Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,864 detections
Filters
Last updated
All Time
Detection languages
2,523
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,448
1,199
1,091
792
575
Platforms
39,926
7,251
6,535
3,864
3,632
Products / Services
1,755
1,449
1,120
438
406
MITRE Techniques
1,888
1,391
913
814
726
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
This rule detects anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser. This indicates a potential compromise of user credentials or an attempt to bypass authentication mechanisms.
Detects when a new owner is added to an application in Azure AD. This action grants the newly added account privileges to modify and configure the application, which could be abused by an attacker to maintain persistence, elevate privileges, or access sensitive data.
Detects when an administrator grants an application either application permissions (app roles) or highly privileged delegated permissions within an Azure environment. This action is logged in the Azure audit logs as 'Add app role assignment to service principal'. Such assignments can lead to persistence or privilege escalation if abused.
This rule detects sign-in attempts originating from IP addresses identified as malicious by Azure AD Identity Protection, specifically when these attempts are characterized by a high failure rate. This indicates potential brute-force attacks, credential stuffing, or other unauthorized access attempts from known bad IP addresses.
Identifies when a Point-to-site VPN is Modified or Deleted in Azure. This could indicate an attacker attempting to disrupt network access or cover their tracks by removing or altering VPN configurations.
This rule identifies when a suppression rule is created in Azure. Adversaries might create suppression rules to evade detection by preventing security alerts from being generated or displayed for their malicious activities.
Detects when highly privileged delegated permissions are granted on behalf of all users in Azure Active Directory. This can indicate an attempt to gain broad access to resources by an application.
This rule identifies user activity originating from an IP address that has been flagged as an anonymous proxy. Such activity can indicate an attempt to obscure the true origin of a sign-in, which is often associated with malicious intent like credential stuffing, account takeover, or bypassing geographical restrictions.
Indicates that a password spray attack has been successfully performed.
Identifies when a application gateway is modified or deleted.
Identifies when a application security group is modified or deleted.
Indicates the SAML token issuer for the associated SAML token is potentially compromised. The claims included in the token are unusual or match known attacker patterns
Identifies when a key vault is modified or deleted.
Identifies when secrets are modified or deleted in Azure.
Identifies when a network security configuration is modified or deleted.
Identifies when a VPN connection is modified or deleted.
End User Consent
Sigma
Detects when an end user consents to an application
Detects when end user consent is blocked due to risk-based consent.
Detects when an application is granted delegated or app role permissions for Microsoft Graph, Exchange, Sharepoint, or Azure AD
Detects when administrator grants either application permissions (app roles) or highly privileged delegated permissions
Indicates that the user's valid credentials have been leaked.
Page 183 of 184