Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
158 detections
Filters
Last updated
All Time
Detection languages
86
29
20
11
4
Contributors
36
20
17
16
15
Categories
128
67
12
11
11
Platforms
106
46
35
27
10
Products / Services
57
39
28
19
16
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
3
IDS Classtypes
1
IDS Protocols
1
Detects bulk Azure AD user account enumeration via Graph API
Detects unauthorized processes reading the .bash_history file concurrently with AWS CLI activity, which could indicate an adversary attempting to extract credentials or sensitive information from command history while interacting with AWS services. This behavior is associated with the Megalodon CI/CD malware.
This rule detects reconnaissance activity targeting sensitive employee information within Microsoft Graph. Specifically, it looks for 'Directory.Read.All' actions in Microsoft Graph events where the raw event data contains keywords like 'jobTitle' or 'displayName' and also includes terms such as 'payroll', 'hr', 'finance', or 'admin'. This combination suggests an attacker is attempting to enumerate or collect information about employees in sensitive departments, potentially for purposes like payroll hijacking or social engineering.
This rule detects reconnaissance activity targeting sensitive employee information within Microsoft Graph. Specifically, it looks for 'Directory.Read.All' actions in Microsoft Graph events where the raw event data contains keywords like 'jobTitle' or 'displayName' and also includes terms such as 'payroll', 'hr', 'finance', or 'admin'. This combination suggests an attacker is attempting to enumerate or collect information about employees in sensitive departments, potentially for purposes like payroll hijacking or social engineering.
Detects bulk Azure AD group membership enumeration via Graph API
Docker Image Enumeration via API
Suricata
This rule detects attempts to enumerate Docker images via the Docker API. Specifically, it looks for HTTP requests to the '/images/json' endpoint on TCP port 2375, which is commonly used for unauthenticated Docker API access. This activity can indicate an adversary performing reconnaissance on a system to understand its Docker environment.
This rule detects suspicious application consent activity in Azure AD. It identifies instances where a user successfully grants consent to three or more applications within a one-hour window. This behavior can indicate an adversary attempting to gain access to resources by tricking users into consenting to malicious applications.
This rule detects suspicious application consent activity in Azure AD. It identifies instances where a user successfully grants consent to three or more applications within a one-hour window. This behavior can indicate an adversary attempting to gain access to resources by tricking users into consenting to malicious applications.
Identifies bursts or requests to high-value Microsoft Graph API discovery endpoints. Tycoon 2FA operators frequently perform automated burst reconnaissance against these endpoints post-compromise to map out roles, tenant relationships, mailbox settings, and contacts.
Identifies bursts or requests to high-value Microsoft Graph API discovery endpoints. Tycoon 2FA operators frequently perform automated burst reconnaissance against these endpoints post-compromise to map out roles, tenant relationships, mailbox settings, and contacts.
A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com.
This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected,
it should be validated from GitHub UI because the log entry may not provide full context.
This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected,
it should be validated from GitHub UI because the log entry may not provide full context.
This rule detects suspicious user-agent strings in Microsoft Graph activity logs that are commonly associated with reconnaissance and attack tools targeting Azure AD and Microsoft 365 environments. These tools include BloodHound, ROADtools, AADInternals, and various other utilities used for enumeration, credential spraying, and other malicious activities.
This rule detects suspicious resource access patterns in Azure. Specifically, it flags instances where an 'Account' type actor (identified by a username) accesses resources that are not explicitly allowed for security monitoring (SecMon) or security orchestration, automation, and response (SecSoar) purposes. The rule also filters out activities from 'Microsoft-WindowsAzure-Frontdoor' and specific 'Microsoft.Resources' actions to reduce false positives. The primary goal is to identify unauthorized or unusual access to Azure resources by user accounts that fall outside defined security operational scopes.
Detects attempts to tamper with AWS CloudTrail or GuardDuty logging configurations by monitoring specific API calls that can disable, modify, or delete logging mechanisms. This includes actions like stopping logging, deleting trails, updating trails, disassociating from master accounts, archiving findings, stopping member monitoring, and deleting or updating detectors. Successful execution of these actions without an error indicates potential malicious activity aimed at evading detection.
Detects anomalous increases in AWS API calls resulting in "AccessDenied" errors for a single identity and source IP address, relative to that identity's historical baseline over the past 30 days. Sudden increases in denied requests or the variety of APIs being denied may indicate reconnaissance, permission probing, or misconfigured automation attempts by an adversary.
This rule detects changes to self-hosted GitHub Actions runner configurations. These changes include actions such as removing a self-hosted runner from an organization or repository, creating or removing runner groups, and adding, removing, or updating runners within a runner group. Such modifications can indicate administrative actions related to CI/CD infrastructure, which should be validated for legitimacy.
Detects the use of AWS IAM Policy Simulator APIs (SimulatePrincipalPolicy, SimulateCustomPolicy), which can indicate a threat actor is enumerating permissions to find privilege escalation paths.
KQL Query from file: GraphRunner Recon Detection & Response
KQL Query from file: Detect Microsoft Graph API Abuse
KQL Query from file: Microsoft Entra Identity Attack Threat Detection
KQL Query from file: Detect Privilege Admin under AiTM attack
Page 5 of 8