Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,868 detections
Filters
Last updated
All Time
Detection languages
2,527
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,092
793
576
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
1,757
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Detects user sign-ins occurring outside of predefined normal business hours and from locations not explicitly whitelisted. This rule aims to identify potentially unauthorized access attempts or compromised accounts being used at unusual times or from unexpected geographies.
Detects the registration of a new device or MFA authentication method in Microsoft Entra ID from an IP address geolocated to Morocco. This is a persistence tactic used by the Jingle Thief group (also tracked as Atlas Lion and STORM-0539).
This rule detects when multi-factor authentication (MFA) has been explicitly disabled for a user in Azure Active Directory. This activity could indicate an adversary attempting to bypass authentication mechanisms to gain unauthorized access or maintain persistence.
Detects successful authentication attempts originating from clients using legacy authentication methods, identifiable via specific user agent strings. This activity can indicate an adversary attempting to bypass multi-factor authentication (MFA), potentially as part of a password spray attack. Legacy authentication protocols often do not support modern MFA mechanisms, making them a target for attackers who have obtained valid credentials through other means or are performing brute-force attacks like password spraying.
Detects when an Azure Blob Storage container's access level is changed to allow public access, or when a long-lived, highly privileged Shared Access Signature (SAS) token is created. Threat actors can use these methods for persistence and data exfiltration.
Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith. The rule specifically looks for 'UserLoggedIn' operations with 'Success' status for the Microsoft Intune Company Portal ApplicationId, while excluding a specific ObjectId often associated with mobile device enrollment to reduce false positives.
Detects the registration of a new device or MFA authentication method in Microsoft Entra ID from an IP address geolocated to Morocco or associated with specific Moroccan ASNs. This is a persistence tactic used by the Jingle Thief group (also tracked as Atlas Lion and STORM-0539).
This rule detects when a user successfully elevates their permissions to manage all Azure Subscriptions. This action grants broad access across the Azure environment and should be immediately investigated if it is not a planned administrative activity. Such an elevation could be leveraged by an attacker to gain extensive control over Azure resources.
This rule detects attempts to read or retrieve BitLocker recovery keys from Azure audit logs. This activity can be indicative of an attacker attempting to gain access to encrypted data on compromised devices or to bypass disk encryption for persistence or defense evasion.
This rule detects when user accounts are created or deleted in Azure Active Directory by users who are not on an approved list. It specifically looks for 'Add user' or 'Delete user' messages in the audit logs with a 'Success' status, and then filters out actions initiated by known, approved administrators.
This rule detects when a user is added to an administrator's role within Azure Active Directory. This is a critical event as it grants elevated privileges to the user, which could be abused for malicious purposes such as persistence, privilege escalation, or initial access. The detection specifically looks for 'Add member to role.' operations in AzureActiveDirectory workload where the new role value ends with 'Admins' or 'Administrator'.
This rule detects the use of legacy authentication protocols for sign-ins to Azure AD. Legacy authentication protocols (such as POP3, IMAP, SMTP, MAPI, Exchange ActiveSync, Exchange Web Services, and 'Other client') do not support modern security features like Multi-Factor Authentication (MFA) and are often targeted by attackers for credential stuffing, brute-force attacks, and other credential-based attacks. Detecting and alerting on these sign-ins helps identify potential compromise or policy violations.
Detects when a temporary access pass (TAP) is added to an account in Azure AD. TAPs are a passwordless authentication method that can be used for onboarding, recovery, or as a strong credential. The addition of a TAP, especially to privileged accounts, should be investigated as it could indicate an attempt to gain or maintain unauthorized access.
This rule detects when Privileged Identity Management (PIM) alerts are disabled within Azure. Disabling PIM alerts can be a defense evasion tactic, as it prevents security teams from being notified of critical activities related to privileged roles, potentially allowing an attacker to operate undetected after gaining initial access or escalating privileges.
Detects successful sign-ins by privileged role accounts that occur outside of normal business hours or from unusual geographic locations. This rule is designed to flag potentially suspicious activity that could indicate compromised credentials or insider threat activity, especially for administrative accounts.
Identifies when a user grants permissions to another user on Azure resources. The rule specifically looks for the 'Microsoft.Authorization/roleAssignments/write' operation in Azure Activity Logs, which indicates a role assignment creation or modification. This can be an indicator of privilege escalation or persistence.
This rule detects when a user's account type is changed from 'Guest' to 'Member' within Azure Active Directory. This change signifies an elevation of privileges for the user, as 'Member' accounts typically have broader access and capabilities compared to 'Guest' accounts. Such a modification could be an indicator of an adversary attempting to gain higher privileges or establish persistence within the cloud environment.
Detects when a Privileged Identity Management (PIM) elevation request is approved or denied within Azure AD. This rule helps monitor critical administrative actions related to privilege escalation. Any approvals or denials outside of expected administrative operations should be investigated as they could indicate unauthorized privilege management or attempts to bypass security controls.
This rule detects successful sign-in attempts to Azure AD from devices that are not registered in Active Directory (non-compliant devices) and where Multi-Factor Authentication (MFA) was not required. The sign-in is also flagged as 'atRisk' by Azure AD. This scenario can indicate an adversary attempting to gain initial access or maintain persistence using compromised credentials from an unregistered device, bypassing stronger authentication controls.
This rule identifies a critical security misconfiguration or bypass scenario within Azure Privileged Identity Management (PIM) where a privileged role can be activated without requiring multi-factor authentication (MFA). This can significantly increase the risk of unauthorized access and privilege escalation if an attacker compromises credentials for an account with PIM roles.
This rule detects instances where a user denies a multi-factor authentication (MFA) prompt. This could indicate that an attacker has successfully obtained the user's password and is attempting to gain unauthorized access, prompting the legitimate user for MFA approval. The user's denial signals that they did not initiate the login attempt.
Page 147 of 185