Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,866 detections
Filters
Last updated
All Time
Detection languages
2,525
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,091
792
575
Platforms
39,936
7,266
6,535
3,866
3,647
Products / Services
1,755
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
This rule detects anomalous activity associated with the Antino backdoor, which uses Microsoft OneDrive as a dead-drop command-and-control (C2) channel. It identifies specific file paths related to heartbeat check-ins, operator tool drops, and exfiltration retrieval, summarizing events by user and IP to highlight potential malicious persistent communication and data transfer patterns.
Detects anomalous authentication patterns associated with AI agent or service account credentials. The rule monitors for logins originating from multiple disparate network locations, ASNs, or countries within a 15-minute window, and detects unexpected MFA challenges directed at accounts that typically function as automated, headless identities.
Detects registration of a new actor-controlled MFA authentication method (phone, authenticator app, or software OTP token) via an Update user operation, matching the NO_DEVICE/NO_DEVICE_TOKEN/SoftwareTokenActivated pattern used to convert temporary compromise into durable identity persistence
This rule detects when a Service Principal or Application is assigned to highly privileged directory roles within Microsoft Entra ID (formerly Azure AD). Adversaries may perform this action to achieve persistence or escalate privileges within the cloud environment by granting high-level administrative access to a compromised or adversary-controlled service principal.
Detects modifications to security groups, network security groups (NSG), or firewall rules across AWS, Azure, and GCP that expose sensitive management or database ports (22, 3389, 3306, 5432, 6379, 9200, 27017) to the entire internet (0.0.0.0/0). Such configurations significantly increase the attack surface and potential for unauthorized access, brute-force attacks, or data exposure.
Detects the use of standard Linux command-line utilities (e.g., cat, curl, vi) to read or reference sensitive cloud credential files or Kubernetes service account tokens. This behavior is a common indicator of credential theft or discovery activities following initial access to a Linux host.
Detects unauthorized modifications or deletions of cloud logging sinks in Google Cloud Platform (GCP) or diagnostic settings in Azure, which may indicate an attacker attempting to disable audit logs to cover their tracks or evade detection.
Detects instances where a long-dormant Entra ID (Azure AD) service principal is reactivated shortly after having a new credential added or a new app role assigned. This activity is a potential persistence technique where an attacker repurposes a legitimate, high-privileged, but unused service principal to blend in as legacy automation.
This rule detects potential adversary-in-the-middle (AiTM) session hijacking by monitoring non-interactive sign-in events. It identifies when a refresh token is redeemed from a device identifier that does not exist in the user's recent interactive sign-in history and from a geographical location different from the user's last known interactive session.
Detects the creation or modification of federated identity credentials within Azure Active Directory (Entra ID). This technique allows external services like GitHub Actions, Kubernetes, or other identity providers to authenticate as an application without stored secrets, bypassing traditional secret-rotation and credential-scanning security controls. The rule identifies potential unauthorized persistence by highlighting external or unrecognized issuers.
Detects potential session cookie replay attacks by identifying sign-in events using SSO or session tokens from different IP addresses, geographic locations, or devices compared to an established user baseline, without a corresponding fresh MFA challenge in the same timeframe. This behavior is indicative of unauthorized access to an already-authenticated session.
Detects a sequence of authentication activity indicative of a credential stuffing attack. The rule identifies a burst of failed password-only authentication attempts followed by a successful authentication for the same account. It requires that the IP address used for the successful login overlaps with the set of IPs that initiated the failed attempts, effectively filtering out typical user noise and highlighting potentially malicious activity where an attacker has identified a valid credential.
Detects a sequence of authentication activity indicative of a credential stuffing attack. The rule identifies a burst of failed password-only authentication attempts followed by a successful authentication for the same account. It requires that the IP address used for the successful login overlaps with the set of IPs that initiated the failed attempts, effectively filtering out typical user noise and highlighting potentially malicious activity where an attacker has identified a valid credential.
Detects sign-in attempts originating from IP address ranges known to be utilized by the TeamFiltration tool for password spraying operations against Azure environments.
Detects a successful self-service password reset followed shortly by an authentication method change on the same account -- the exact SSPR-then-MFA-reregistration sequence used by Storm-3068 and Storm-2949 for persistence.
Hardened before submission: switched TargetResources[0] positional indexing to mv-expand + type == "User" matching, consistent with the fix already applied to the Agent User group-membership rule.
MITRE ATT&CK: T1098.005 (Account Manipulation: Device Registration), T1556 (Modify Authentication Process)
Hardened before submission: switched TargetResources[0] positional indexing to mv-expand + type == "User" matching, consistent with the fix already applied to the Agent User group-membership rule.
MITRE ATT&CK: T1098.005 (Account Manipulation: Device Registration), T1556 (Modify Authentication Process)
Detects attempts by potentially malicious processes, such as web-browsing tools, scripts, or agents, to access the cloud instance metadata service (169.254.169.254) or associated metadata paths. This behavior is indicative of Server-Side Request Forgery (SSRF) exploitation aimed at stealing cloud instance credentials.
The following analytic detects the assignment of privileged Azure Active Directory roles to a user. It leverages Azure AD audit logs, specifically monitoring the "Add member to role" operation. This activity is significant as adversaries may assign privileged roles to compromised accounts to maintain persistence within the Azure AD environment. If confirmed malicious, this could allow attackers to escalate privileges, access sensitive information, and maintain long-term control over the Azure AD infrastructure.
The following analytic detects potential privilege escalation threats in Azure Active Directory (AD). This detection is important because it identifies instances where privileged roles that hold elevated permissions are assigned to service principals. This prevents unauthorized access or malicious activities, which occur when these non-human entities access Azure resources to exploit them. False positives might occur since administrators can legitimately assign privileged roles to service principals. This detection leverages the O365 Universal Audit Log data source.
This rule correlates phishing emails containing URLs with successful, MFA-satisfied sign-ins from an ASN or network location that has not been associated with the user account within the previous 30 days. This pattern is highly indicative of an Adversary-in-the-Middle (AiTM) session hijacking attempt, where a user is phished and their session cookie is intercepted by an attacker.
Detects modifications to domain federation settings in Microsoft Entra ID (formerly Azure AD) where a domain is converted from a managed authentication state to a federated authentication state. This type of configuration change is often used by adversaries to establish persistence or facilitate domain-level identity deception.
This rule detects anomalous sign-in behavior for Azure Service Principals by comparing current activity against a 14-day baseline. It alerts on sign-ins from new ASNs or countries, significant spikes in sign-in volume, or unauthorized access to sensitive resources such as Microsoft Graph, Exchange Online, or Azure Key Vault, while filtering out known cloud egress ranges.
Page 8 of 185