Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
839 detections
Filters
Last updated
All Time
Detection languages
438
190
77
62
40
Contributors
120
114
72
71
68
Categories
464
233
193
152
122
Platforms
288
274
154
88
56
Products / Services
220
169
162
90
76
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
839
CVEs
6
5
5
5
5
IDS Classtypes
4
2
IDS Protocols
1
Detects a sequence of events where an AWS IAM Policy is modified or created and then immediately attached to a principal (user, role, or group) within a short time window (10 minutes). This behavior is highly suspicious and often indicates a rapid privilege escalation attempt or a lateral movement step where an attacker grants themselves new permissions for immediate use.
Detects the addition of an SSH public key to a GitHub account using programmatic access (Personal Access Tokens, OAuth, or GitHub Apps). Unlike keys added via the Web UI, programmatic creation often bypasses manual verification steps and provides long-lived access that survives password resets and MFA changes. This is a common technique for attackers to establish persistent command line access to repositories.
Detects the creation of a new Personal Access Token (PAT) in GitHub. Attackers frequently create PATs after gaining initial access to an account to maintain persistence that survives a password reset. Tokens with broad scopes (repo, admin:org) allow for full repository exfiltration and administrative manipulation of the organization.
This rule detects modifications to properties of 'break glass' accounts. It joins a watchlist of identity categories containing 'Break Glass' accounts with Azure Audit Logs to identify specific operations performed on these accounts. The rule focuses on changes to user principal names, operation names, activity display names, results, and AAD operation types.
This rule detects sign-in attempts by 'Break Glass' accounts. Break Glass accounts are emergency access accounts typically used in situations where normal administrative access methods are unavailable. Monitoring their usage is critical due to the high privileges usually associated with these accounts. The rule joins sign-in logs with a watchlist of identities to specifically identify activity related to these designated accounts.
This rule detects when a guest user from a common public email domain (e.g., gmail.com, outlook.com) is invited to an Azure Active Directory (AAD) tenant and subsequently added to an AAD security group. This could indicate an attempt to grant unauthorized access to an external account or a misconfiguration allowing guest users to be added to sensitive groups.
Detects local accounts being added to the Administrators group using net.exe, net1.exe, or cmd.exe.
Detects activity where there are role bindings and high-risk actions (verbs) applied.
This could be indicative of Privilege Escalation.
This could be indicative of Privilege Escalation.
Detects the use of the 'net' command to create a new domain user and immediately add that user to a high-privilege domain group (e.g., Enterprise Admins, Domain Admins) within a short time window. This TTP was observed in campaigns following the exploitation of BeyondTrust (CVE-2026-1731) to establish persistent, privileged access.
Detects events that may indicate a user is being enrolled into a Bitwarden organization's account recovery policy under malicious circumstances. As described by researchers, a malicious or compromised server can silently add a user to an attacker-controlled organization and enable an account recovery policy. The victim's client will then encrypt the user's vault key with an attacker-provided public key and upload it, leading to a full vault compromise.
This rule detects when a member is added to or removed from highly sensitive administrative groups within Active Directory. It specifically monitors Windows Security Event IDs 4728 (member added) and 4729 (member removed) for a predefined list of critical groups such as 'Administrators', 'Domain Admins', 'Enterprise Admins', and 'Schema Admins'. The rule excludes changes made by computer accounts to reduce false positives.
This alert identifies a potential bypass of repository governance controls. It triggers when a GitHub repository's default branch is changed and then reverted or updated again within a 24-hour window. By temporarily changing the default branch to an unprotected branch, an actor can push code or merge pull requests to the primary branch (e.g., main) without satisfying mandatory status checks or peer review requirements.
This rule detects a multi-stage attack chain starting with a high-confidence phishing email, followed by a risky sign-in from the recipient, and culminating in sensitive actions within Azure, specifically targeting IAM role assignments, storage account key access, or AKS cluster modifications. The detection correlates these events within a defined time window to identify potential compromise of cloud resources originating from a successful phishing attack.
This rule detects the creation of a local administrative account on a FortiGate device with a generic name commonly used by threat actors for persistence following an initial compromise. The rule specifically looks for log events indicating the addition of a new system administrator account with names like 'secadmin', 'itadmin', 'support', 'backup', 'remoteadmin', or 'audit'.
Detects HTTP POST requests to the Appsmith password reset endpoint where the 'Origin' header does not match the expected internal or legitimate application domain. This is indicative of an attempt to exploit CVE-2026-22794 to achieve account takeover.
This rule detects when a certificate is issued to a privileged user. It identifies privileged users by checking their group membership against a predefined list of administrative groups such as 'Domain Admins', 'Enterprise Admins', and 'Administrators'. The rule then looks for Windows Security Event ID 4886, which indicates a certificate services operation, and extracts the principal name from the Subject Alternative Name field. Finally, it joins this information with the identified privileged users to flag any certificate issuance to them.
This detection correlates suspicious device code authentication behaviour in Azure AD with a successful creation of a Windows Hello for Business (WHfB) credential within the same 24 hours.
Microsoft allows specific application and resource combinations (permitted by CA) access without a previously registered device. Even more, one of these combinations allows the registration of a device.
An access token issued for the Microsoft Authentication Broker application and the Intune Enrollment resource can be used to authenticate and initiate the device join process.
Therefore, an attacker can leverage the token to bypass CA, register device, and establish persistence. Once registered, attacker gets a Primary Refresh Token (PRT), valid for 90 days.
Attackers often push further to configure WHfB (Windows Hello For Business) on the registered device. WHfB issues TPM-backed, cryptographic credentials that Entra recognizes as a strong, phishing-resistant, passwordless authentication method.
Device registration unlocks persistence, but WHfB unlocks the ability to bypass stricter authentication-strength requirements.
Analysts: Check for IP mismatches, since in the Device Code authentication event we will see the victims IP, the WHfB registration event will contain the attackers IP.
Microsoft allows specific application and resource combinations (permitted by CA) access without a previously registered device. Even more, one of these combinations allows the registration of a device.
An access token issued for the Microsoft Authentication Broker application and the Intune Enrollment resource can be used to authenticate and initiate the device join process.
Therefore, an attacker can leverage the token to bypass CA, register device, and establish persistence. Once registered, attacker gets a Primary Refresh Token (PRT), valid for 90 days.
Attackers often push further to configure WHfB (Windows Hello For Business) on the registered device. WHfB issues TPM-backed, cryptographic credentials that Entra recognizes as a strong, phishing-resistant, passwordless authentication method.
Device registration unlocks persistence, but WHfB unlocks the ability to bypass stricter authentication-strength requirements.
Analysts: Check for IP mismatches, since in the Device Code authentication event we will see the victims IP, the WHfB registration event will contain the attackers IP.
Detects the creation of a new administrative account with 'prof_admin' privileges on a FortiWeb device from an unknown IP address. This activity is highly suspicious if not performed by a known administrator and could indicate post-exploitation activity, potentially related to CVE-2025-64446.
Detects the creation of a new domain user account that is immediately added to a high-privilege group, such as Domain Admins. This pattern is a strong indicator of persistence and privilege escalation, as observed in the Lynx Ransomware campaign.
Microsoft Entra ID Protection can provide a broad range of risk detections that can be used to identify suspicious activity in your organization.
This KQL detection rule identifies and prioritizes high-fidelity user risk events in Azure AD. It focuses on high-fidelity risk event types, filtering out known, noisy, or low-fidelity events to ensure alerts are accurate, actionable, and reliable.
This KQL detection rule identifies and prioritizes high-fidelity user risk events in Azure AD. It focuses on high-fidelity risk event types, filtering out known, noisy, or low-fidelity events to ensure alerts are accurate, actionable, and reliable.
Detects a user account creation event followed by that same account being added to a privileged administrative group within a short timeframe (e.g., 40 minutes). This behavior is a key tactic of threat actors like Muddled Libra (Scattered Spider), who are known to rapidly escalate privileges after gaining initial access. This detection requires a SIEM to correlate the user identity between the creation event and the group addition event.
Page 26 of 40