source IP can indicate an adversary attempting to establish persistence or escalate privileges within an Azure AD environment.
Detects high-risk activity where a user session, characterized by specific suspicious browser user agents and non-interactive authentication (indicative of token replay/session hijacking), is followed by changes to Workday payroll information (direct deposit, banking details) or unauthorized access to HR-related email content.
This rule monitors Microsoft Graph API audit logs for suspicious activity targeting user objects. It specifically detects attempts at bulk enumeration, use of pagination to circumvent limits, or searches using keywords associated with sensitive organizational data (e.g., payroll, finance, hr, admin).
Detects instances where a user successfully authenticates from geographically distant locations within a short timeframe (impossible travel) followed by sensitive privileged operations within a 4-hour window.
This rule detects potential Adversary-in-the-Middle (AiTM) session hijacking by monitoring for successful multi-factor authentication (MFA) events on unmanaged or non-compliant devices, followed within 30 minutes by an API request from a geographically distant location. It includes logic to flag suspicious User-Agent strings often associated with automated AiTM tools.
Detects high-volume Microsoft Graph API and SCIM endpoint enumeration consistent with employee directory scraping, potentially by threat groups like BlackFile/Cordial Spider. This rule identifies suspicious activity based on a high count of directory queries or distinct URIs accessed within a short time frame, originating from non-Microsoft/Google/Amazon/IBM ASNs and using common scripting/API user agents.
Detects suspicious interactions with Google Cloud Pub/Sub APIs occurring shortly after an OAuth2 token request, specifically when the activity is performed by processes other than standard Google Cloud SDK tools (gcloud, gsutil, etc.). This behavior may indicate an attempt to utilize stolen OAuth tokens to exfiltrate or manipulate data within a GCP environment.
Detects automated Microsoft Graph API requests originating from the 'axios/1.7.9' user-agent. This specific user-agent string is associated with the Payroll Pirate campaign, where threat actors (notably Storm-2755 and Storm-2657) employ scripted tools to enumerate directory information, specifically targeting HR and payroll personnel.
This rule detects the creation or modification of inbox rules in Office 365 that involve email forwarding or redirection to external domains. It calculates a risk score based on whether the action occurred outside of typical business hours (08:00-18:00 local time/weekends) and whether the user is performing this action from a previously unseen IP address, which may indicate a compromised account attempting to exfiltrate or redirect emails.
Detects an unusually high frequency of storage blob and container listing operations within a short time window. This behavior often indicates an attempt to enumerate the contents of Azure Blob Storage, which may be a precursor to data discovery or exfiltration.
Detects attempts to exfiltrate data through Microsoft Copilot Enterprise Search by identifying URL clicks containing specific keywords ('extract', 'embed', 'img') in the query parameters. This could indicate an adversary trying to extract sensitive information or embed malicious content.
Page 82 of 135