Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,866 detections
Filters
Last updated
All Time
Detection languages
2,525
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,091
792
575
Platforms
39,936
7,266
6,535
3,866
3,647
Products / Services
1,755
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Identify a successful group creation. Triggered through the use of GraphRunner's Invoke-SecurityGroupCloner function.
This detects when the search/query endpoint is called which can be used for enumeration of items like SharePoint site URLs. GraphRunner contains a function called Get-SharePointSiteURLs but other tools may as well.
Identify enumeration of inboxes across the Entra ID tenant. This detection is based on the Invoke-GraphOpenInboxFinder in GraphRunner but the concepts are applicable to other tools that scan for accessible inboxes.
Identify the enumeration of both the users and members of groups in the Entra ID tenant. While these are two separate functions in GraphRunner, they are often run in support of one another.
Detects when a group is deleted.
This rule detects when an Entra ID application has a significant increase in the number of assigned permissions within a short timeframe (5 minutes). This could indicate a "greedy permission grab" by an attacker attempting to escalate privileges or gain broader access to resources. The rule specifically looks for an increase of more than 8 permissions compared to the previous state. It does not compare the specific permissions, only the count.
This rule detects the creation of new applications within Microsoft Entra ID (formerly Azure AD). While application creation is a legitimate administrative activity, it does not occur frequently. Monitoring this event can help identify unauthorized or suspicious application registrations that could be used for persistence, privilege escalation, or other malicious activities within the cloud environment.
This rule detects when a permission on a pre-defined watchlist is applied to an Entra ID application. It specifically looks for 'Update application.' events in Office 365 logs where the 'NewValue_EntitlementId-' or 'OldValue_EntitlementId-' labels indicate a change in application permissions. The rule leverages a watchlist named 'msgraph_watchlist_permissions' to identify sensitive or suspicious permission changes.
Detects when an excessive number of permissions are assigned to an Entra ID application within a short time window, calculated as a percentage increase from existing permissions. This could indicate a "greedy permission grab" by an attacker attempting to escalate privileges or gain broader access within the Entra ID environment. The rule specifically looks for updates to application permissions where the percentage increase of new permissions over old permissions exceeds a 70% threshold.
Detects when an excessive number of permissions are assigned to an Entra ID application within a time window, potentially indicating a greedy permission grab, as a numeric value comparing old permissions to new permissions
Detects when an excessive number of permissions are assigned to an Entra ID application within a time window, potentially indicating a greedy permission grab, as a percentage from old permissions to new permissions
Alerts when a permission on the watchlist is applied to an Entra ID application.
Application creation is a legitimate activity but doesn't occur frequently. Alerts when a new application is created in Entra ID (formerly Azure AD).
Detects when an application (service principal) is assigned Azure AD roles, such as global administrator, or Azure RBAC roles, such as subscription owner. This activity can indicate privilege escalation or persistence by an attacker who has compromised an application.
Detects when an app is assigned Azure AD roles, such as global administrator, or Azure RBAC roles, such as subscription owner.
This rule identifies when an Azure Firewall resource is created, modified, or deleted within an Azure subscription. This activity is captured through Azure Activity Logs, specifically looking for 'MICROSOFT.NETWORK/AZUREFIREWALLS/WRITE' (for creation/modification) and 'MICROSOFT.NETWORK/AZUREFIREWALLS/DELETE' operations. Such changes can indicate legitimate administrative actions or potentially malicious attempts to alter network defenses.
This rule detects activity related to AzureHound, a BloodHound data collector specifically designed for Microsoft Azure environments. It identifies AzureHound's presence by looking for its default 'User-Agent' string in Azure sign-in logs after a successful authentication (ResultType: 0). This indicates that an authenticated user or service principal is using AzureHound to enumerate Azure resources, which is often a precursor to further reconnaissance or privilege escalation within a cloud environment.
This rule identifies when a key within Azure Key Vault is modified or deleted. This includes operations such as updating, creating, importing, recovering, restoring, deleting, backing up, or purging keys. Monitoring these actions is crucial as compromise or unauthorized modification/deletion of cryptographic keys can lead to significant security incidents, including data compromise, loss of access to encrypted resources, or disruption of services relying on these keys.
This rule detects when an Azure AD user's credentials have been identified as leaked. This detection is based on the 'leakedCredentials' risk event type reported by Azure AD Identity Protection, indicating that the user's valid credentials (e.g., username and password) have been found on the dark web or other publicly available sources.
Detects suspicious inbox manipulation rules that are set on a user's mailbox to delete or move messages or folders. This often indicates an attacker is trying to hide their activities or exfiltrate data by automatically moving emails.
Detects when Microsoft Cloud App Security reports activities performed by users whose accounts have been terminated in Azure AD, but are still active in other platforms like AWS or Salesforce. This is particularly relevant for accounts used to manage resources that might not be terminated when a user leaves the company.
Page 180 of 185