Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,666 detections
Filters
Last updated
All Time
Detection languages
1,077
189
170
102
53
Contributors
520
361
306
67
52
Categories
20,417
11,806
5,870
5,145
4,864
1,666
Platforms
1,091
590
440
252
122
Products / Services
1,130
476
189
125
118
MITRE Techniques
944
842
437
416
412
CVEs
12
12
9
6
5
IDS Classtypes
1
1
Detects a sequence of multiple VPN authentication failures from a single IP address followed by a successful authentication within a 10-minute window, which is indicative of a successful credential brute force attack.
Detects a successful VPN authentication event followed within 30 minutes by the execution of the MeshAgent RMM tool or its renamed variant mvtcs.exe. This behavioral pattern is associated with initial access via compromised VPN credentials followed by the deployment of remote monitoring and management (RMM) tools for persistence and command and control.
Detects anomalous sign-in behavior shortly after a successful MFA-authenticated session in Microsoft 365. This rule flags scenarios where a subsequent session for the same user occurs within a short window (30 minutes) from a different IP, ASN, User-Agent, or device identifier, potentially indicating the replay of a stolen session cookie obtained via Adversary-in-the-Middle (AiTM) phishing.
Detects anomalous reuse of an authenticated Microsoft 365 session cookie shortly after a successful MFA-satisfied sign-in. The detection identifies scenarios where the subsequent access originates from a different IP address, device, or user agent without an intervening MFA challenge, which is a pattern indicative of session hijacking techniques like Adversary-in-the-Middle (AiTM) or session token replay.
Detects anomalous sign-in behavior where a device code authentication flow is initiated from one location, but the resulting session is replayed from a different IP address in a different country within a one-hour window. This behavior is indicative of an adversary capturing an authentication token via a device code phishing or relay attack and attempting to use it from their own infrastructure to bypass conditional access policies and MFA.
Detects successful authentication events using known default or low-privileged Cisco Firepower Management Center (FMC) service accounts, or IDS alerts (Snort SID 66883) associated with credential abuse activity potentially related to CVE-2026-20316.
Detects successful authentication attempts to a LiteLLM proxy instance using the hardcoded default master key 'sk-1234'. This activity indicates potential exploitation of misconfigured instances where default credentials remain unchanged.
Detects high-volume authentication attempts against Fortinet network appliances where multiple distinct source IPs successfully authenticate against multiple distinct accounts matching specific administrative naming patterns. This pattern is indicative of potential credential stuffing or brute-force campaigns targeting edge infrastructure.
Detects high-volume authentication attempts against Fortinet network appliances where multiple distinct source IPs successfully authenticate against multiple distinct accounts matching specific administrative naming patterns. This pattern is indicative of potential credential stuffing or brute-force campaigns targeting edge infrastructure.
This rule identifies potential MFA fatigue attacks by detecting multiple MFA denial or failure events for a user within a 30-minute window, followed by a successful authentication for the same user in the same time frame.
Detects activity from Anthropic network range across multiple event types
Detects activity from Anthropic network range across multiple event types
Detects activity from Anthropic network range across multiple event types
Detects successful sign-ins where Multi-Factor Authentication (MFA) was approved using the 'PhoneAppOTP' method, specifically where the method was registered by the user prior to the observed sign-in timeframe. This pattern can indicate an adversary using an actor-controlled MFA device registered previously to maintain persistent access to a compromised account.
This rule detects successful user authentication events within the environment. It acts as a base filter to capture login success, which can be further refined with context such as IP addresses or usernames to monitor for anomalous login patterns, though it does not inherently provide detection of complex attacks like session token hijacking on its own.
Detects a successful authentication event where standard endpoint identification metadata (endpoint name and IP address) is absent. This often indicates logs originating from sources without proper endpoint telemetry integration or potential attempts to obfuscate the source of an authentication request.
Detects login events to the 'My Sign-Ins' portal (mysignins.microsoft.com) by users. This portal is a high-value target for adversaries who have gained access to a session via token theft or session hijacking, as it allows them to modify or add authentication methods (such as MFA devices) to establish long-term persistence in the victim's account.
Detects a single Azure AD identity successfully authenticating from three or more unique IP addresses within a 24-hour window. This behavior is indicative of infrastructure rotation by threat actors, such as those observed in Storm-3121/Storm-3032 campaigns, intended to evade network-based detection and conditional access controls during reconnaissance or exfiltration phases.
Detects when a user registers a new MFA or authentication method, such as a software token or authenticator app, within one hour of a suspicious sign-in event. This pattern is commonly indicative of an adversary establishing persistence or bypassing authentication controls following account compromise via phishing or credential harvesting.
Detects anomalous authentication behavior where a user successfully completes an OAuth device-code grant, followed by a subsequent login event using the same user context but originating from a different source IP address. This pattern is indicative of device-code phishing, where an adversary tricks a user into authorizing a device, then uses the resulting session or token from their own infrastructure.
Detects anomalous authentication behavior where a user successfully completes an OAuth device-code grant, followed by a subsequent login event using the same user context but originating from a different source IP address. This pattern is indicative of device-code phishing, where an adversary tricks a user into authorizing a device, then uses the resulting session or token from their own infrastructure.
Page 38 of 80