Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,733 detections
Filters
Last updated
All Time
Detection languages
909
387
164
127
68
Contributors
479
417
201
177
61
Categories
20,440
11,814
5,871
5,145
4,864
1,733
Platforms
822
436
329
274
206
Products / Services
498
378
118
96
79
MITRE Techniques
433
327
225
196
196
CVEs
12
12
10
10
6
IDS Classtypes
1
1
IDS Protocols
2
Detects high-volume file deletion or modification activity within sanctioned cloud storage applications, monitored via Netskope. This behavior is indicative of potential ransomware, malicious bulk data destruction, or an insider threat attempting to sabotage data.
Detects DLP policy violations flagged by Netskope when users upload, share, post, or send files within Slack or Microsoft Teams. This rule monitors for DLP profile matches which may indicate unauthorized exfiltration or exposure of sensitive data via collaboration tools.
KQL Query
This rule detects potentially malicious service principal activity by correlating the granting of sensitive app roles with subsequent spikes in sign-in volume. It monitors AuditLogs for 'Add app role assignment to service principal' events involving high-privilege roles, then joins this data with AADServicePrincipalSignInLogs to identify if the service principal experiences a sudden, significant increase in hourly sign-ins compared to its historical baseline within 24 hours of the permission change.
FortiGate Conserve Mode Activated
Cortex XDR
Detects system events on FortiGate devices indicating that the FortiOS has entered 'conserve mode'. This state occurs when the system experiences high memory pressure, potentially triggering resource-protection mechanisms that can impact traffic processing, security inspection, and overall firewall stability.
This rule detects the installation of a new VS Code extension occurring in close temporal proximity to network communication with the official VS Code marketplace or unpkg domains. This pattern is designed to surface potential supply chain compromises where malicious extensions may be deployed to developers' machines.
Detects Google Workspace bulk export/Takeout activity occurring shortly after an OAuth grant or app-password creation, or an unusual volume of export/download events, consistent with automated Gmail/Docs/Keep data exfiltration.
KQL Query
Detects high-risk user behavior associated with unsanctioned or restricted Generative AI applications, specifically targeting large data uploads (potential data exfiltration) or repeated access following a coaching intervention.
This rule detects Azure AD sign-in attempts to the 'OfficeHome' application resulting in error code 90014. This specific error indicates that the OAuth flow was initiated without the required nonce parameter, a behavior frequently observed when adversary-in-the-middle (AiTM) phishing kits relay authentication flows incorrectly. The rule highlights the significance of this error when correlated with implausible user-agent and operating system combinations.
Detects user activity involving unsanctioned or 'Shadow IT' applications that have a low or poor Cloud Confidence Index (CCI) rating, as reported by Netskope. This rule helps identify potential security risks associated with the use of unapproved or newly observed cloud services.
Detects when a user authorizes an OAuth application that requests high or critical permissions in a SaaS environment via Netskope logs. This pattern is commonly used in OAuth-based phishing campaigns or illicit application consent grants where adversaries attempt to gain persistent access to cloud resources.
This rule identifies devices with a high concentration (5 or more) of local AI agents reported within a 30-day period. This could indicate potentially unauthorized mass deployment or misconfiguration of AI agent software on specific endpoints.
This rule detects the installation of a new VS Code extension occurring in close temporal proximity to network communication with the official VS Code marketplace or unpkg domains. This pattern is designed to surface potential supply chain compromises where malicious extensions may be deployed to developers' machines.
Detects the installation of a Manifest V3 browser extension that requests the 'chrome.proxy' permission as its sole permission. This behavior is indicative of potential malicious extensions designed to modify web traffic or route browser activity through an adversary-controlled proxy server.
This rule detects potentially malicious AI prompt injection attempts targeting web-based AI assistants like Microsoft Copilot or Atlassian Rovo. It monitors CommonSecurityLog data for specific URL parameters (rovoChatPrompt, q, prompt) containing suspicious keywords (e.g., 'ignore', 'system', 'exfiltrate') or unusually long parameter values, which are indicators of efforts to bypass AI safety guardrails or perform data exfiltration via prompt manipulation.
Detects high-volume file deletion or modification activity within sanctioned cloud storage applications, monitored via Netskope. This behavior is indicative of potential ransomware, malicious bulk data destruction, or an insider threat attempting to sabotage data.
This rule monitors DeviceEvents for the presence of the 'Runtime.addBinding' JavaScript interface within process creation or network inspection logs. This pattern is commonly associated with WebView-based applications exposing internal browser-side objects to the web content, which can potentially be exploited for remote code execution or cross-site scripting (XSS) if not implemented with strict security constraints.
Detects OAuth application authorization events where the granted scopes include highly sensitive access such as Gmail, Drive, or Admin APIs. This rule identifies potential consent phishing attacks where users are tricked into granting malicious third-party applications broad, unauthorized access to their Google Workspace account. The rule excludes common, expected applications like Google Cloud SDK or standard Google services.
Detects mass revocation of OAuth tokens by a user, which may indicate an attacker cleaning up evidence after data extraction, or legitimate administrative incident response activity.
Detects the creation of a new inbox rule that performs email manipulation actions (forward, redirect, delete, move, or stop processing) shortly after a user account has logged in with a high or medium risk score, or an unusual result type. This pattern is commonly indicative of account compromise where an attacker establishes persistence or data exfiltration via mailbox rules.
Page 50 of 83