Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,866 detections
Filters
Last updated
All Time
Detection languages
2,525
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,091
792
575
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
1,755
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Detects the addition of passwords or certificates to Entra ID applications or service principals by an identity that is not currently listed as an owner. This behavior is a common persistence technique used by threat actors to maintain long-term access, bypass password resets, and circumvent MFA.
Detects modifications to Entra ID (formerly Azure AD) that disable security defaults, per-user MFA enforcement, or conditional access policies requiring MFA. Such actions remove tenant-wide MFA protection and are often precursors to account takeover, password spraying, or ransomware attacks.
Detects instances where a Service Principal or Enterprise Application is assigned a highly privileged Entra ID directory role (e.g., Global Administrator, Privileged Role Administrator). This behavior is often associated with adversary attempts to establish persistent access that survives remediation of human-managed identities.
Detects the creation of a new application secret or credential in a cloud environment followed by an immediate authentication attempt using that credential from an IP address that has not been observed performing successful authentication within the specified lookback window. This behavior is indicative of potential unauthorized persistence or the use of compromised credentials by an adversary.
Detects unauthorized sharing, copying, or exporting of EBS, disk, or database snapshots to external cloud accounts, subscriptions, or projects that are not present in the defined trusted allow-list for AWS, Azure, or GCP environments.
This rule identifies potential account compromise through the detection of non-interactive Azure AD sign-ins originating from geographically distant locations within a short, travel-implausible timeframe. Such activity is highly indicative of the theft and export of a Primary Refresh Token (PRT) from a legitimate endpoint, which is subsequently replayed by an adversary from external infrastructure to gain unauthorized access to cloud resources.
Detects the assignment of high-privilege Azure directory roles to a service principal identity. Threat actors may leverage this behavior to establish persistent, non-interactive backdoor access in a cloud tenant, bypassing MFA and sign-in scrutiny.
This rule detects when a new password credential (client secret) is added to an existing Azure AD Service Principal or application. This activity is a common method for adversaries to establish persistence in a cloud environment that survives password resets or MFA enforcement on the original administrative account.
Detects modifications to cloud storage access control configurations in Azure (containers/blobs) and GCP (storage buckets) that result in public or unauthenticated access. The rule uses lookups to filter out approved public assets before alerting.
Detects modifications to SAML identity providers, federation settings, and trust configurations in AWS and Azure AD/Entra where the signing certificate fingerprint does not match a known-good baseline, and no corresponding change ticket is detected in the raw logs.
Detects high-volume or multi-type destructive operations against cloud backup, snapshot, and recovery infrastructure, including the disabling of immutability policies or soft-delete protections. This activity is consistent with ransomware actors attempting to eliminate recovery options before encrypting data.
Detects a service principal or application identity performing a burst of deletion operations across multiple Azure resource types, such as Storage Accounts, SQL Databases, Key Vaults, and Function Apps. This behavior is indicative of malicious activity, including potential cloud environment destruction or 'agentic' destructive operations similar to those observed in the Storm-3168 (JADEPUFFER) threat activity.
Detects unauthorized modifications to Microsoft Entra Conditional Access (CA) policies, including deleting policies, disabling them, removing MFA requirements, or excluding specific users. These actions are common techniques used by adversaries to establish persistence or facilitate unauthorized access by weakening security controls.
Detects instances where a user grants an OAuth application consent to high-risk scopes (such as mail reading, file access, or directory reading) without administrator oversight. This behavior is a common indicator of OAuth abuse where an attacker lures a user into granting excessive permissions to a malicious application, providing the attacker persistent access to the user's data.
Detects the modification of an Azure Storage account configuration to enable public access (allowBlobPublicAccess: true). This activity is often associated with attackers attempting to facilitate anonymous data exfiltration by enabling public access to blobs and subsequently reading them.
This rule detects a multi-stage attack chain where a device shows signs of credential theft (accessing browser credential stores or cookies) followed closely by a successful cloud authentication from that same user using a device identifier not previously observed in the last 30 days.
This rule detects scenarios where an existing SSO or Identity Provider (IdP) session is reused from a device context that differs from the one that originally performed MFA. It identifies this by joining authentication events by SessionId, specifically looking for instances where MFA occurred in one event and a subsequent non-MFA event for the same session has a different User-Agent, DeviceId, JA3 hash, or Operating System build, indicating potential session token theft or reuse.
Detects instances where a user account associated with a detected infostealer malware infection (e.g., Redline, Raccoon, Vidar) successfully authenticates to a cloud service from a suspicious network location, such as a VPN, residential proxy, or Tor exit node, within 24 hours of the infection alert.
Detects MFA or security information registration, updates, or deletions within Entra ID AuditLogs that occur within two hours of a sign-in event flagged as risky, impossible travel, or involving a new device. This sequence is a common indicator of post-compromise identity persistence.
This rule correlates endpoint security alerts for popular information-stealer malware (Lumma, StealC, Vidar, RedLine, Acreed, Atomic Stealer) with subsequent successful cloud identity authentication events from the same user account. The correlation window is set to 72 hours following an endpoint infostealer detection, which suggests potential account takeover or unauthorized access facilitated by credentials stolen from a compromised endpoint.
Detects mass device management actions (e.g., remote wipe, retire, or delete) performed via the Microsoft Intune console by a user who has simultaneously exhibited risky sign-in behavior, potentially indicating a compromised administrative account.
Page 10 of 185