Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
302 detections
Filters
Last updated
All Time
Detection languages
166
46
36
22
20
Contributors
117
49
34
24
9
Categories
222
188
118
59
49
Platforms
201
75
70
46
19
Products / Services
129
121
49
46
27
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
CVEs
5
1
IDS Classtypes
2
IDS Protocols
2
Detects the creation of a new application secret or credential in a cloud environment followed by an immediate authentication attempt using that credential from an IP address that has not been observed performing successful authentication within the specified lookback window. This behavior is indicative of potential unauthorized persistence or the use of compromised credentials by an adversary.
This rule detects when a new password credential (client secret) is added to an existing Azure AD Service Principal or application. This activity is a common method for adversaries to establish persistence in a cloud environment that survives password resets or MFA enforcement on the original administrative account.
Detects the creation of application-specific passwords named 'ZimbraWeb' in Zimbra environments. This pattern is associated with potential persistence mechanisms or credential access attempts where an adversary creates a dedicated service or app password to maintain access, as identified in CVE-2025-66376.
Detects Azure AD / M365 audit log events associated with OAuth2 permission grants or application consent
where a high-privilege delegated scope (e.g. Mail.Read, Mail.ReadWrite, Directory.ReadWrite.All, offline_access)
is granted to an application. This technique has been publicly attributed to APT29 (Cozy Bear / Midnight Blizzard)
for maintaining persistent access to M365 mailboxes and directory data via malicious or unverified OAuth
applications, consistent with MITRE ATT&CK T1098.001 (Additional Cloud Credentials) and T1550.001 (Use Alternate
Authentication Material: Application Access Token).
where a high-privilege delegated scope (e.g. Mail.Read, Mail.ReadWrite, Directory.ReadWrite.All, offline_access)
is granted to an application. This technique has been publicly attributed to APT29 (Cozy Bear / Midnight Blizzard)
for maintaining persistent access to M365 mailboxes and directory data via malicious or unverified OAuth
applications, consistent with MITRE ATT&CK T1098.001 (Additional Cloud Credentials) and T1550.001 (Use Alternate
Authentication Material: Application Access Token).
Detects administrative IAM operations such as user, role, or access key creation performed by an identity containing 'agent' in its ARN or username. This behavior is intended to flag unauthorized privilege escalation or persistence mechanisms initiated by automated service identities that should not be modifying IAM configurations.
This rule detects when new credentials (secrets or certificates) are added to an Azure Active Directory Service Principal. It flags this activity as suspicious if it occurs outside of typical business hours or if it exhibits signs of 'rapid re-keying', where multiple credentials are added to the same service principal within a 24-hour window. This behavior is a common indicator of persistence maintenance or credential rotation to support unauthorized access.
Detects OAuth2 permission consent events where a user grants a third-party or newly registered application access to high-risk scopes (such as Mail, Files, or Directory). This technique is commonly used to establish persistence and bypass MFA by gaining access to user accounts via malicious or compromised OAuth applications.
This rule detects scenarios where a user account grants high-privilege permissions (e.g., mail access or file modification) to an OAuth application within a short time frame (2 hours) following a sign-in event flagged as risky by Entra ID (Azure AD). This pattern is indicative of an adversary abusing OAuth consent flows as a persistence and credential-access mechanism following account compromise.
Detects AWS CloudTrail events where an actor performs identity or session token manipulation, specifically through the use of sts:GetFederationToken or sts:AssumeRole, or by modifying MFA configurations such as DeactivateMFADevice or CreateVirtualMFADevice on privileged accounts. This activity may indicate an attempt to gain persistent access, bypass security controls, or masquerade as a legitimate principal.
Detects the addition of a new client secret or certificate to an application or service principal by a user account. This activity is correlated with recent high-risk or suspicious sign-in events. Adversaries often perform this action following account takeover to establish durable, MFA-immune persistence in the cloud tenant.
This rule monitors for the addition of new credentials (secrets) to service principals or applications in an Azure/Entra ID environment. It then correlates this event with subsequent mailbox activity (such as accessing mail items, sending mail, or message binding) performed by the application within 7 days of the credential creation. This detection pattern is indicative of potential OAuth application-based persistence and mailbox data exfiltration.
Detects potential help-desk impersonation or social engineering activity involving account credential or MFA method resets, followed shortly by a sign-in from an unknown device or geography. The rule excludes activity tied to established ticketing systems or standard automated password expiration processes.
Detects modifications to Microsoft Entra ID applications or service principals involving the addition or configuration of 'externalauthprovider' redirect URIs or properties. This behavior is indicative of an attacker attempting to establish a malicious federated identity or persistence mechanism by manipulating application configuration to use an adversary-controlled authentication provider.
Detects the addition of service principal credentials by a user who is not explicitly listed as an owner of the application. This activity is monitored to identify potential persistence or privilege escalation attempts where an unauthorized account adds its own authentication method to an existing cloud application or service principal.
This rule detects when a non-privileged user adds a new owner to an Azure AD Application or Service Principal, followed by a suspicious modification (such as adding credentials or permissions) to that same application within 30 minutes. This behavior is indicative of an adversary attempting to gain persistent, elevated access to an application's service principal to manipulate its configuration or permissions.
This rule detects when a non-privileged user adds a new owner to an Azure AD Application or Service Principal, followed by a suspicious modification (such as adding credentials or permissions) to that same application within 30 minutes. This behavior is indicative of an adversary attempting to gain persistent, elevated access to an application's service principal to manipulate its configuration or permissions.
Detects the addition of new service principal credentials (passwords or certificates) to Azure AD applications occurring outside of typical business hours. This behavior may indicate an attacker attempting to establish persistence or maintain unauthorized access to cloud resources through an existing application identity.
Detects the creation of new programmatic credentials (AWS access keys, Azure AD service principal credentials, or GCP service account keys) where the identity creating the credential differs from the identity for which the credential is being issued. This behavior is often indicative of persistence mechanisms or credential abuse where an attacker with sufficient permissions creates secondary credentials for other accounts.
This rule detects scenarios where a new credential (password or key) is added to a service principal or application, followed by an authentication event using that service principal within a short window (1 hour). This pattern is indicative of potential credential injection or persistence attempts, where an attacker adds a secret and immediately leverages it to establish access.
This rule detects scenarios where a new credential (password or key) is added to a service principal or application, followed by an authentication event using that service principal within a short window (1 hour). This pattern is indicative of potential credential injection or persistence attempts, where an attacker adds a secret and immediately leverages it to establish access.
Detects the addition of certificate-type credentials (AsymmetricX509Cert, usage=Verify) to Microsoft Entra ID (Azure AD) applications or service principals. This behavior is indicative of an attacker adding an adversary-controlled certificate to impersonate an application or service principal to achieve persistent, long-lived access.
Page 2 of 15