Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,733 detections
Filters
Last updated
All Time
Detection languages
909
387
164
127
68
Contributors
479
417
201
177
61
Categories
20,440
11,814
5,871
5,145
4,864
1,733
Platforms
822
436
329
274
206
Products / Services
498
378
118
96
79
MITRE Techniques
433
327
225
196
196
CVEs
12
12
10
10
6
IDS Classtypes
1
1
IDS Protocols
2
This rule monitors authentication events across various SaaS platforms (Jira, Okta, Azure AD, Google Workspace, Auth0, OneLogin) to detect suspicious activity. It calculates a risk score based on indicators such as impossible travel, high volume of distinct source IPs or geographic locations, and anomalous user agent activity, flagging sessions that exceed a defined risk threshold.
This rule detects when a user grants an OAuth application permissions within an Azure AD or Office 365 environment, specifically monitoring for highly sensitive permissions such as 'Mail.Read', 'Files.ReadWrite', 'User.Read.All', or 'offline_access'. The rule cross-references the application ID against a known list to filter out pre-authorized applications and assigns a risk score based on the combination of granted permissions, flagging suspicious, unrecognized applications.
Detects anomalous activities targeting SaaS CRM applications (Salesforce, Microsoft Dynamics 365, HubSpot), including high-volume bulk exports, off-hours access, mass API queries for sensitive objects, and suspicious OAuth token grants.
Detects successful exploitation of the CVE-2026-48558 OIDC authentication bypass vulnerability in SimpleHelp. The rule monitors for a forged OIDC response processed by the OIDCAuthenticator followed immediately by the registration of a new technician account marked with the [New Anon] identifier, indicating identity verification failure and unauthorized privileged account creation.
Detects the presence and execution of RustDesk remote access software by monitoring process names, command-line arguments, specific destination network ports, and DNS queries associated with the application. This rule identifies potential unauthorized remote access attempts or the use of non-approved remote support tools.
This rule detects potentially malicious HTTP requests targeted at Google Cloud Run services that attempt to access restricted or internal application paths, such as '/app/' or '/var/task/'. These patterns often indicate attempts to probe for or exploit vulnerable web application files, internal scripts, or configuration files (e.g., 'graph_api.py', 'graph.zip') commonly found in serverless environments.
Detects Microsoft Excel application crashes (Event ID 1000) characterized by an access violation exception code (c0000005). This pattern can indicate an attempt to exploit vulnerabilities in office applications or memory corruption issues, potentially signaling a malicious document exploitation attempt.
Detects unauthorized usage of the Android AccessibilityService 'performGlobalAction' to trigger a 'BACK' operation specifically when the Android Settings application is active. This behavior is indicative of malicious applications attempting to obstruct user attempts to reach the Settings menu to uninstall a malicious package.
Detects the initialization of an Android package installation session using the 'PackageInstaller.createSession' API in conjunction with 'PackageInstaller$SessionParams'. This behavior is indicative of potential silent second-stage APK installation, a technique used by malicious applications to bypass standard installation prompts or deploy additional malicious components.
Detects messages sent within Microsoft Teams from an external tenant that contain potentially malicious indicators, such as URL shorteners, external links, or references to executable file extensions. This rule is designed to identify potential spearphishing or social engineering attempts originating from external Microsoft 365 tenants.
This rule detects potential Remote Code Execution (RCE) attempts leveraging Velocity Template Language (VTL) injection vulnerabilities within AWS API Gateway. It monitors logs for specific indicators, including references to 'ProcessBuilder', malicious template artifacts, and exploitation patterns associated with the 'floci-apigateway-vtl-rce-poc' exploit.
Detects the exploitation of a vulnerability in the SimpleHelp OIDC authentication flow where an attacker can register a forged technician account and self-register MFA during the first login, effectively bypassing mandatory multi-factor authentication requirements. The detection looks for specific sequences in server logs involving OIDC attribute fetching and 'New Anon' technician registration tags.
Detects potential SearchLeak (CVE-2026-42824) prompt-to-parameter injection in Microsoft 365 Copilot Enterprise. The rule monitors for search operations containing URL-encoded characters, HTML/JS injection payloads, or anomalous long query strings that indicate a malicious attempt to influence search results or exfiltrate data.
Detects a critical authentication bypass in SimpleHelp servers (CVE-2026-48558) where an adversary leverages a forged OIDC identity token. The rule identifies the sequence of an unverified OIDC response, the failure to issue an MFA session token, successful group-level authentication without a challenge, and the subsequent registration of an unauthenticated '[New Anon]' identity.
Latin American banking trojan using DLL side-loading and overlay attacks
Detects potentially malicious Android applications installed via non-standard sources that exhibit suspicious characteristics such as masquerading as system/security updates, requesting device administrator privileges, or clustering highly sensitive permissions like location, contacts, call logs, and audio recording.
Detects instances where a user grants an OAuth application sensitive permissions, which could indicate an illicit consent grant attack where an adversary lures a user into authorizing a malicious application to access their email, files, or directory data.
This rule monitors ServiceNow API traffic for high-volume requests originating from unauthenticated or guest accounts, particularly outside of standard business hours. It uses time-windowed aggregation to detect potential brute force, unauthorized scanning, or enumeration attempts against the ServiceNow platform.
Detects messages sent within Microsoft Teams from an external tenant that contain potentially malicious indicators, such as URL shorteners, external links, or references to executable file extensions. This rule is designed to identify potential spearphishing or social engineering attempts originating from external Microsoft 365 tenants.
Detects unauthenticated requests directed at ServiceNow Scripted REST Resource endpoints, specifically targeting path segments like '/api/now/related_list_edit/create' or general '/api/now/' paths. The rule looks for transaction activity identified as 'Guest' user or lacking necessary authorization headers, potentially indicating exploitation of ServiceNow platform vulnerabilities.
Detects anomalous, high-volume API requests to ServiceNow endpoints originating from the same source IP that lack valid authorization headers or session tokens, potentially indicating automated scanning, enumeration, or exploitation attempts.
Page 57 of 83