Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,666 detections
Filters
Last updated
All Time
Detection languages
1,077
189
170
102
53
Contributors
520
361
306
67
52
Categories
20,443
11,831
5,872
5,155
4,866
1,666
Platforms
1,091
591
441
252
122
Products / Services
1,130
476
189
125
117
MITRE Techniques
945
843
438
416
413
CVEs
12
12
9
6
5
IDS Classtypes
1
1
This rule identifies successful user sign-ins (ResultType 0) originating from specific Autonomous System Numbers (197540, 216154) where Multi-Factor Authentication (MFA) was not required or not recorded, and where Conditional Access policies either did not apply or succeeded without enforcing MFA.
Detects sign-in activity using pre-existing durable session tokens (e.g., PRT, broker-based tokens) that occur shortly after a password reset, suggesting that the adversary has maintained persistent access despite the credential change.
This rule detects successful logon events (Event ID 4624) or special logon events (Event ID 4648) with specific logon types (7: NetworkCleartext, 8: NewCredentials, 9: Network, 11: CachedInteractive) that occur within 24 hours of a user registration event on the same host. This pattern may indicate suspicious account usage shortly after account creation or registration on a device.
This rule detects authentication events using the Device Code OAuth flow where the user account name contains keywords associated with sensitive or privileged roles (such as 'finance', 'admin', 'accounts'), originating from non-private (external) IP addresses. This activity is indicative of potential device code phishing attacks targeting sensitive user accounts.
Detects rapid, successive successful interactive sign-ins for the same user account that each satisfy MFA requirements, but originate from geographically and technically distinct environments (different IP locations, ASNs, and device IDs) within a 2-minute window. This behavior is indicative of session hijacking via Adversary-in-the-Middle (AiTM) or Phishing-as-a-Service (PhaaS) frameworks.
Detects login attempts to source code repositories and developer tooling (GitHub, GitLab, Bitbucket, Azure DevOps, Slack, Visual Studio Code) originating from unmanaged or non-compliant devices, excluding traffic originating from known corporate network ranges.
This rule detects a user account performing its first-ever GitHub OAuth or repository access within a short timeframe (30 minutes) after authenticating to a designated low-trust OpenAI community forum. This pattern is designed to identify potential adversary activity where a compromised or newly created account is used to pivot from a low-trust environment to corporate repository access.
This rule detects a user account performing its first-ever GitHub OAuth or repository access within a short timeframe (30 minutes) after authenticating to a designated low-trust OpenAI community forum. This pattern is designed to identify potential adversary activity where a compromised or newly created account is used to pivot from a low-trust environment to corporate repository access.
Detects potential cross-application SSO session or token reuse by identifying users transitioning from a low-trust application (forum) to a high-trust application (ChatGPT/Codex) within a short window (15 minutes), especially when the sign-in is non-interactive (lacking MFA) or occurs from a different IP address or user agent, suggesting a possible token replay attack.
Detects potential cross-application SSO session or token reuse by identifying users transitioning from a low-trust application (forum) to a high-trust application (ChatGPT/Codex) within a short window (15 minutes), especially when the sign-in is non-interactive (lacking MFA) or occurs from a different IP address or user agent, suggesting a possible token replay attack.
This rule monitors cloud and identity logs to detect a single user identity exhibiting multiple stages of suspicious activity (authentication, reconnaissance, and exfiltration) within a 24-hour period while utilizing distinct, non-overlapping source IP addresses for each stage. This behavior is indicative of an account compromise where different stages of the attack chain originate from different infrastructure.
Detects instances where a user successfully authenticates using the OAuth 2.0 device code flow, and the resulting token is subsequently used from a different IP address or by a different client application, indicating potential token theft or session hijacking.
Detects successful API requests to sensitive administrative endpoints on WSO2 systems that lack a corresponding legitimate authentication event (session) from the same SourceIP and user pair, which may indicate the use of forged JWTs or authentication bypass exploitation (e.g., CVE-2026-5430).
Detects successful API requests to sensitive administrative endpoints on WSO2 systems that lack a corresponding legitimate authentication event (session) from the same SourceIP and user pair, which may indicate the use of forged JWTs or authentication bypass exploitation (e.g., CVE-2026-5430).
Detects the creation of a new user account in Nacos, followed immediately by an authentication failure and then a successful authentication, which may indicate an attacker using automated tools to create and test a backdoored administrative account.
Detects unauthorized cloud authentication attempts in Azure AD where a session token appears to have been replayed. The rule identifies sign-ins flagged by Identity Protection as anomalous or involving token/issuer irregularities, particularly when these occur without a fresh MFA challenge, suggesting a bypass of standard authentication controls.
Detects anomalous SSH authentication patterns characterized by a high volume of failed logon attempts (>= 10) originating from a specific IP address within a short timeframe (30 minutes), followed by a successful authentication to the same target device. This pattern is indicative of a successful credential brute-force or password guessing attack against an exposed SSH service.
Detects instances where a single proxy service API key or account is used from an abnormally high number of distinct IP addresses within a short timeframe. This behavior is indicative of credential theft and unauthorized sharing or exploitation of proxy credentials by third-party actors.
Detects potential post-authentication persistent actions (e.g., OAuth app grants, MFA changes, mailbox rule updates) performed shortly after a successful Google Workspace login, specifically flagging actions originating from IP addresses different from the login session to identify session hijacking or token replay (AiTM) activity. Includes suppression for known corporate IP ranges, trusted OAuth application consents, and recurring user behavior.
Detects potential post-authentication persistent actions (e.g., OAuth app grants, MFA changes, mailbox rule updates) performed shortly after a successful Google Workspace login, specifically flagging actions originating from IP addresses different from the login session to identify session hijacking or token replay (AiTM) activity. Includes suppression for known corporate IP ranges, trusted OAuth application consents, and recurring user behavior.
This rule detects a sequence of authentication activity on VPN gateways (Palo Alto, Fortinet, Cisco) where a source IP experiences multiple failed login attempts followed by at least one successful login within a 60-minute window, potentially indicating a successful brute force or password spraying attack.
Page 33 of 80