Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,866 detections
Filters
Last updated
All Time
Detection languages
2,525
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,091
792
575
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
1,755
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
The following analytic detects the addition of new credentials for Service Principals within an Office 365 tenant. It uses O365 audit logs, focusing on events related to credential modifications or additions in the AzureActiveDirectory workload. This activity is significant because Service Principals represent application identities, and their credentials allow applications to authenticate and access resources. If an attacker successfully adds or modifies these credentials, they can impersonate the application, leading to unauthorized data access, data exfiltration, or malicious operations under the application's identity.
The analytic identifies authentication events of service principals in Azure Active Directory. It leverages the `azure_monitor_aad` data source, specifically targeting "Sign-in activity" within ServicePrincipalSignInLogs. This detection gathers details such as sign-in frequency, timing, source IPs, and accessed resources. Monitoring these events is significant for SOC teams to distinguish between normal application authentication and potential anomalies, which could indicate compromised credentials or malicious activities. If confirmed malicious, attackers could gain unauthorized access to resources, leading to data breaches or further exploitation within the environment.
The analytic detects an Azure AD user enabling a previously disabled account and resetting its password within 2 minutes. This activity is significant because it may indicate an adversary with administrative access attempting to establish a backdoor identity within the Azure AD tenant. If confirmed malicious, this could allow the attacker to maintain persistent access, escalate privileges, and potentially exfiltrate sensitive information from the environment.
The analytic identifies a single source IP failing to authenticate with multiple valid users, potentially indicating a Password Spraying attack against an Azure Active Directory tenant. It uses Azure SignInLogs data and calculates the standard deviation for source IPs, applying the 3-sigma rule to detect unusual numbers of failed authentication attempts. This activity is significant as it may signal an adversary attempting to gain initial access or elevate privileges. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and potential compromise of sensitive information.
This rule detects login activity by Azure AD administrators to Microsoft cloud applications that are not part of a predefined list of common first-party applications. The rule specifically looks for successful logins where the application ID is not in the 'first_party_ms_cloud_apps' list and the user ID is present in the 'entra_id_admin_watchlist'. This helps identify potentially unusual or unauthorized access by administrators to less common or custom applications, which could indicate compromise or policy violation.
This rule identifies attempts to use expired or revoked OAuth refresh tokens to sign in to Entra ID (formerly Azure AD). This could indicate an adversary attempting to use a previously compromised token that is no longer valid, or a legitimate user whose token has expired due to inactivity (90 days) or revocation. The rule specifically looks for login events from 'Azure Activity' with a 'BLOCK' action and an action detail code of '50173', which corresponds to an expired or invalid refresh token.
This rule detects file downloads from Office 365 or Microsoft Graph Activity logs, specifically excluding anonymous file links. It looks for 'FileDownloaded' events from Office 365 and HTTP GET requests with a 302 response code from Microsoft Graph Activity, ensuring the download is not initiated by an anonymous user.
This rule detects Azure AD login activity to applications that are not part of a predefined list of first-party Microsoft Cloud Apps. This could indicate an attempt to access an unauthorized or unusual application within the Azure AD environment, potentially by a compromised account or an insider threat. The rule specifically excludes the 'On-Premises Directory Synchronization Service Account' to reduce false positives related to ADFS synchronization.
This rule detects when an Entra ID (formerly Azure Active Directory) conditional access policy has been modified. It specifically looks for 'USER_RESOURCE_UPDATE_CONTENT' events within Office 365, targeting the 'AzureActiveDirectory' application, where the 'extendedAuditEventCategory' is 'Policy' and the 'product_event_type' is 'Update policy.'. This indicates a change to a conditional access policy, which could be a legitimate administrative action or a malicious attempt to alter security controls.
This rule detects when a user is added to an administrative role within Microsoft Entra ID (formerly Azure AD). It specifically looks for events where the event type is 'USER_CHANGE_PERMISSIONS', the product event type is 'Add member to role', and the product name is 'Azure AD Directory Audit'. The rule is configured to trigger when a user is assigned to a role with the TemplateId '62e90394-69f5-4237-9190-012177145e10', which corresponds to the Global Administrator role in Azure AD. This activity is sensitive and warrants validation due to the high privileges associated with administrative roles.
This rule detects the creation, modification, or deletion of client secrets within an Entra ID (formerly Azure AD) application. While client secrets have legitimate uses, their manipulation can be a method for adversaries to establish persistence by gaining unauthorized access to an application's functionalities and data.
This rule detects successful login activity by administrative users to Microsoft Office 365 applications that are not part of a predefined list of common, first-party Microsoft cloud applications. This helps identify potentially unauthorized or unusual access to less common applications within the O365 ecosystem by privileged accounts. The rule specifically targets 'USER_LOGIN' events from 'Office 365' where the login is allowed and the application ID is not in the 'first_party_ms_cloud_apps' list. It also filters for users present in an 'msazure_admin_watchlist'.
This rule detects persistent login activity to the Azure AD PowerShell application. Specifically, it looks for successful user logins to the application identified by the product object ID '1b730954-1685-4b74-9bfd-dac224a7b894' (which corresponds to Azure AD PowerShell) by the same user ID over a 24-hour period. The rule is designed to flag continuous access to this administrative tool, which is not considered a security best practice and warrants further investigation.
This rule detects the creation or modification of anonymous links in OneDrive. Anonymous links can be used to export files from OneDrive, posing a risk of data leakage, especially in organizations that do not support their creation.
This rule detects when a user is added to a role in Microsoft Entra ID (formerly Azure AD) outside of a Privileged Identity Management (PIM) process. While adding users to roles is a normal administrative action, performing it outside of PIM can indicate a potential security risk, as PIM provides just-in-time access and approval workflows for privileged roles. This rule specifically looks for "Add member to role outside of PIM (permanent)" events, which are often triggered via PowerShell API calls.
This rule detects successful login activities to the Azure AD PowerShell application within Office 365. While legitimate administrative tasks often involve using Azure AD PowerShell, adversaries can also abuse this access to gather user information or perform other malicious actions. The rule specifically looks for successful user logins to the application identified by the product object ID '1b730954-1685-4b74-9bfd-dac224a7b894'. It also includes commented-out filters for ADFS Sync Accounts, which are typically legitimate and run every 30 minutes.
Detects when a new user is created in Entra ID (formerly Azure Active Directory) and subsequently assigned administrative or other specified roles within a 90-minute window. This rule aims to identify potential privilege escalation or suspicious account setup activities.
This rule detects when a client secret is added to an application within Azure AD. While this action can be legitimate for application configuration and integration, it can also be abused by adversaries to establish persistence within the environment. By adding a secret, an attacker can maintain access to the application and potentially associated resources, even if their initial access method is remediated. The rule specifically looks for 'Update application' events related to 'Certificates and secrets management' in Azure AD Directory Audit logs.
This rule detects successful Office 365 login activity to applications that are not part of a predefined list of common, first-party Microsoft Cloud applications. This can help identify potentially unauthorized or unusual access to cloud resources via less common applications, which might indicate credential compromise or an attempt to bypass standard access controls. The rule specifically excludes certain known benign Microsoft application IDs and allows for filtering out ADFS synchronization traffic.
This rule detects a sequence of events where a new user account is created in Entra ID (formerly Azure AD) and then, shortly after, that same user is assigned an administrative-level role. This behavior can indicate an attacker establishing persistence or escalating privileges by creating a new account and immediately granting it high-level access.
This rule detects when the Unified Audit Log (UAL) is disabled in Office 365. This is identified by monitoring for the 'Set-AdminAuditLogConfig' product event type where the 'UnifiedAuditLogIngestionEnabled' field is set to 'False'. Disabling the UAL can indicate an adversary attempting to impair defenses and avoid detection by preventing their actions from being logged.
Page 175 of 185