Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,733 detections
Filters
Last updated
All Time
Detection languages
909
387
164
127
68
Contributors
479
417
201
177
61
Categories
20,440
11,814
5,871
5,145
4,864
1,733
Platforms
822
436
329
274
206
Products / Services
498
378
118
96
79
MITRE Techniques
433
327
225
196
196
CVEs
12
12
10
10
6
IDS Classtypes
1
1
IDS Protocols
2
Detects M365 Copilot jailbreak attempts through prompt injection techniques including rule manipulation, system bypass commands, and AI impersonation requests that attempt to circumvent built-in safety controls. The detection searches exported eDiscovery prompt logs for jailbreak keywords like "pretend you are," "act as," "rules=", "ignore," "bypass," and "override" in the Subject_Title field, assigning severity scores based on the manipulation type (score of 4 for amoral impersonation or explicit rule injection, score of 3 for entity roleplay or bypass commands). Prompts with a jailbreak score of 2 or higher are flagged, prioritizing the most severe attempts to override AI safety mechanisms through direct instruction injection or unauthorized persona adoption.
Detects agentic AI jailbreak attempts that try to establish persistent control over M365 Copilot through rule injection, universal triggers, response automation, system overrides, and persona establishment techniques. The detection analyzes the PromptText field for keywords like "from now on," "always respond," "ignore previous," "new rule," "override," and role-playing commands (e.g., "act as," "you are now") that attempt to inject persistent instructions. The search computes risk by counting distinct jailbreak indicators per user session, flagging coordinated manipulation attempts.
Detects M365 Copilot users exhibiting suspicious application usage patterns including multi-location access, abnormally high activity volumes, or access to multiple Copilot applications that may indicate account compromise or automated abuse. The detection aggregates M365 Copilot Graph API events per user, calculating metrics like distinct cities/countries accessed, unique IP addresses, number of different Copilot apps used, and average events per day over the observation period. Users are flagged when they access Copilot from multiple cities (cities_count > 1), generate excessive daily activity (events_per_day > 100), or use more than two different Copilot applications (app_count > 2), which are anomalous patterns suggesting credential compromise or bot-driven abuse.
Detects potential Distributed Denial of Service (DDoS) attacks or rate limit abuse against Ollama API endpoints by identifying excessive request volumes from individual client IP addresses. This detection monitors GIN-formatted Ollama server logs to identify clients generating abnormally high request rates within short time windows, which may indicate automated attacks, botnet activity, or resource exhaustion attempts targeting local AI model infrastructure.
Detects M365 Copilot impersonation and roleplay jailbreak attempts where users try to manipulate the AI into adopting alternate personas, behaving as unrestricted entities, or impersonating malicious AI systems to bypass safety controls. The detection searches exported eDiscovery prompt logs for roleplay keywords like "pretend you are," "act as," "you are now," "amoral," and "roleplay as" in the Subject_Title field. Prompts are categorized into specific impersonation types (AI_Impersonation, Malicious_AI_Persona, Unrestricted_AI_Persona, etc.) to identify attempts to override the AI's safety guardrails through persona injection attacks.
The analytic detects the execution of rundll32.exe loading advpack.dll or ieadvpack.dll via the LaunchINFSection function. This method is identified using Endpoint Detection and Response (EDR) telemetry, focusing on command-line executions and process details. This activity is significant as it indicates a potential application control bypass, allowing script code execution from a file. If confirmed malicious, an attacker could execute arbitrary code, potentially leading to privilege escalation, persistence, or further network compromise. Investigate script content, network connections, and any spawned child processes for further context.
The following analytic detects the execution of rundll32.exe loading setupapi.dll and iesetupapi.dll via the LaunchINFSection function. This behavior is identified using Endpoint Detection and Response (EDR) telemetry, focusing on process creation events and command-line arguments. This activity is significant as it indicates a potential application control bypass, allowing an attacker to execute arbitrary script code. If confirmed malicious, this technique could enable code execution, privilege escalation, or persistence within the environment, posing a severe threat to system integrity and security.
Detects abnormal memory allocation patterns and excessive runner operations in Ollama that may indicate resource exhaustion attacks, memory abuse through malicious model loading, or attempts to degrade system performance by overwhelming GPU/CPU resources. Adversaries may deliberately load multiple large models, trigger repeated model initialization cycles, or exploit memory allocation mechanisms to exhaust available system resources, causing denial of service conditions or degrading performance for legitimate users.
Detects remote RPC calls to create or execute a scheduled task via SASec
Detects remote RPC calls to create or execute a scheduled task via ATSvc
Detects remote RPC calls to create or execute a scheduled task
This KQL provide a detailed audit listing of your tenant consented OAuth apps and their granted permissions and number of users consented.
Detects a user authorizing a Salesforce application via the '/setup/connect' page. This specific TTP is associated with ShinyHunters vishing campaigns where attackers impersonate IT staff and trick employees into entering a connection code, thereby granting a malicious application access to the organization's Salesforce environment.
Detects an exploit attempt against Sitecore vulnerability CVE-2025-53690. This rule correlates an HTTP POST request to '/sitecore/blocked.aspx' with a subsequent 'ViewState verification failed' Windows Event Log (EID 1316) from the same source IP and target host.
Detects scenarios where an attacker enables the disabled (recommended) SA admin account on the SQL Server instance.
Detects scenarios where an attacker grants new privileges on a SQL instance level
Detects scenarios where an attacker enables CLR (Common Language Runtime with .NET) to abuse store procedures in order to move lateraly.
Detects scenarios where an attacker adds his account to a server role (sysadmin, securityadmin, serveradmin, ...)
Detects scenarios where an attacker attempts authenticate to the database using a disabled user accont
Detects scenarios where an attacker attempts to enumerate potential existing SQL users, resulting in failed logins with unexisting or invalid accounts.
Detects scenarios where an attacker enable the xp_cmdshell in order to execute non SQL content and escalate privileges
Page 71 of 83