Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,733 detections
Filters
Last updated
All Time
Detection languages
909
387
164
127
68
Contributors
479
417
201
177
61
Categories
20,440
11,814
5,871
5,145
4,864
1,733
Platforms
822
436
329
274
206
Products / Services
498
378
118
96
79
MITRE Techniques
433
327
225
196
196
CVEs
12
12
10
10
6
IDS Classtypes
1
1
IDS Protocols
2
Detects a Google Workspace OAuth application grant and application-specific password issuance occurring within 30 minutes of a suspicious/AiTM-flagged sign-in, indicating Gmail account takeover.
This rule identifies accounts (by SID) that have registered multiple local AI agent instances. It aggregates agent registration information over a 30-day period, summarizing the total count of agents and listing specific device names and IDs associated with each account to identify potential anomalous behavior, such as credential abuse or unauthorized mass deployment of local AI tools.
Detects inbound voice calls that spoof corporate helpdesk numbers. The rule triggers when an incoming call from an external/PSTN trunk matches a known helpdesk number and exhibits signs of spoofing, specifically either a mismatch between the current call's carrier and historical baseline carrier for that number, or a report by the recipient that the call was suspicious.
Detects invocation of the Hermes Agent 'godmode' LLM jailbreaking skill — the literal string 'godmode' appearing in application messages or commands together with agent/skill/jailbreak/red-team context, or an explicit 'godmode' skill name — indicating an attempt to bypass an LLM's built-in safety controls for autonomous offensive tasking.
This rule detects potential mass data retrieval or excessive access to sensitive-labeled files by an individual user through Microsoft Copilot within a one-hour window. By monitoring the volume of distinct sensitivity-labeled objects accessed, it identifies behavior consistent with a user or compromised account performing high-volume information gathering.
This rule identifies accounts (by SID) that have registered multiple local AI agent instances. It aggregates agent registration information over a 30-day period, summarizing the total count of agents and listing specific device names and IDs associated with each account to identify potential anomalous behavior, such as credential abuse or unauthorized mass deployment of local AI tools.
This rule identifies devices with a high concentration (5 or more) of local AI agents reported within a 30-day period. This could indicate potentially unauthorized mass deployment or misconfiguration of AI agent software on specific endpoints.
This rule detects potentially malicious AI prompt injection attempts targeting web-based AI assistants like Microsoft Copilot or Atlassian Rovo. It monitors CommonSecurityLog data for specific URL parameters (rovoChatPrompt, q, prompt) containing suspicious keywords (e.g., 'ignore', 'system', 'exfiltrate') or unusually long parameter values, which are indicators of efforts to bypass AI safety guardrails or perform data exfiltration via prompt manipulation.
This rule detects instances where a user grants an OAuth application consent to perform sensitive actions in an Azure AD environment. It specifically filters for high-risk scopes (such as Mail.Read, Files.ReadWrite, or Directory.ReadWrite) granted to applications with publishers other than Microsoft Corporation, which is often indicative of OAuth consent phishing attacks or malicious application integration.
Detects the creation of a new inbox rule that performs email manipulation actions (forward, redirect, delete, move, or stop processing) shortly after a user account has logged in with a high or medium risk score, or an unusual result type. This pattern is commonly indicative of account compromise where an attacker establishes persistence or data exfiltration via mailbox rules.
This rule detects instances where a user grants an OAuth application consent to perform sensitive actions in an Azure AD environment. It specifically filters for high-risk scopes (such as Mail.Read, Files.ReadWrite, or Directory.ReadWrite) granted to applications with publishers other than Microsoft Corporation, which is often indicative of OAuth consent phishing attacks or malicious application integration.
This rule detects potential mass email access or collection activities by an application (AppId). It monitors Microsoft 365 CloudAppEvents for actions like 'MailItemsAccessed', 'Send', or 'New-InboxRule' associated with an application. It triggers an alert when a single application interacts with 10 or more distinct mailboxes within a one-hour window, which is indicative of potential Business Email Compromise (BEC) or unauthorized mass data exfiltration via compromised OAuth applications.
Detects unauthorized remote access sessions within N-able N-central by monitoring the Windows Application log for events indicating usage of the default 'MSP Support' account or source IP addresses associated with active exploitation of CVE-2026-18577.
Detects anomalous OAuth application authorization behavior by a user, specifically monitoring for a spike in authorization events within a short timeframe. This activity is often indicative of consent phishing campaigns where an adversary tricks a user into granting excessive application permissions to a malicious OAuth app, or a compromised account performing bulk authorization grants.
This rule detects instances where a user enters a protected password into an application that has not been configured or registered for SSO (Single Sign-On). It achieves this by identifying 'Protected password entered' events and using a join-anti operation to filter out sessions where an 'SSO_PASSWORD_USED' event was previously recorded for the same user and domain.
This rule detects the presence of Android applications, packages, or signals related to root-based SSL unpinning modules (e.g., JustTrustMe, TrustMeAlready, MagiskTrustUserCerts) or instrumentation frameworks (Xposed, LSPosed) when associated with Magisk or Shamiko root management tools. These tools are commonly used by adversaries to bypass SSL certificate validation on compromised or rooted Android devices, allowing for man-in-the-middle (MITM) attacks against network traffic.
This rule detects activities indicative of Android APK repackaging and the manual injection of the Frida-gadget library to bypass security controls like SSL pinning. It monitors for the use of APK patching tools followed by ADB installation commands, the installation of specific patched APK names, the presence of the Frida-gadget shared library file, and system-level signature mismatch errors from the PackageManager.
Detects screenshot capture events on domain controllers occurring while both FTK Imager and Microsoft Edge processes are running within the same 15-minute window, consistent with UNC6692's Edgecution malware suite deployment where attackers use FTK Imager for forensic/data collection and Edge (loaded with a malicious extension) as the Edgecution backdoor, alongside screen capture activity for surveillance/monitoring of compromised domain controllers.
This rule detects potential cloud data exfiltration by identifying anomalous device-code authentication sign-ins followed by high-velocity file or mailbox access. It specifically monitors Microsoft 365 sign-in logs for device-code authentication sessions involving either an application (AppId) or a geographic location not seen in the user's previous 14-day baseline. If such a sign-in is immediately followed (within a 2-hour window) by a rapid burst of activity in SharePoint, OneDrive, or Exchange—defined by at least 20 operations at a rate of 5 or more events per minute—the rule flags the sequence as suspicious. This pattern is characteristic of attackers using stolen device-code tokens to programmatically mass-download or exfiltrate sensitive cloud data.
This rule detects potential data exfiltration by monitoring for anomalous user behavior across integrated SaaS applications. It flags accounts that perform high-frequency read, search, or view activities across three or more monitored SaaS platforms (Confluence, Jira, Slack, Google Workspace, Microsoft 365, or Bitbucket) within a 5-minute window, followed immediately by an upload or post activity to an external, non-integrated domain.
This rule detects potential data exfiltration by monitoring for anomalous user behavior across integrated SaaS applications. It flags accounts that perform high-frequency read, search, or view activities across three or more monitored SaaS platforms (Confluence, Jira, Slack, Google Workspace, Microsoft 365, or Bitbucket) within a 5-minute window, followed immediately by an upload or post activity to an external, non-integrated domain.
Page 51 of 83