Catalogue
ATT&CK

Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Search detections

Filters

Loading detections…

Loading detections

The public catalogue of detection rules. Every entry carries its source, the identifier it had there, its licence and its ATT&CK mapping.

Product

Catalogue ATT&CK Create a workspace

Trust

Security Privacy Licences Terms

Contact

Report a vulnerability Report a content issue contacto@detections.app

Medium>Splunk security content

Windows Azure PowerShell Module Installation Via PowerShell Script

This analytic detects the installation of Azure AD and cloud management modules via PowerShell Script Block Logging. Tools such as AADInternals, AzureAD, MSOnline, and Az.Resources provide deep access to Azure Active Directory objects, user accounts, service principals, and tenant configurations making them high-value targets for adversaries conducting reconnaissance, privilege escalation, or persistence operations post-compromise.

ATT&CK coverage

Initial Access

T1078Valid AccountsAlso under Persistence, Privilege Escalation, and Stealth.291 detections cover this technique

Persistence

T1098Account ManipulationAlso under Privilege Escalation.230 detections cover this technique
T1136Create Account
- T1136.003Cloud Account 33 detections cover this technique

Discovery

T1069Permission Groups Discovery
- T1069.003Cloud Groups 13 detections cover this technique

Lateral Movement

T1021Remote Services
- T1021.007Cloud Services 12 detections cover this technique

Detection requirements

Log source category: powershell_script_block_logging_4104

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.

Provenance

Where this detection came from, and what you may do with it.

At source: Open at source
Written by: Raven Tait
Splunk
Licence: Apache-2.0Read the licence
Published: Aug 26, 2026
Version: 1