Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,866 detections
Filters
Last updated
All Time
Detection languages
2,525
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,091
792
575
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
1,755
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Detects unauthorized changes to the token-signing certificate for federated domains in Microsoft Entra ID (formerly Azure AD). This behavior is often associated with the Golden SAML attack technique, where an adversary modifies federation settings to forge authentication tokens. The rule filters for events occurring outside of standard business hours and alerts when the modification is not performed by known automation service accounts.
Detects the registration of a new multi-tenant OAuth application in an enterprise cloud environment that requests high-risk scopes (e.g., mail access or directory write permissions). This behavior is often associated with OAuth-based consent phishing or the establishment of persistent backdoors in cloud environments.
Detects the registration of a new multi-tenant OAuth application in an enterprise cloud environment that requests high-risk scopes (e.g., mail access or directory write permissions). This behavior is often associated with OAuth-based consent phishing or the establishment of persistent backdoors in cloud environments.
This rule detects when a Service Principal or Application is assigned to highly privileged directory roles within Microsoft Entra ID (formerly Azure AD). Adversaries may perform this action to achieve persistence or escalate privileges within the cloud environment by granting high-level administrative access to a compromised or adversary-controlled service principal.
Detects a mass influx of OAuth consent grant events for a single application from multiple users within a one-hour window. This behavior is indicative of a consent phishing campaign, where attackers lure users into granting excessive permissions to a malicious application to steal access tokens.
Detects the addition or update of federated identity credentials (FIC) on Entra ID applications or service principals that do not match an approved list of OIDC issuers. This technique, known as Workload Identity Federation, can be abused by adversaries for stealthy, token-less, secret-free persistence.
This rule detects when an OAuth application is granted sensitive Exchange Online permissions, such as 'full_access_as_app', 'Mail.Read', 'Mail.ReadWrite', or 'Mail.Send'. Granting these permissions allows an application to access mailboxes across the tenant without requiring a signed-in user context, which is a common persistence and data exfiltration technique used in Business Email Compromise (BEC) and espionage campaigns.
Detects modifications to Microsoft Entra ID (formerly Azure AD) Conditional Access policies that lower security posture. This includes disabling an active policy, removing users or groups from enforcement scopes, or removing MFA requirements. Such actions are typical of an adversary attempting to maintain persistent access or evade authentication controls.
This rule detects scenarios where an Azure application's permissions (scopes) are upgraded to high-risk levels after an initial period, a technique known as 'incremental consent'. This is often used by attackers to avoid triggering high-risk consent alerts during the initial application authorization process, subsequently escalating privileges over time.
Detects modifications to Microsoft Entra ID (formerly Azure AD) Conditional Access policies that lower security posture. This includes disabling an active policy, removing users or groups from enforcement scopes, or removing MFA requirements. Such actions are typical of an adversary attempting to maintain persistent access or evade authentication controls.
This rule detects scenarios where an Azure application's permissions (scopes) are upgraded to high-risk levels after an initial period, a technique known as 'incremental consent'. This is often used by attackers to avoid triggering high-risk consent alerts during the initial application authorization process, subsequently escalating privileges over time.
Detects the creation of a new application secret or credential in a cloud environment followed by an immediate authentication attempt using that credential from an IP address that has not been observed performing successful authentication within the specified lookback window. This behavior is indicative of potential unauthorized persistence or the use of compromised credentials by an adversary.
Detects malicious attempts to delete or modify the access control settings of centralized cloud audit log storage, such as S3 buckets, Azure Log Analytics workspaces, or GCP log buckets. These actions aim to impair visibility into an adversary's activities, a common step in anti-forensics and data destruction workflows.
This rule detects administrative changes to cloud storage configurations (AWS S3, Azure Blob, and GCP Storage) that result in public or anonymous read/write access to buckets or containers, which could lead to unauthorized data exposure.
Detects the creation of programmatic API credentials or service principal keys by highly privileged cloud identities across AWS, Azure, and GCP. Specifically monitors AWS Root, Azure AD Global/Company Administrators, and GCP Organization Owners, whose roles generally do not require long-term API access.
Detects successful cloud console login events across AWS, Azure, and GCP where multi-factor authentication (MFA) was not utilized, combined with impossible travel indicators (login from different countries within an 8-hour window for the same principal).
This rule detects the assignment of sensitive Microsoft Graph API application roles to a service principal, which can be an indicator of an adversary establishing a directory-wide backdoor in an Azure/Entra ID environment. This technique is often used to escalate privileges following an initial compromise of a low-privilege application registration.
Detects instances where a non-administrative user grants OAuth application permissions for high-risk Microsoft Graph delegated scopes. This activity is a common indicator of 'consent phishing' campaigns, where an attacker tricks a user into authorizing a malicious application, granting persistent access to the user's data and resources via API tokens, even after password resets.
Detects unauthorized modifications to federation trust configurations, such as IssuerUri, federationMetadataUrl, or signing certificate thumbprints, on a federated domain. Adversaries may manipulate these settings to establish credential-independent persistence or to forge SAML tokens (Golden SAML) by repointing the federation metadata to attacker-controlled infrastructure.
Detects OAuth application consent events where an application is granted a combination of 'offline_access' (allowing refresh token issuance) and email-read permissions. This pattern is commonly used by adversaries to establish persistent, long-term access to user mailboxes for data exfiltration or Business Email Compromise (BEC) activities, surviving password changes until the consent is explicitly revoked.
Detects instances where an administrator has granted tenant-wide consent to an OAuth application requesting highly privileged Microsoft Graph permissions. This activity is a significant indicator of potential persistence or privilege escalation, as it allows the application to perform sensitive operations across the organization without requiring individual user interaction.
Page 25 of 185