Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,749 detections
Filters
Last updated
All Time
Detection languages
2,543
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,244
994
880
773
476
Platforms
2,849
1,449
1,229
356
73
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
1,096
988
949
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
Identify emails that were send from an address external to your company and where email was send to more then 50 distinct corporate users.
Update corporatedomain.com to your corporate domain to have it excluded.
Update 50 if you want to adjust the distinct user count.
Update corporatedomain.com to your corporate domain to have it excluded.
Update 50 if you want to adjust the distinct user count.
Count of recipient's email addresses by subject
Count of recipient's email addresses by subject
Count of all Senders and where they were delivered
Count of sender's email addresses by subject
This rule detects suspicious activity following a successful login to the Azure AD PowerShell application. Specifically, it looks for a user performing multiple administrative actions within a short timeframe after logging in. These actions include adding or updating applications, adding delegated permission grants, or managing certificates and secrets for applications. This behavior is indicative of an attacker attempting to establish persistence or escalate privileges within an Entra ID environment after initial access.
This rule detects when a user is added to an administrative role within Office 365. While adding users to administrative roles is not inherently malicious, it is a sensitive action that warrants validation due to the elevated privileges granted. The rule specifically looks for the 'Add member to role.' event type within Office 365 and requires the role to be present in a predefined watchlist of sensitive roles.
Once a user authenticates to the Azure AD PowerShell application, if they take multiple admin actions indicative of establishing their own persistence with an Entra ID application within a portion of the access token time, alert for additional investigation
This analytic detects Lumma Stealer download attempts using Cisco Secure Firewall Intrusion Events. It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where Snort signatures with specific IDs have been triggered. If confirmed malicious, this behavior could indicate an active infection of Lumma Stealer.
Adding users to administrative roles is not malicious, but due to the sensitivity of certain roles, validation should occur when this occurs
The following analytic identifies potential DLL side-loading instances involving unsigned DLLs mimicking Microsoft signatures. It detects this activity by analyzing Sysmon logs for Event Code 7, where both the `Image` and `ImageLoaded` paths do not match system directories like `system32`, `syswow64`, and `programfiles`. This behavior is significant as adversaries often exploit DLL side-loading to execute malicious code via legitimate processes. If confirmed malicious, this activity could allow attackers to execute arbitrary code, potentially leading to privilege escalation, persistence, and unauthorized access to sensitive information.
This analytic aggregates and summarizes alerts from Microsoft Defender for Endpoint. It extracts details such as source, file name, severity, process command line, IP address, registry key, signature, description, and unique ID. The detection is not intended to identify new activity from raw data but rather to leverage existing Microsoft Defender for Endpoint alerts for correlation and risk-based alerting. It filters out alerts with a 'clean' verdict and dynamically maps MITRE techniques and assigns risk scores based on the alert's severity.
Detects when an account dumps the LAPS password from Entra ID.
The following analytic identifies the creation of new email forwarding rules in an Office 365 environment. It detects events logged under New-InboxRule and Set-InboxRule operations within the o365_management_activity data source, focusing on parameters like ForwardTo, ForwardAsAttachmentTo, and RedirectTo. This activity is significant as unauthorized email forwarding can lead to data exfiltration and unauthorized access to sensitive information. If confirmed malicious, attackers could intercept and redirect emails, potentially compromising confidential communications and leading to data breaches.
The following analytic identifies when a new device is enrolled on an Okta account. It uses OktaIm2 logs ingested via the Splunk Add-on for Okta Identity Cloud to detect the creation of new device enrollments. This activity is significant as it may indicate a legitimate user settinging up a new device or an adversary adding a device to maintain unauthorized access. If confirmed malicious, this could lead to potential account takeover, unauthorized access, and persistent control over the compromised Okta account. Monitoring this behavior is crucial for detecting and mitigating unauthorized access attempts.
This correlation rule identifies when a user exceeds a predefined risk threshold based on multiple suspicious Okta activities within a 24-hour period. It aggregates risk events from "Suspicious Okta Activity," "Okta Account Takeover," and "Okta MFA Exhaustion" analytic stories. The detection is significant as it highlights potentially compromised user accounts exhibiting multiple tactics, techniques, and procedures (TTPs). If confirmed malicious, this activity could indicate a serious security breach, allowing attackers to gain unauthorized access, escalate privileges, or persist within the environment.
This analytic identifies the creation or modification of email inbox rules within an Office 365 environment. It specifically looks for `New-InboxRule` and `Set-InboxRule` operations in the O365 management activity logs where the rule parameters indicate actions such as mail forwarding (`ForwardTo`, `ForwardAsAttachmentTo`, `RedirectTo`), or mail manipulation like deletion (`SoftDeleteMessage`, `DeleteMessage`) or moving to specific folders (`MoveToFolder`, `CopyToFolder`). While legitimate users create inbox rules, adversaries often leverage these techniques to exfiltrate emails, maintain persistence, or hide their activities by deleting or moving security alerts.
The following analytic detects attempts to disable multi-factor authentication (MFA) for an Azure AD user. It leverages Azure Active Directory AuditLogs to identify the "Disable Strong Authentication" operation. This activity is significant because disabling MFA can allow adversaries to maintain persistence using compromised accounts without raising suspicion. If confirmed malicious, this action could enable attackers to bypass an essential security control, potentially leading to unauthorized access and prolonged undetected presence in the environment.
The analytic detects the registration of a new Multi-Factor Authentication (MFA) method for an Azure AD account. It leverages Azure AD AuditLogs to identify when a user registers new security information. This activity is significant because adversaries who gain unauthorized access to an account may add their own MFA method to maintain persistence. If confirmed malicious, this could allow attackers to bypass existing security controls, maintain long-term access, and potentially escalate their privileges within the environment.
The following analytic identifies suspicious command-line parameters associated with the use of Impacket's smbexec.py for lateral movement. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific command-line patterns indicative of Impacket tool usage. This activity is significant as both Red Teams and adversaries use Impacket for remote code execution and lateral movement. If confirmed malicious, this activity could allow attackers to execute commands on remote endpoints, potentially leading to unauthorized access, data exfiltration, or further compromise of the network.
The following analytic identifies instances where a service principal in Office 365 Azure Active Directory assigns app roles without standard admin consent. It leverages `o365_management_activity` logs, specifically focusing on the 'Add app role assignment to service principal' operation. This activity is significant for SOCs as it may indicate a bypass of critical administrative controls, potentially leading to unauthorized access or privilege escalation. If confirmed malicious, this could allow an attacker to misuse automated processes to assign sensitive permissions, compromising the security of the environment.
Page 167 of 179