Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,868 detections
Filters
Last updated
All Time
Detection languages
2,527
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,092
793
576
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
1,757
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
This rule detects potential command and control (C2) beaconing activity by monitoring network events for specific URL patterns and user agent strings associated with known C2 frameworks like AzureVeil and Adaptix. It identifies beaconing if multiple devices communicate with the same remote IP address using these indicators within a 15-minute window, with more than 5 beacon counts and more than 1 distinct device.
This rule detects when a user account assigns a 'Global Administrator' or 'Owner' role from multiple distinct IP addresses within a one-hour window. This behavior can indicate a compromised account being used to escalate privileges or establish persistence from different locations.
This rule detects suspicious activity involving the creation or update of managed identities and the assignment of highly privileged roles (Contributor, Owner, User Access Administrator) to them. It specifically looks for multiple such assignments within a one-hour window to managed identities associated with automation, runbook, or function resources, indicating potential privilege escalation or malicious access.
Detects the configuration change that enables the 'external rest endpoint' feature in SQL Server 2025. Threat actors can abuse this feature using sp_invoke_external_rest_endpoint to natively exfiltrate data and establish C2 channels.
This rule detects attempts to create new accounts on major cloud platforms (AWS, Azure, Google Cloud) by monitoring HTTP traffic for specific hostnames and the 'signup' keyword in the URI. It specifically looks for connections to 'aws.amazon.com', 'portal.azure.com', or 'console.cloud.google' with 'signup' in the URI, indicating a potential account creation activity.
Detects compromised serverless functions being used as C2 relay infrastructure
Detects modification of cloud compute infrastructure to evade detection or remove evidence
Detects creation of Intune device management scripts, a potential privilege abuse vector.
This rule detects attempts to enumerate Azure Blob Storage containers. It specifically looks for HTTP requests targeting Azure Blob storage hosts (ending with '.blob.core.windows.net') and containing the query parameter '?comp=list', which is used to list containers within a storage account. This activity is indicative of reconnaissance or discovery against Azure cloud resources.
This rule detects a high volume of web requests (20 or more within 5 minutes from a single IP address) containing keywords commonly associated with denial-of-service (DoS) attacks, performance testing, or reconnaissance activities against web applications. Keywords include 'sleep', 'benchmark', and 'loadtest' in the URI query string.
Detects serverless function deployments used as C2 infrastructure
This rule detects a high volume of web requests (20 or more within 5 minutes from a single IP address) containing keywords commonly associated with denial-of-service (DoS) attacks, performance testing, or reconnaissance activities against web applications. Keywords include 'sleep', 'benchmark', and 'loadtest' in the URI query string.
This rule detects an unusually high number of web search queries (identified by 'search' or 'query' in the URI) originating from a single IP address within a one-hour window. A threshold of 100 or more queries triggers the alert. This behavior could indicate automated activity such as web scraping, reconnaissance, or a denial-of-service attempt against the search functionality.
This rule identifies successful device code authentications using the Microsoft Authentication Broker application (AppId '29d9ed98-a469-4536-ade2-f981bc1d605e') targeting Microsoft Graph (ResourceIdentity '00000003-0000-0000-c000-000000000000'). It specifically looks for these authentications originating from untrusted network locations. This activity is highly anomalous and can indicate an attacker generating Primary Refresh Tokens (PRTs) via device code phishing.
This rule detects potential tampering with Conditional Access Policies in Azure Active Directory by monitoring for multiple update, delete, or add operations on policies containing 'Conditional Access' in their display name within a one-hour window. This could indicate an adversary attempting to weaken security controls to maintain access or bypass MFA.
This rule detects a spike in modifications or creations of Azure Diagnostic Settings within a one-hour window. A high volume of 'Diagnostic Setting' operations by a single caller could indicate an attempt to alter logging configurations, potentially to impair defenses or hide malicious activity.
This query summarizes successful operations performed on Azure Container Registries, grouped by the caller and hourly time bins. It can be used for auditing or monitoring legitimate activity.
This rule detects a spike in successful Azure Load Balancer operations from a single caller within an hour. A count of 3 or more successful operations from the same caller within a one-hour window will trigger this alert. This could indicate automated activity or unusual configuration changes related to load balancers.
This rule detects an unusual number of successful encryption-related operations performed by a single caller within a one-hour window in Azure Activity logs. This could indicate legitimate bulk administrative tasks or potentially malicious activity such as data encryption for impact (e.g., ransomware) or preparation for exfiltration by an attacker.
Detects a spike in successful operations related to Azure Storage Account Keys by a single caller within a one-hour window. This could indicate an adversary attempting to enumerate, access, or exfiltrate storage account keys, or a legitimate user performing multiple key management activities.
This query summarizes successful operations performed on Azure Container Registries, grouped by the caller and hourly time bins. It can be used for auditing or monitoring legitimate activity.
Page 127 of 185