Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
132 detections
Filters
Last updated
All Time
Detection languages
66
28
15
13
5
Contributors
29
22
20
13
12
Categories
96
93
27
19
16
Platforms
74
44
27
26
16
Products / Services
55
42
27
14
9
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
1
IDS Classtypes
2
IDS Protocols
2
Detects high-risk administrative actions in Entra ID, such as role assignments, user creation, or password resets, occurring shortly after a user authenticates using the device code flow. This pattern is indicative of a post-compromise takeover where an adversary utilizes a stolen or coerced device code session to escalate privileges.
Detects unauthorized modifications to the Entra ID authentication methods policy or suspicious application activity often associated with the staging of rogue External Authentication Methods (EAM). Adversaries may exploit these configuration changes to intercept or bypass multi-factor authentication (MFA) during user login processes.
Detects the creation of an application registered with a specific Microsoft external authentication provider URI, immediately followed by the configuration of its service principal with reply URLs pointing to external tunneling services like ngrok. This sequence is indicative of an attacker attempting to register a rogue MFA provider to intercept authentication requests.
Detects the presence or execution of artifacts associated with the TrustSink proof-of-concept (deploy.py, cleanup_eam.py, deploy_state.json), which is used to register or remove rogue Entra authentication providers.
Detects potential post-authentication persistent actions (e.g., OAuth app grants, MFA changes, mailbox rule updates) performed shortly after a successful Google Workspace login, specifically flagging actions originating from IP addresses different from the login session to identify session hijacking or token replay (AiTM) activity. Includes suppression for known corporate IP ranges, trusted OAuth application consents, and recurring user behavior.
Detects the creation of applications, service principals, or delegated permission grants in Entra ID where the initiating User-Agent string contains 'python-requests'. This pattern is often indicative of programmatic interaction with Microsoft Graph API using standard Python libraries, which may be associated with automated malicious registration chains or unauthorized application persistence.
Detects the creation of an application or service principal followed quickly (within 1 hour) by a tenant-wide delegated permission grant scoped to 'AllPrincipals' with 'openid' and 'profile' permissions. This sequence is a known indicator of automated rogue Enterprise Application setup, often used in consent phishing or persistence campaigns.
Detects high-velocity administrative activity performed by a single user account in Azure Active Directory, specifically focusing on account provisioning and role membership changes. The rule flags patterns such as password resets, enabling/disabling accounts, adding new users, and privilege escalation (e.g., granting Global Administrator roles), which are indicative of malicious post-compromise activity.
Detects high-risk AWS IAM privilege escalation activities, such as attaching AdministratorAccess policies, creating new access keys, roles, or users, occurring shortly after a suspicious sign-in event (e.g., impossible travel or new device login with MFA) for the same principal.
Detects anomalous bursts of cloud secret or parameter retrieval API calls followed shortly by administrative actions that expose data or credentials (such as bucket policy changes or new key creation). This behavior is consistent with an adversary staging compromised credentials to exfiltrate data or maintain persistence.
Detects when a Google Cloud Config Connector (KCC) Workload Identity-bound service account is granted overly permissive organization-level roles (roles/owner or roles/resourcemanager.organizationAdmin). This configuration deviates from the security best practice of using namespaced mode with per-namespace scoped identities, potentially allowing the KCC controller to gain broader access than required, which is a known attack vector for privilege escalation.
Detects when a Google Cloud Config Connector (KCC) Workload Identity-bound service account is granted overly permissive organization-level roles (roles/owner or roles/resourcemanager.organizationAdmin). This configuration deviates from the security best practice of using namespaced mode with per-namespace scoped identities, potentially allowing the KCC controller to gain broader access than required, which is a known attack vector for privilege escalation.
Detects when a Google Cloud Config Connector (KCC) Workload Identity-bound service account is granted overly permissive organization-level roles (roles/owner or roles/resourcemanager.organizationAdmin). This configuration deviates from the security best practice of using namespaced mode with per-namespace scoped identities, potentially allowing the KCC controller to gain broader access than required, which is a known attack vector for privilege escalation.
Detects when a Google Cloud Config Connector (KCC) Workload Identity-bound service account is granted overly permissive organization-level roles (roles/owner or roles/resourcemanager.organizationAdmin). This configuration deviates from the security best practice of using namespaced mode with per-namespace scoped identities, potentially allowing the KCC controller to gain broader access than required, which is a known attack vector for privilege escalation.
Detects potential post-authentication persistent actions (e.g., OAuth app grants, MFA changes, mailbox rule updates) performed shortly after a successful Google Workspace login, specifically flagging actions originating from IP addresses different from the login session to identify session hijacking or token replay (AiTM) activity. Includes suppression for known corporate IP ranges, trusted OAuth application consents, and recurring user behavior.
Detects a suspicious correlation between the registration of new authentication methods or application integrations and the subsequent modification of Conditional Access policies within a 2-hour window. This behavior is indicative of the activation phase of a TrustSink attack, where an adversary sets up a malicious MFA provider and forces its use by expanding Conditional Access policy scope.
Detects the scripted, non-human-paced registration of a rogue external authentication method by monitoring a sequence of specific Azure Audit Log operations (Add application, Add service principal, Add delegated permission grant) occurring within 60 seconds of each other by the same actor. The detection is further corroborated by analyzing Microsoft Graph Activity Logs for associated Python requests to specific Graph API URIs.
Detects the scripted, non-human-paced registration of a rogue external authentication method by monitoring a sequence of specific Azure Audit Log operations (Add application, Add service principal, Add delegated permission grant) occurring within 60 seconds of each other by the same actor. The detection is further corroborated by analyzing Microsoft Graph Activity Logs for associated Python requests to specific Graph API URIs.
Detects the scripted, non-human-paced registration of a rogue external authentication method by monitoring a sequence of specific Azure Audit Log operations (Add application, Add service principal, Add delegated permission grant) occurring within 60 seconds of each other by the same actor. The detection is further corroborated by analyzing Microsoft Graph Activity Logs for associated Python requests to specific Graph API URIs.
This rule detects high-risk administrative operations in Azure Active Directory (such as role assignment, password resets, and account status changes) that occur within 3 hours of a user's sign-in. This pattern often indicates an account compromise followed by immediate privilege escalation or persistence establishment.
Detects when a Google Cloud Config Connector (KCC) Workload Identity-bound service account is granted overly permissive organization-level roles (roles/owner or roles/resourcemanager.organizationAdmin). This configuration deviates from the security best practice of using namespaced mode with per-namespace scoped identities, potentially allowing the KCC controller to gain broader access than required, which is a known attack vector for privilege escalation.
Page 2 of 7