Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
53 detections
Filters
Last updated
All Time
Detection languages
41
7
3
1
1
Contributors
13
12
11
7
2
Categories
24
19
12
11
11
Platforms
43
15
12
5
3
Products / Services
25
18
13
9
8
MITRE Techniques
18,116
15,638
12,586
8,396
6,226
CVEs
1
1
IDS Classtypes
1
IDS Protocols
1
Detects a user password change synced from on-premises Active Directory, immediately followed by the same user registering a new MFA method. This sequence is highly suspicious for existing privileged accounts and was used by the threat actor Storm-0501 to compromise a Global Administrator account that previously lacked MFA.
This detection specifically flags credentials being added to the Connect Sync Application in Entra ID, a technique known to have persistance from On-premise AD DS to Entra ID. It tries to look at both certificate, client secret, and federated credentials being added, and tries to remove legitimate renewal processes. Since the legitimate renewal process first adds a new certificate only te remove the old one short after, we by default allow for a maximum of 1 minute between the certificate create and delete events.
This detection flags any changes happening on the Connect Sync Application in Entra ID. Since this is a very interesting account for attackers to abuse when moving laterally between AD DS and Entra ID, any change to the account should be investigated. We try to exclude legitimate certificate renewal processes, and a new account onboarding in the detection rule.
KQL Query
KQL Query
KQL Query from file: Detect Privilege Admin under AiTM attack
KQL Query from file: Conditional Access Report
KQL Query from file: Detecting GOLDEN SAML Attack
KQL Query from file: Entra Admin Roles Query
KQL Query from file: Entra ID Administrative Role (AD-Sync)
KQL Query
KQL Query from file: Threat Hunting Nation State Actors
KQL Query
KQL Query
KQL Query from file: Monthly Report Entra Eligible Role Activation
In this detection,we hunt for any sign-in attempt from a non-managed, non-compliant, untrusted device.
Looks for multiple users that had their admin role removed by a single user within a certain period.
'Looks for new device registrations following a risky user account sign-in. By default the
query will use a 6 hour lookback period, this can be configured within the query.'
query will use a 6 hour lookback period, this can be configured within the query.'
'Identifies accounts that have been added to a PIM managed privileged group'
'Azure AD Connect (AAD Connect) is a critical service that handles connections between on-premise Active Directory and Azure AD.
Due to the critical nature of AAD Connect threat actors may attempt to compromise the service in order to access credentials.
This query looks for SSH connections to host that appear to run AAD Connect. The results should be reviewed to determine if the
SSH connection is legitimate.'
Due to the critical nature of AAD Connect threat actors may attempt to compromise the service in order to access credentials.
This query looks for SSH connections to host that appear to run AAD Connect. The results should be reviewed to determine if the
SSH connection is legitimate.'
' This query will detect when an attempt is made to update an existing user and link it to an guest or external identity. These activities are unusual and such linking of external
identities should be investigated. In some cases you may see internal Entra ID sync accounts (Sync_) do this which may be benign'
identities should be investigated. In some cases you may see internal Entra ID sync accounts (Sync_) do this which may be benign'
Page 2 of 3