Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,666 detections
Filters
Last updated
All Time
Detection languages
1,077
189
170
102
53
Contributors
520
361
306
67
52
Categories
20,417
11,806
5,870
5,145
4,864
1,666
Platforms
1,091
590
440
252
122
Products / Services
1,130
476
189
125
118
MITRE Techniques
944
842
437
416
412
CVEs
12
12
9
6
5
IDS Classtypes
1
1
This rule detects successful device-code authorization logins to Azure AD that originate from a country or region not previously associated with the user. It evaluates the user's historical sign-in locations to establish a baseline and flags deviations, which may indicate account compromise via device-code phishing or MFA bypass attempts.
Detects potential device code phishing activity by identifying a successful device code authentication event followed shortly (within 10 minutes) by an interactive or API sign-in from the same user utilizing a Python-requests user agent, which is commonly associated with adversary-in-the-middle phishing kits.
This rule monitors for security-related account activities in Azure AD, specifically tracking self-service password resets, admin-led password resets, and changes to user security information. It aggregates these events by user to identify potential account manipulation, unauthorized password changes, or MFA registration abuse.
Detects when a user who has successfully authenticated to a system is subsequently added to the 'Domain Admins' group within a 15-minute window. This behavior often indicates an adversary performing privilege escalation after gaining initial access to an account.
Detects unauthorized modification of the Nacos database users table, specifically identifying direct INSERT or UPDATE statements used to plant a backdoor administrative account. The rule correlates database modifications with abnormal authentication patterns, such as a password hash update occurring after a failed login attempt to the Nacos application.
Detects successful VPN authentication attempts originating from known Cloudflare WARP tunnel infrastructure or European VPS provider IP address ranges. This pattern is often used by adversaries to mask their true geographic origin or bypass location-based security policies.
This rule identifies potentially compromised Entra ID accounts by correlating multiple suspicious behaviors within a 14-day window. It aggregates four specific indicators: successful authentication following repeated MFA failures, impossible travel (sign-ins from multiple countries within a short timeframe), unusual hour logons (00:00-05:00), and sign-ins flagged with medium/high risk or reported as compromised. The rule triggers when an account exhibits two or more of these distinct anomalous behaviors.
Detects multiple successful GitLab authentication events from a specific source IP that contain parameters indicating an attempt to skip or bypass two-factor authentication, consistent with known GitLab 2FA bypass vulnerabilities.
Detects successful remote logons to network devices (routers, VPNs, NAS) using the 'admin' account. This pattern is indicative of credential spraying or brute-force attacks targeting weak default credentials on externally facing management interfaces, often associated with botnets or threat actors performing reconnaissance and initial access operations.
Detects successful remote logons to network devices (routers, VPNs, NAS) using the 'admin' account. This pattern is indicative of credential spraying or brute-force attacks targeting weak default credentials on externally facing management interfaces, often associated with botnets or threat actors performing reconnaissance and initial access operations.
Detects successful remote logons to network devices (routers, VPNs, NAS) using the 'admin' account. This pattern is indicative of credential spraying or brute-force attacks targeting weak default credentials on externally facing management interfaces, often associated with botnets or threat actors performing reconnaissance and initial access operations.
Detects anomalous SSH authentication patterns characterized by a high volume of failed logon attempts (>= 10) originating from a specific IP address within a short timeframe (30 minutes), followed by a successful authentication to the same target device. This pattern is indicative of a successful credential brute-force or password guessing attack against an exposed SSH service.
Detects anomalous cloud authentication events occurring within a 3-hour window after suspected unauthorized access to sensitive configuration or credential files on a Vite development server. The rule flags sign-ins with high risk, anomalous location, or missing device compliance information, excluding trusted corporate locations and devices, serving as an indicator of potential post-exfiltration account takeover.
Detects rapid, successive successful interactive sign-ins for the same user account that each satisfy MFA requirements, but originate from geographically and technically distinct environments (different IP locations, ASNs, and device IDs) within a 2-minute window. This behavior is indicative of session hijacking via Adversary-in-the-Middle (AiTM) or Phishing-as-a-Service (PhaaS) frameworks.
Detects successful VPN logins following a burst of failed attempts from multiple IP addresses, where the successful login originates from a known malicious IP or an IP associated with the preceding failed attempts. This rule specifically identifies potential credential stuffing or password spraying activity targeting VPN services, often associated with the BlackSuit ransomware group.
Detects anomalous, non-interactive sign-in activity in Microsoft 365 that suggests session cookie replay (Pass-the-Cookie). The rule correlates successful, MFA-validated interactive sign-ins against subsequent, non-interactive sign-ins that lack MFA, occur from a different device and IP address within a short time window, and bypass standard interactive re-authentication.
This rule detects user authentication events that deviate significantly from a 14-day historical baseline of known devices, operating systems, browsers, and network locations (ASN). It flags logins where at least two out of four key metadata signals (DeviceId, OS, Browser, ASN) have changed compared to the user's historical pattern, specifically targeting successful authentications that did not trigger a fresh multi-factor authentication (MFA) challenge, potentially indicating token theft or unauthorized session reuse.
Detects a privilege escalation technique where an attacker with application management permissions adds a credential to the 'Office 365 Exchange Online' service principal (SP). The attacker then leverages the SP's 'Domain.ReadWrite.All' permission to add or modify a federated domain, allowing them to forge tokens for any hybrid user.
This rule correlates successful Microsoft 365 sign-in events with preceding network events involving identified NovaCookies AiTM phishing infrastructure (specifically targeting .vu domains or specific URL patterns). It triggers when a user successfully authenticates using MFA shortly after accessing a known phishing link, which is a strong indicator of an active AiTM session hijacking attempt.
Detects anomalous authentication behavior indicative of an Adversary-in-the-Middle (AiTM) phishing kit. The rule identifies multiple password submission attempts (failures) followed by a successful authentication within a short period, consistent with an attacker testing multiple harvested credentials against an active session.
Detects a sequence of events starting with a device code OAuth sign-in, followed within two hours by the creation or modification of inbox rules and high-frequency enumeration of email items (contacts, folders, messages, threads, people) via Microsoft Graph API. This behavior is indicative of post-compromise activity where an adversary uses OAuth device code grants to maintain access and subsequently automates inbox analysis or data harvesting.
Page 40 of 80