Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
158 detections
Filters
Last updated
All Time
Detection languages
86
29
20
11
4
Contributors
36
20
17
16
15
Categories
128
67
12
11
11
Platforms
106
46
35
27
10
Products / Services
57
39
28
19
16
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
3
IDS Classtypes
1
IDS Protocols
1
Detects anomalous GitLab project enumeration where an account performs an excessive number of requests to the Projects API using the 'membership=true' parameter within a one-hour window. This behavior is indicative of an attacker attempting to discover all accessible repositories associated with a compromised or over-privileged GitLab token.
Detects Shai-Hulud / ChainDrop activity by correlating known malicious hashes, npm/Node/Bun execution, payload artifacts, IDE persistence, credential discovery, cloud metadata access, GitHub exfiltration, C2 domains, Ethereum RPC activity, staging files, persistence artifacts, and known IOC IP connections.
Detects Shai-Hulud / ChainDrop activity by correlating known malicious hashes, npm/Node/Bun execution, payload artifacts, IDE persistence, credential discovery, cloud metadata access, GitHub exfiltration, C2 domains, Ethereum RPC activity, staging files, persistence artifacts, and known IOC IP connections.
This rule detects anomalous activity involving the legacy Microsoft Azure AD Graph API (graph.windows.net) originating from users who lack corresponding entries in standard Entra ID (AuditLogs) sign-in or management activity logs. A high frequency of these undocumented API calls (more than 5 in an hour) from a specific user and IP address indicates potential unauthorized reconnaissance or access attempts attempting to bypass standard audit logging.
This rule detects anomalous activity involving the legacy Microsoft Azure AD Graph API (graph.windows.net) originating from users who lack corresponding entries in standard Entra ID (AuditLogs) sign-in or management activity logs. A high frequency of these undocumented API calls (more than 5 in an hour) from a specific user and IP address indicates potential unauthorized reconnaissance or access attempts attempting to bypass standard audit logging.
Detects GET requests to the Microsoft Graph API 'organization' endpoint, often used by malicious tools to validate a tenant environment or gather metadata before initiating C2 communication or secondary stages of an attack.
Detects GET requests to the Microsoft Graph API 'organization' endpoint, often used by malicious tools to validate a tenant environment or gather metadata before initiating C2 communication or secondary stages of an attack.
Detects anomalous discovery behavior in Azure where a principal performs multiple 'read' operations against both Container Registry and Role Assignments within a short timeframe. This pattern is consistent with an adversary attempting to map the cloud environment, identify accessible resources, and understand permission structures.
Detects GET requests to the Microsoft Graph API 'organization' endpoint, often used by malicious tools to validate a tenant environment or gather metadata before initiating C2 communication or secondary stages of an attack.
Detects use of 'az acr show' or 'az acr repository list' commands to enumerate Azure Container Registry security settings such as adminUserEnabled, anonymousPullEnabled, or networkRuleBypassOptions, indicating reconnaissance for misconfigurations.
Detects reconnaissance activities targeting Azure Container Registry, specifically the listing of available repositories using the Azure CLI and pulling container images, which may indicate an adversary attempting to discover or exfiltrate software components.
This rule monitors for the execution of Azure CLI commands used to enumerate role assignments and Azure Container Registry (ACR) details. Adversaries often perform this reconnaissance to identify high-privilege accounts, discover container registries, or map out permissions to facilitate lateral movement or persistence within an Azure environment.
Detects anomalous activity where an identity performs a sequence of reconnaissance-related AWS API calls (e.g., listing roles, policies, or describing instances) followed shortly (within 10 minutes) by deployment actions like RunInstances or CreateCluster. This behavior is indicative of an attacker who has gained access to an identity and is surveying the environment before provisioning malicious infrastructure.
Detects rapid, multi-type API enumeration (GetCallerIdentity, ListBuckets, DescribeInstances) performed by an IAM principal or AssumedRole that has no historical record of performing these actions. This pattern is indicative of potential credential theft, specifically from compromised developer tooling such as malicious MCP configurations or automated agents like Amazon Q, Claude Code, Cursor, or Windsurf.
Detects Microsoft Graph API enumeration of privileged directory endpoints using a token with only User.Read scope and password-only authentication (amr: pwd). This activity is consistent with the exploitation of CVE-2025-0309, often associated with tooling like AzureHound/roadtx, which abuses hidden Conditional Access exclusion policies.
Detects an unusually high volume of successful operations related to Azure App Services originating from a single caller within a one-hour window. This could indicate automated activity, reconnaissance, or a misconfigured application.
Detects AzureHound or roadtx bulk enumeration of Microsoft Graph API endpoints using tokens obtained via CVE-2025-0309 CA policy bypass, characterized by high-frequency GET requests to /v1.0/users, /v1.0/groups, /v1.0/devices, /v1.0/servicePrincipals from Edge client IDs (f44b1140-bc5e-48c6-8dc0-5cf5a53c0e34 or 22098786-6e16-43cc-a27d-191a01a1e3b5) with password-only amr claim and no MFA.
Detects high-frequency enumeration of privileged roles or role assignments within Azure AD (Entra ID) by a single user or IP address within a short time window. This activity often precedes more targeted attacks aimed at compromising highly privileged identities.
Detects bulk enumeration of Microsoft Graph API endpoints (users, groups, devices, service principals) characteristic of tools like AzureHound or roadtx. The detection focuses on high-frequency GET requests originating from known Edge browser client IDs associated with CA policy bypass (CVE-2025-0309) where tokens lack MFA claims, indicating unauthorized reconnaissance in an Azure/Entra ID environment.
This rule detects suspicious application consent activity in Azure AD. It identifies instances where a user successfully grants consent to three or more applications within a one-hour window. This behavior can indicate an adversary attempting to gain access to resources by tricking users into consenting to malicious applications.
Detects attackers querying audit logs to understand defender visibility
Page 3 of 8