Detection rule library
Every rule the KIROSEC analyzer runs — 329 of them, mapped to 184 MITRE ATT&CK techniques across Windows, Linux, macOS, cloud identity, network and web-server logs. Each page explains what the rule looks for, how to triage a hit and where false positives come from, and shows the rule itself. The rules are plain YAML, published under the Apache License 2.0; the rules adapted from SigmaHQ keep the Detection Rule License 1.1 and credit their authors.
329 rules.
Windows · 111
An executable was written to this host over an administrative share (
ADMIN$,C$).A database engine process started a command shell or interpreter.
A directory-service replication request (Event ID 4662) invoking the DS-Replication-Get-Changes rights — a "DCSync" attack.
A local account whose name ends in
$was created in the SAM.appcmd.exewas used to read IIS credentials out of the server configuration.A signed Microsoft diagnostic tool used to write another process's memory to disk.
A value under
HKLM\SECURITY\Policy\Secretswas read or written.A process opened a handle to lsass.exe with credential-read access rights (Sysmon ProcessAccess, Event ID 10, TargetImage lsass.exe with a GrantedAccess…
Detects LSASS memory dumping for offline credential extraction — the comsvcs.dll MiniDump export, procdump against lsass, or known dumpers…
A process obtained a handle to LSASS, recorded by Windows object-access auditing (4656 request / 4663 use) rather than by Sysmon.
A PowerShell script block containing the API calls or tool names used to extract credentials from memory.
An RDP session was authenticated from a LOOPBACK address (
127.0.0.1/::1).A thread was created inside another process, and the target is one of the processes attackers habitually inject into.
regsvr32 /i:<url>— the "Squiblydoo" technique. regsvr32 fetches a remote COM scriptlet and executes the script inside it, so code runs from a URL with…Detects the Security event log being cleared (1102).
Detects destruction of recovery data — Volume Shadow Copies, system-state backups, or the Windows recovery environment (vssadmin / wmic shadowcopy…
An SSH client was run with port-forwarding flags — a tunnel that carries traffic the network is not supposed to see.
A binary carrying the NAME of a Windows system executable ran from somewhere other than a real system directory.
The DLL backing a core Windows service was repointed in the registry.
A process opened a handle to another process, and the call came from memory that is NOT backed by any file on disk (
CallTrace=UNKNOWN(0x…)).A web-server worker process opened a connection to a remote-administration or file-sharing service.
wmic ... /format:<url>— XSL script processing.Detects a member being added to the local Administrators group (Security 4732 for the built-in Administrators SID).
A remote client opened one of the named pipes over
IPC$that grant control of the machine rather than access to data.A Kerberos authentication-service (TGT) request (Event ID 4768) for an account that does NOT require pre-authentication (Pre-Authentication Type 0x0).
An auto-elevating Windows binary is the PARENT of an interpreter or proxy-execution host.
A built-in Windows component that runs elevated without prompting was invoked with attacker-supplied input.
A registry value that Windows itself consults to decide what code to load was written.
Disabling Windows recovery with bcdedit — common ransomware precursor
Flags activity matching the SigmaHQ rule “Certutil Download / Decode” — MITRE ATT&CK T1105, Ingress Tool Transfer.
cmstp.exeinstalling a connection-manager profile from a caller-supplied INF or INI file.A COM class was redefined in the per-user registry.
A Control Panel applet (
.cpl) executed from a user-writable directory.Procdump against LSASS, or Mimikatz-style command lines — credential theft
Procdump against LSASS, or Mimikatz-style command lines — credential theft
Adding a Microsoft Defender exclusion — security-tool tampering
Detects Microsoft Defender protection being disabled or degraded (Defender Operational 5001/5010/5012/5013, normalized to security_tool_disabled).
Detects PowerShell download-cradle patterns (web download primitives inside a command line or script block) used to pull second-stage payloads.
The Directory Services Restore Mode (DSRM) administrator password was changed on a domain controller — Security event 4794.
Detects PowerShell executing with an -EncodedCommand argument, which is frequently used to obfuscate malicious scripts.
Flags activity matching the SigmaHQ rule “Encoded PowerShell Command” — MITRE ATT&CK T1059.001, Command and Scripting Interpreter: PowerShell.
Detects a burst of failed Windows logons (Security 4625) against one account from one source address within a short window — brute force or password…
A thread was created inside
KeePass.exefrom another process — Sysmon event 8 with KeePass as the target.A burst of Kerberos service-ticket requests (Event ID 4769) using RC4-HMAC encryption (Ticket Encryption Type 0x17).
One account requesting RC4-HMAC (Ticket Encryption Type 0x17) Kerberos service tickets (Event ID 4769) for many DISTINCT services in a short window.
A driver service was registered in the registry — an
ImagePathwritten underCurrentControlSet\Servicespointing at a.sysfile.Windows recorded a boot configuration that weakens kernel code integrity.
Adding an account to the local Administrators group — privilege abuse
A signed Microsoft utility used as a launcher for an arbitrary program, so the real payload runs as that utility's child instead of appearing on its own.
Detects living-off-the-land download/execution: certutil URL cache download, bitsadmin transfer, or mshta pulling a remote/script payload — signed…
A connection was made to the
\lsassnamed pipe.A single process deleted a large number of files in a short window (Sysmon FileDelete, Event ID 23/26).
Flags activity matching the SigmaHQ rule “Mshta Remote Payload” — MITRE ATT&CK T1218.005, System Binary Proxy Execution: Mshta.
Repeated SQL Server login failures in a short window — a password-guessing attack against the database rather than against Windows.
SQL Server logged configuration event 15457 for
xp_cmdshell— the server-level option that lets a database session run operating-system commands as the…Configuring a netsh portproxy tunnel — lateral movement / pivot
netsh interface portproxyturns a compromised host into a relay: traffic arriving on a listening port is forwarded to an address the attacker could not…A PowerShell command in the CLASSIC
Windows PowerShellchannel built out of concatenated string fragments —&('ne'+'w-'+'item'),('h'+'ttp')…A PowerShell script block that decompresses or decodes a payload and executes it directly from memory.
Odbcconf executing a response file / registering a DLL — LOLBIN
Word/Excel/PowerPoint spawning a shell or scripting host — macro execution
Detects an Office application spawning a script/shell engine — the classic maldoc macro execution chain (document → PowerShell/cmd/wscript).
PowerShell in-memory download cradle (Net.WebClient / IEX)
Remote execution as SYSTEM via PsExec service install
A burst of security-group membership modifications on one host in a short window — members added (Security 4732 local / 4728 global / 4756 universal) or…
Flags activity matching the SigmaHQ rule “Registry SAM Hive Dump via reg save” — MITRE ATT&CK T1003.002, OS Credential Dumping: Security Account Manager.
Regsvr32 loading a remote/COM scriptlet (Squiblydoo)
A process running from a scratch / user-writable directory created a thread in ANOTHER process (Sysmon CreateRemoteThread, Event ID 8).
Detects a value being written under a CurrentVersion\Run / RunOnce registry key (Sysmon 13) — autostart persistence that survives reboots.
Flags activity matching the SigmaHQ rule “Rundll32 JavaScript Execution” — MITRE ATT&CK T1218.011, System Binary Proxy Execution: Rundll32.
A signed Microsoft DLL invoked through its documented export purely to launch something else.
A value inside the SAM registry hive was written directly.
The SAME scheduled task is registered and then deleted within a short window (Security 4698 then 4699 for one task name).
A registry value that governs a host's own security controls was written.
A named endpoint-security service was STOPPED (Service Control Manager 7036 transitioning to the Stopped state).
Flags activity matching the SigmaHQ rule “Shadow Copy Deletion via vssadmin” — MITRE ATT&CK T1490, Inhibit System Recovery.
An executable or script was written into a Startup folder.
A named pipe was created or connected whose name matches a known lateral-movement tool or C2 framework (Sysmon Event ID 17/18).
A program was executed directly from
\\tsclient\— the virtual share that maps the drives of the machine on the OTHER end of an RDP session.A per-user registry hijack of a shell "open" handler that an auto-elevating Windows binary consults.
An UNSIGNED module (DLL) was loaded from a scratch / user-writable directory (Sysmon ImageLoad, Event ID 7, with Signed=false or a non-Valid…
Deleting the NTFS USN change journal — anti-forensics
Flags activity matching the SigmaHQ rule “Windows Event Log Cleared via wevtutil” — MITRE ATT&CK T1070.001, Indicator Removal: Clear Windows Event Logs.
A process was launched by a WinRM host process, meaning someone executed a command on this machine remotely over WS-Management.
A WMI permanent event subscription was established — a consumer registered (Sysmon 20, which carries the command/script it will run) or a…
Detects WMI process creation via
wmic ... process call create, commonly used for local or remote (/node:) execution and lateral movement.wusa.exe /extract:unpacking a cabinet into a protected system directory. wusa is auto-elevating, and its/extractmode writes wherever it is told…Active Directory reconnaissance from the command line — enumerating domain admins, trusts, users, or running an AD-mapping tool (BloodHound / SharpHound…
Detects data being collected into an archive prior to exfiltration — password-protected or maximum-compression RAR / 7-Zip / WinRAR archives, or…
attrib +hmarking a file or directory hidden.A Background Intelligent Transfer Service job was created by a USER account rather than by the system.
Flags activity matching the SigmaHQ rule “BITSAdmin Transfer” — MITRE ATT&CK T1197, BITS Jobs.
Detects PowerShell launched with a hidden window (-WindowStyle Hidden / -w hidden), a common way to keep malicious execution invisible to the logged-on…
Flags activity matching the SigmaHQ rule “Net Local Account Creation” — MITRE ATT&CK T1136.001, Create Account: Local Account.
A new SMB share was defined on this host (
LanmanServer\Shares\<name>).Flags activity matching the SigmaHQ rule “Nltest Domain Enumeration” — MITRE ATT&CK T1482, Domain Trust Discovery.
A network logon (Security 4624, Logon Type 3) authenticated with NTLM rather than Kerberos.
The membership of a privileged local group was enumerated (Windows 4799), or an account's group memberships were listed (4798).
Detects an interactive RDP logon (Security 4624 with LogonType 10, normalized to event_action remote_login).
Autorun persistence written to a Run key with reg.exe
Flags a removable storage / external device being recognized on the host (Security 6416, and the plug-and-play device disable/enable audit events…
Flags execution of remote-access / RMM tools (AnyDesk, TeamViewer, ScreenConnect, Atera, Splashtop, LogMeIn, Ammyy).
Detects Windows Firewall rule additions/modifications (Security 4946/4947).
Detects creation of a scheduled task (Security 4698).
Flags activity matching the SigmaHQ rule “Scheduled Task Creation via schtasks” — MITRE ATT&CK T1053.005, Scheduled Task/Job: Scheduled Task.
Detects installation of a new Windows service (Security 4697 / System 7045).
Detects creation of a local account (Security 4720).
Flags activity matching the SigmaHQ rule “Whoami Execution” — MITRE ATT&CK T1033, System Owner/User Discovery.
Process creation via wmic process call create — LOLBIN execution
A successful Windows logon (Security 4624).
A remote client opened one of the named pipes used to enumerate a host: who is logged on, what is shared, and which accounts exist. *
\srvsvc…
Linux · 26
A command was run whose purpose is to make data unrecoverable rather than merely to delete it.
Detects interactive reverse-shell primitives — /dev/tcp redirection, netcat -e, or a mkfifo named-pipe backpipe — used to hand an attacker an interactive…
An interactive reverse shell executed on Linux (bash /dev/tcp,
nc -e, or a Python socket one-liner) — attacker-controlled remote command execution.The Linux audit daemon reported that it was terminating or aborting.
Detects repeated SSH authentication failures from a single source IP against one user within a short window.
Detects cron-based persistence — a job written into a system cron location (/etc/cron.*, /etc/crontab, /var/spool/cron).
/etc/doas.confwas created or replaced.A kernel module was loaded or unloaded (
insmod,modprobe,rmmod)./etc/ld.so.preloadwas created or replaced.Curl/wget piped to a shell or a chmod+x in /tmp — staging payloads
A systemd unit that provides logging, endpoint monitoring, or host firewalling was stopped.
Access to a sensitive credential file — /etc/shadow, an SSH private key (id_rsa/id_ed25519), or cloud credentials (~/.aws/credentials) — a credential…
The setuid bit set on a file (
chmod u+sorchmod 4xxx) — creating a SUID binary that runs with the owner's privileges, used for privilege escalation…An SSH
authorized_keysfile was CREATED or DELETED.An SSH configuration file under /etc/ssh was created or replaced.
A change to the sudoers policy (/etc/sudoers or /etc/sudoers.d/*) — granting or modifying sudo privileges, a classic privilege-escalation-persistence move.
A new or modified systemd service unit — a common Linux persistence mechanism.
The
atcommand was run — scheduling a command to execute once, later.A filesystem search tool (
find,grep,locate,rg,ag) was run against patterns that only make sense if the goal is credentials: private-key…A file's permissions or extended attributes were changed in one of the two ways attackers use them: *
chattr +i/chattr -i— the immutable attribute.Shell history cleared or diverted to hide activity —
history -c, unsetting HISTFILE, or symlinking a history file to /dev/null.A process was launched with
LD_PRELOADset on the command line, forcing a shared library into that process ahead of its own.A shell startup file was created or replaced — a user's
.bashrc,.bash_profile,.profile,.zshrc,.zshenvor.bash_logout, a system-wide…Repeated failed sudo attempts on one host in a short window — password guessing to escalate to root, or a foothold account probing which commands it can…
Detects local account creation (useradd / adduser / newusers).
A successful SSH logon ("Accepted password/publickey").
macOS · 11
An existing macOS account was granted local administrator rights, or a new account was created already holding them.
Detects a remote script piped straight into a shell (curl/wget ... | sh|bash|zsh) — a one-liner download-and-execute that runs attacker-controlled code…
DYLD_INSERT_LIBRARIESset, forcing the dynamic linker to load an attacker's dylib into processes it launches — macOS's equivalent ofLD_PRELOADon…Gatekeeper disabled via spctl (--master-disable / --global-disable), removing macOS code-signing enforcement so unsigned/quarantined apps run without…
The macOS
securitycommand used to read secrets out of a keychain — either dumping a whole keychain (dump-keychain -d) or extracting a specific…A LaunchAgent/LaunchDaemon whose program runs from a world-writable or temp location (/tmp, /var/tmp, /private/tmp, /Users/Shared) or launches…
AppleScript (osascript) used for shell execution, privilege escalation, or keystroke injection — a common macOS living-off-the-land execution technique.
Remote access enabled on macOS: Remote Login (SSH) via systemsetup, or Apple Remote Desktop / screen sharing activated via kickstart — remote-control…
Detects creation of a LaunchAgent/LaunchDaemon in a user- or admin-writable location, a common macOS persistence mechanism.
The com.apple.quarantine extended attribute removed via xattr, stripping the macOS download provenance flag so Gatekeeper stops vetting a downloaded file.
Inventory signal: a LaunchAgent/LaunchDaemon item was imported.
Cloud & SaaS · 165
A managed-disk snapshot was created, or a download URL was issued for one.
A burst of secret, key or certificate reads from an Azure Key Vault.
A private endpoint or a storage/SQL network restriction was removed.
An identity is marked
confirmedCompromisedin Microsoft Entra ID Protection.A cross-tenant access or synchronization relationship with another Entra tenant was created or modified.
One address or session presented SEVERAL DIFFERENT Primary Refresh Tokens interactively — the signature of a host replaying a harvested collection of…
A Primary Refresh Token that had been failing interactively then SUCCEEDED from the same source — the moment a replayed token got through.
An account kept working after its sessions were revoked.
A Conditional Access policy's SIGN-IN FREQUENCY was changed.
Microsoft found a SERVICE PRINCIPAL's credential published somewhere public and the detection is still open.
A Google Workspace administrator removed an account's second factor.
Two multi-factor challenges refused, then one accepted, for the same account.
The
ApplicationImpersonationrole was assigned in Exchange Online.A tenant domain's authentication or federation settings were changed, or a new domain was added (Set domain authentication / Set federation settings /…
A compliance search action was run with a PURGE — evidence deleted across every mailbox the search matched, in one command.
A native Exchange mailbox export was started — an entire mailbox written out as a
.pstto a file share or blob container.Several directory accounts deleted by one actor in a short window.
An outbound Exchange connector was created or modified — mail flow itself re-pointed at an external host.
An inbox rule was created that hides incoming mail from PAYMENT or CONTRACT senders — QuickBooks, DocuSign, Adobe Sign, BILL, Xero and the like.
An eDiscovery search export was DOWNLOADED — the results of a search pulled out of the tenant as one archive.
A custom transport agent was installed or enabled on Exchange.
Detects when a new credential is added to an existing application.
Detects when an application is granted delegated or app role permissions for Microsoft Graph, Exchange, Sharepoint, or Azure AD
Detects when administrator grants either application permissions (app roles) or highly privileged delegated permissions
Detects when a configuration change is made to an applications AppID URI.
Detects when a configuration change is made to an applications URI.
AWS CloudTrail logging was stopped or a trail was deleted/reconfigured to narrow its scope.
Repeated failed AWS console sign-ins for one identity.
A change to AWS IAM that can grant or persist elevated access — attaching a policy, adding a user to a group, creating a new access key, or creating a…
An EBS snapshot, AMI, or RDS snapshot had its sharing attribute modified — made public, or shared with another AWS account.
Direct use of the AWS account root identity.
An S3 bucket was made (or allowed to become) publicly accessible — a bucket policy/ACL change or the removal of a public-access block.
An AWS security or logging service was torn down — a GuardDuty detector, a WAF web ACL or IP set, a CloudWatch log group or stream, a Config rule, or an…
An Azure Automation runbook or webhook was created or modified.
Detects when a user is removed from a privileged role.
Detects when changes are made to PIM roles
Detects when highly privileged delegated permissions are granted on behalf of all users
An owner was added to an Entra ID application or service principal.
A directory role DEFINITION was created or changed — the permissions a role carries, rather than who holds it.
A Microsoft Entra ID sign-in that used the OAuth 2.0 **device authorization grant** (
authenticationProtocol=deviceCode).A device was registered or enrolled against a user account.
A FEDERATED IDENTITY CREDENTIAL was added to an Entra application or service principal — workload identity federation, which lets an EXTERNAL issuer mint…
A GUEST identity changed its own authentication method — a new phone number or authenticator registration on an account whose home is another tenant.
A GUEST account was converted to a full MEMBER of the tenant (
UserTypeGuest → Member).A user's IMMUTABLE ID / SourceAnchor was set or changed — the value that binds a cloud account to an on-premises identity.
A cloud sign-in whose client string names a known directory-enumeration tool — AzureHound, ROADrecon, AADInternals and the like.
A single source IP producing many "invalid username or password" (error 50126) Entra ID sign-in failures within an hour — the low-and-slow pattern of…
The SAME Primary Refresh Token was presented interactively over and over from one source and kept failing — a stolen token being retried against…
A Microsoft Entra sign-in that Identity Protection rated risky, or that carries a named risk detection.
One session appearing from two countries inside an hour.
One session presenting more than one device identity.
Repeated failed cloud sign-ins from one source IP against a single user within a short window — brute force or password guessing against cloud identity.
Multi-factor authentication was turned off for an Entra ID account ("Disable Strong Authentication"), or the per-user MFA requirement was cleared.
A Temporary Access Pass (TAP) was created for an Entra ID account.
One session that starts as a person in a browser and, moments later, continues as a machine redeeming a refresh token.
Microsoft Entra ID Protection has an OPEN risk detection against a SERVICE PRINCIPAL — an application or automation identity, not a person.
Google Workspace 2-step verification was turned off for an account (a
2sv_disablelogin event, or an admin enforcement change).A Google Workspace administrator privilege or admin role was granted to a user.
An account's MFA / 2-step verification was disabled and then that SAME account signed in successfully within the hour - the classic takeover ordering…
A directory role member was added in Microsoft Entra ID / Microsoft 365 ("Add member to role").
A Copilot or Power Platform agent was created or modified.
A credential (client secret or certificate) was added to a Microsoft Entra application or service principal ("Add service principal credentials."…
One identity read items from MANY DIFFERENT mailboxes through the API in a short window —
MailItemsAccessedrecords whose client is REST/Graph or…An application registration's REQUESTED permissions changed to include app-only access to Exchange Online, Microsoft Graph or SharePoint Online.
Microsoft 365 unified audit logging was turned off (Set-AdminAuditLogConfig with UnifiedAuditLogIngestionEnabled = False, or a mailbox audit bypass).
A multi-factor authentication method / security info was registered or changed for an account.
A named account was granted read rights on someone's CALENDAR or CONTACTS.
A burst of collaboration invitations / mentions / comment notifications sent from one mailbox — the propagation phase of a business email compromise.
A Microsoft Entra Conditional Access policy (or strong-authentication / security-defaults setting) was created, changed, removed, or disabled.
Repeated sign-in failures for ONE account from many addresses inside a single network prefix, over days rather than minutes.
An OAuth application was consented to (or granted) HIGH-PRIVILEGE Microsoft Graph permissions — mailbox, files, or directory read/write, or app-only…
A soft-deleted or inactive mailbox was restored, or its contents merged into another mailbox.
A Microsoft 365 mailbox inbox rule (New-InboxRule / Set-InboxRule) that forwards, redirects, or auto-deletes mail.
A legacy mail protocol (IMAP or POP) was ENABLED on a mailbox (Set-CASMailbox ImapEnabled/PopEnabled = true).
A tenant mailbox sent mail carrying a document- or credential-shaped subject to a CONSUMER mail provider, and it was delivered.
One mailbox sent to an unusual number of DISTINCT recipients in a short window.
A message was written straight into a mailbox folder — Drafts, Sent Items or similar — rather than arriving through mail flow.
A mailbox's audit RETENTION was changed with
Set-Mailbox -AuditLogAgeLimit.A Microsoft 365 mailbox delegate-permission grant (Add-MailboxPermission) giving a principal FullAccess or Send-As on another user's mailbox.
A mailbox folder was granted read or write access for a BROAD principal —
Everyone,AnonymousorDefault— rather than a named person.A Microsoft 365 mailbox inbox rule (UpdateInboxRules / New-InboxRule / Set-InboxRule) whose actions delete, permanently delete, mark-as-read, move, or…
A burst of mailbox message purges (SoftDelete / HardDelete) from one account in a short window.
A mailbox's data RESIDENCY was changed —
PreferredDataLocationorRemoteRoutingAddressaltered, or the mailbox moved outright.A mailbox or compliance search was created or modified whose terms read like reconnaissance for valuable mail rather than an investigation. eDiscovery is…
Activity involving a Microsoft 365 OAuth application that is commonly abused in business-email-compromise and consent-phishing (e.g. eM Client…
A burst of multi-factor authentication challenges / denials for one account — the shape of MFA fatigue ("push bombing"), where an attacker who already…
The tenant's multi-factor authentication policy was rewritten (
Set Company InformationchangingStrongAuthenticationPolicy).A Microsoft Entra ID / Microsoft 365 OAuth application consent or permission grant ("Consent to application.", "Add OAuth2PermissionGrant.", "Add…
MANY DIFFERENT accounts failing to sign in from ONE address — password spray, as it appears in the Unified Audit Log.
A Power Automate flow was created, modified or shared in a way that can move mail out of a mailbox.
A Microsoft Purview data-protection or retention policy was disabled, removed or weakened.
A run of mail moved out of folders whose NAME says the contents are financial or legal — payroll, contracts, vendors, investments, month-end statements.
A service principal / enterprise application was added, or an app was granted a directory role or delegated permission, in Microsoft Entra ID.
Mailbox-level SMTP auto-forwarding was configured (Set-Mailbox / Set-RemoteMailbox with ForwardingSmtpAddress or ForwardingAddress).
Executable or archive files uploaded into Teams repeatedly by one account.
A Microsoft 365 org-wide Exchange transport (mail-flow) rule (New-TransportRule / Set-TransportRule) that blind-copies, forwards, or redirects mail.
An EXISTING mail-flow rule was reordered or short-circuited — a
Set-TransportRulethat changesPriorityorStopRuleProcessing.The tenant's authorization policy was changed so ORDINARY USERS may consent to applications (
PermissionGrantPolicyIdsAssignedToDefaultUserRolegaining…An Okta administrator role was granted to a user or group.
An Okta API token was created (
system.api_token.create).An Okta inbound identity provider was created, activated, deactivated or deleted (
system.idp.lifecycle.*).An Okta multifactor authentication factor was deactivated or reset.
Okta sent a burst of verification pushes to one account.
An Okta sign-on / MFA / password policy or rule was deactivated or deleted.
One Okta account evaluated from two different addresses within minutes.
Okta ThreatInsight blocked or flagged a request it judged malicious (
security.threat.detected).An end user reported activity on their own account as suspicious (
user.account.report_suspicious_activity_by_enduser).Detects when PIM alerts are set to disabled.
Detects when a PIM elevation is approved or denied.
One account authenticating successfully from an unusually large number of DISTINCT source IPs in a short window - a strong account-takeover /…
Detects when a user is added to a privileged role.
Detects when a new owner is added to an application.
Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments.
Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to…
Repeated
GetPasswordDatacalls — the API that returns the encrypted local Administrator password for a Windows EC2 instance.A single identity called KMS
DecryptorGenerateDataKeyrepeatedly in a short window.The code or configuration of a Lambda function was replaced.
A VPC network ACL or its entries were created, replaced or deleted.
An RDS database instance or cluster was modified, which is the API that also resets the master user password and can make an instance publicly accessible.
Identifies when a device or device configuration in azure is modified or deleted.
Third-party marketplace terms were accepted, or a marketplace image was programmatically enabled for deployment.
Monitor and alert on conditional access changes where non approved actor removed CA Policy.
Monitor and alert on conditional access changes.
An administrator reset another account's password, or re-enabled a disabled account, in Entra ID.
A user was shown an OAuth consent prompt for an application and DECLINED it (Entra sign-in error
65004— "User declined to consent to access the app").Repeated Microsoft Graph reads of directory objects from one identity — the shape of a tenant being enumerated rather than used.
A successful Entra ID sign-in over a legacy / basic-authentication client (IMAP4, POP3, SMTP, MAPI, Exchange ActiveSync, "Other clients").
Microsoft Entra ID Protection raised a risk detection against an account and it is still OPEN (
riskState: atRisk) — nobody has dismissed it, remediated…A human user account authenticating through a scripting client — python-requests, curl, a bare HTTP library — rather than a browser or a mail client.
A custom security attribute was set or changed on a directory object.
Google Workspace flagged a login as suspicious (Google's own risk engine set
is_suspicious=true, or asuspicious_login/ out-of-domain…A new Google Workspace user account was created.
Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.
A member was removed from a directory role.
An APP ROLE ASSIGNMENT was granted — a user or a service principal was given a role on an enterprise application.
A user's Microsoft 365 licence was changed ("Change user license").
A Microsoft 365 content / eDiscovery / audit search was created or exported (Security & Compliance Center).
A SharePoint / OneDrive anonymous or external sharing link was created.
An external (guest / B2B) user was invited to the tenant.
Any Microsoft 365 mailbox inbox rule was created, modified, removed, enabled, or disabled (New-InboxRule / Set-InboxRule / UpdateInboxRules /…
A mailbox was accessed over a legacy / non-interactive mail protocol — IMAP4, POP3, or Exchange Web Services (EWS).
A message whose subject carries a MONEY or CREDENTIAL instruction was delivered to a mailbox — it was not quarantined, not filtered, it landed.
A burst of Microsoft 365 mailbox-item access (MailItemsAccessed / AttachmentAccess) against one mailbox from one client IP in a short window.
A burst of folder-level mailbox syncs (MailItemsAccessed with MailAccessType=Sync) from one client.
A burst of SharePoint / OneDrive file downloads or a full sync from one account in a short window — the shape of bulk collection / exfiltration after…
Microsoft's own security tooling (Defender for Office 365 / Microsoft Purview / Cloud App Security) raised an alert that is recorded in the Unified Audit…
A burst of user phishing reports (UserSubmission) in a short window.
Repeated SharePoint or OneDrive file access from a scripted client — a PowerShell, curl, python or bare-SDK user agent rather than a browser or the sync…
A RUN of send-as / send-on-behalf activity by one account in a short window — the takeover signal, as opposed to the single delegated send an assistant…
A SharePoint, OneDrive or Exchange search for terms that name credentials, payment details or regulated data.
One participant joining and leaving a Teams meeting repeatedly in a short window.
Monitor and alert on conditional access changes.
Number of VM creations or deployment activities occur in Azure via the azureactivity log.
Several Okta accounts locked out in a short window (
user.account.lock).An Okta authentication event where Okta's security context flagged the client as coming through an anonymizing proxy or Tor.
A new device was enrolled against an Okta account (
device.enrollment.create).An attempt to reach an Okta-managed application the account is not assigned to (
app.generic.unauth_app_access_attempt).Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.
A burst of sign-in errors from ONE ADDRESS, counted without needing to know who they were for.
One account signing in behind MANY DIFFERENT client strings in a short window.
Monitor and alert on group membership additions of groups that have CA policy modification access
An account signed in from a source IP never seen for that account during the case's learning window (the first 7 days of its data).
Monitor and alert on group membership removal of groups that have CA policy modification access
Mail was sent as, or on behalf of, another mailbox (Exchange SendAs / SendOnBehalf).
A successful cloud identity sign-in (Entra ID / Azure AD, Exchange Online, and other application-platform authentication sources).
Network · 3
A DNS query whose name carries a very long, high-entropy label — the shape of DNS tunneling / DGA, where data or C2 traffic is smuggled inside DNS…
One source address was denied against many DIFFERENT destination hosts in a short window — a host sweep, the other half of network reconnaissance.
One source address was denied against many DIFFERENT destination ports in a short window — the shape of a port scan or service sweep.
Web servers · 4
Flags a web-application attack that the server did NOT reject — an injection, traversal, web-shell, or Log4Shell request that returned a 2xx or a 5xx…
Detects web-application attack patterns in HTTP request logs — SQL injection, cross-site scripting (XSS), path traversal / local file inclusion…
Detects a burst of failed HTTP requests (4xx/5xx) from one client IP in a short window — the signature of web vulnerability scanning, directory / file…
Flags HTTP requests to sensitive files or administrative endpoints — secrets and VCS/config files (.env, .git, .aws, .ssh, config.php), admin panels…
Cross-platform · 9
Many DISTINCT accounts failed authentication across the tenant in a short window — a password spray, counted the only way a spray can be counted.
Flags the presence or execution of known offensive tooling (SharpHound, Mimikatz, Rubeus, Impacket, Cobalt Strike, ...) catalogued in the threat…
A security / audit log was cleared, in ANY log format.
Flags anonymizing-proxy / monitoring-circumvention tools on a managed endpoint — Tor, Psiphon, Ultrasurf, Hotspot Shield, or a SOCKS proxy to the Tor…
Flags data transfer to personal cloud storage or anonymous file-sharing services (mega.nz, WeTransfer, anonfiles, gofile, transfer.sh, file.io, 0x0.st…
Flags tooling that adversaries lean on heavily but that administrators also run legitimately every day: bulk copy/exfil utilities (rclone)…
A burst of failed authentication from a single source IP, in ANY log format.
A new user account was created, in ANY log format.
Flags a network connection to a port strongly associated with offensive C2 frameworks, backdoors, or covert tunnels (Metasploit 4444/4445, common…