Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,666 detections
Filters
Last updated
All Time
Detection languages
1,077
189
170
102
53
Contributors
520
361
306
67
52
Categories
20,443
11,831
5,872
5,155
4,866
1,666
Platforms
1,091
591
441
252
122
Products / Services
1,130
476
189
125
117
MITRE Techniques
945
843
438
416
413
CVEs
12
12
9
6
5
IDS Classtypes
1
1
Correlates a high-risk or compromised Microsoft Entra sign-in event with a subsequent device registration (Add device or Register device) performed by the same user account within a 3-hour window.
Correlates an interactive MFA-satisfied user sign-in with a subsequent non-interactive or token-based successful authentication from a different IP address and country within a short time window for the same user and application. This pattern is indicative of adversary-in-the-middle (AitM) phishing attacks where session cookies or tokens are intercepted and replayed.
Detects successful Entra ID sign-ins using the device code authentication flow by users who have no prior device code sign-in history within a 30-day baseline window. This behavior can indicate device code phishing or abuse of the device code grant mechanism.
Detects Microsoft 365 session token replay as described in the Huntress token spray research: sign-ins from the campaign addresses, scripted clients (node or a bare Mozilla/5.0 user agent) using the Office, Authentication Broker or OfficeHome app IDs from an address new to the account, Device Registration Service access from a new address and one session seen from different operating systems and addresses. The campaign address list is short lived and serves as enrichment.
Hunting query for the ConnectWise Cloud Backup (SkyKick) application credential abuse reported in October 2026. It returns three signals, sorted by a Priority column. First, sign-ins by the seven ConnectWise and SkyKick application IDs from a public IP address. ConnectWise states the Cloud Backup app normally signs in from Azure private IPv6 addresses. Second, service principals that sign in from a public IP address in a country not seen in their 14-day baseline. This signal evaluates apps with at least 20 prior sign-ins. Third, Entra audit events initiated by applications. These include an application adding itself or another non-user identity to a directory role, an application adding or changing credentials for the first time in the baseline window and any credential change by an application named ConnectWise or SkyKick. Role additions with an unidentified target appear with Review priority. Audit events initiated by applications carry no source IP, so the IP indicator applies to the sign-in signals only. Routine credential changes by Azure services can still appear with Review priority. The query follows the Microsoft Defender advanced hunting schemas and runs without errors in Advanced Hunting. The audit signal was exercised against live Entra audit events in a Microsoft 365 tenant. Indicator columns are short-lived and used for enrichment only.
Detects when a user authenticates via device code flow or performs device registration/ownership addition, followed by a bulk download of SharePoint or OneDrive files (25 or more distinct files) within a 60-minute window. This behavior can indicate session hijacking or unauthorized access where an attacker uses device code phishing to gain access and quickly exfiltrate cloud documents.
Detects a high volume of authentication failures followed by a successful authentication from the same source IP address against edge devices like FortiGate or Palo Alto GlobalProtect within a specific time window.
Detects potential session hijacking or token theft where a user signs in using the Microsoft Teams app ID from an Android context with an unrecognized user agent, followed by Microsoft Graph API access from a different IP address and device ID within one hour.
Detects potential SQL injection probing followed by a successful authentication response (HTTP 302) from the same external client IP within a short timeframe on IIS web servers.
Detects administrative access to the DLP console from an unfamiliar address. Console
access permits policy change, violation review and exception approval — everything
needed to make data loss invisible, in one place.
Onboarding: TRELLIX-DLP is ingested via Syslog (XML) (Bloo extractor 805).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='TRELLIX-DLP' and action='LOGIN'
| groupby user, srcip, authproto
access permits policy change, violation review and exception approval — everything
needed to make data loss invisible, in one place.
Onboarding: TRELLIX-DLP is ingested via Syslog (XML) (Bloo extractor 805).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='TRELLIX-DLP' and action='LOGIN'
| groupby user, srcip, authproto
Hunting query for the ConnectWise Cloud Backup (SkyKick) application credential abuse reported in October 2026. It returns three signals, sorted by a Priority column. First, sign-ins by the seven ConnectWise and SkyKick application IDs from a public IP address. ConnectWise states the Cloud Backup app normally signs in from Azure private IPv6 addresses. Second, service principals that sign in from a public IP address in a country not seen in their 14-day baseline. This signal evaluates apps with at least 20 prior sign-ins. Third, Entra audit events initiated by applications. These include an application adding itself or another non-user identity to a directory role, an application adding or changing credentials for the first time in the baseline window and any credential change by an application named ConnectWise or SkyKick. Role additions with an unidentified target appear with Review priority. Audit events initiated by applications carry no source IP, so the IP indicator applies to the sign-in signals only. Routine credential changes by Azure services can still appear with Review priority. The query follows the Microsoft Defender advanced hunting schemas and runs without errors in Advanced Hunting. The audit signal was exercised against live Entra audit events in a Microsoft 365 tenant. Indicator columns are short-lived and used for enrichment only.
Detects Microsoft Entra ID sign-ins to specific third-party applications related to Updraft (TeamUpdraft, UpdraftCentral, UpdraftVault, UpdraftClone, UpdraftPlus) with anomalous characteristics such as multi-IP access, distinct countries, or failed-then-successful access attempts, indicating possible credential compromise or misuse.
Detects successful administrative login events originating from IP addresses outside of configured trusted management networks on Fortinet devices.
Detects a successful device code flow sign-in followed within one hour by a successful sign-in from the same user using a different IP address and country. This pattern can indicate device code phishing or abuse of the OAuth 2.0 device authorization grant flow.
Detects successful Palo Alto GlobalProtect VPN authentications where no Multi-Factor Authentication (MFA) challenge or related text is recorded in the firewall logs, and no corresponding successful MFA sign-in event is found in Entra ID (SigninLogs).
Detects potential Multi-Factor Authentication (MFA) fatigue or push bombing attacks against Azure Active Directory (Entra ID) accounts by identifying a high volume of MFA failures followed by suspicious or fraudulent report actions, or successful authentications shortly after repeated failures.
Detects sign-in events to Entra ID via service principals where the application is marked as external and enabled, and the user agent string indicates the use of a Python client.
Alerts whenever a default SAP administrative account (e.g., SAP*, DDIC, TMSADM) logs into the system. These accounts should be locked and used only for emergency 'break-glass' scenarios
Detects a sequence of events where an account performs a device code flow sign-in, registers or joins a device, and accesses a high volume of files in SharePoint or OneDrive within a 24-hour window. This pattern is commonly associated with adversary techniques abusing device code flows for initial access and registering managed/compromised devices to access sensitive corporate data.
Browser sign-ins and MFA prompts with medium or high sign-in risk from devices that have no Entra device identity and are not managed or compliant. Hunting query, not an alert.
Detects the creation of application-specific passwords followed by their initial use from unknown or new IP addresses using legacy authentication clients, which may indicate account compromise or persistence establishment.
Page 1 of 80