Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,666 detections
Filters
Last updated
All Time
Detection languages
1,077
189
170
102
53
Contributors
520
361
306
67
52
Categories
20,401
11,795
5,864
5,145
4,864
1,666
Platforms
1,091
590
440
252
122
Products / Services
1,130
476
189
125
118
MITRE Techniques
944
842
437
416
412
CVEs
12
12
9
6
5
IDS Classtypes
1
1
This rule detects potential session token replay attacks in Azure Active Directory by correlating interactive or single-factor sign-in events using 'python-requests' user agents (common in automated tooling) with subsequent 'Register device' and 'Register security info' (Windows Hello for Business) activity within a 48-hour window. This behavior often indicates an adversary attempting to register a device to a compromised account to maintain persistence or bypass MFA requirements.
Detects session hijacking activity characteristic of the Mirage2FA AiTM (Adversary-in-the-Middle) phishing toolkit. The rule identifies non-interactive authentication events (token reuse) that lack an MFA challenge, occurring shortly after interaction with a known malicious phishing proxy domain. It further correlates this activity with anomalous signals, such as impossible travel or the use of an unseen device/user-agent, to confirm high-fidelity malicious intent.
Detects anomalous authentication behavior indicative of an Adversary-in-the-Middle (AiTM) phishing kit. The rule identifies multiple password submission attempts (failures) followed by a successful authentication within a short period, consistent with an attacker testing multiple harvested credentials against an active session.
Detects successful device code authentication flows from users who have not utilized this authentication method within the past 14 days. This rule monitors Entra ID (Azure AD) sign-in logs and non-interactive logs, enriching results with Intune device compliance data and authentication protocol details to assist in identifying anomalous access patterns that may indicate credential abuse or device-code phishing.
Aggregates identity, endpoint, cloud application, and messaging telemetry to build a consolidated profile of the devices, clients, applications, and user agents associated with a specific user account.
The query combines Microsoft Entra sign-in data, endpoint logon activity, cloud application events, and email telemetry to provide a high-level overview of a user's activity footprint across the environment.
This query is useful for incident response, account compromise investigations, insider threat investigations, and validating whether a user is accessing services from expected devices and client applications.
The query combines Microsoft Entra sign-in data, endpoint logon activity, cloud application events, and email telemetry to provide a high-level overview of a user's activity footprint across the environment.
This query is useful for incident response, account compromise investigations, insider threat investigations, and validating whether a user is accessing services from expected devices and client applications.
This rule detects potential brute force or password spraying activity by identifying a user account that experiences at least 5 login failures followed by a successful login for the same application and source IP address within a one-hour window. This pattern is indicative of an attacker who has successfully guessed credentials after multiple attempts.
This rule detects successful SSH logins that follow a burst of at least 10 failed SSH authentication attempts from the same remote IP address to the same device within a 10-minute window, followed by a successful login within 15 minutes. This pattern is indicative of a successful credential brute-force attack, frequently associated with botnet propagation efforts.
This rule detects a potential security risk by identifying instances where a user registers a new security information method (e.g., FIDO2/Passkey) and subsequently logs in using that same authentication method within a 15-minute window. This pattern may indicate an attacker who has gained initial access or compromised credentials and is attempting to establish persistence or facilitate further account takeovers by registering their own multifactor authentication device.
Detects high-frequency state changes in authentication events for a single account within a short time window. This type of 'flapping' behavior, where an account repeatedly toggles between different authentication statuses (e.g., success and failure) on one or more hosts, can be an indicator of brute force attempts, credential stuffing, or misconfigured automated authentication services.
Detects instances where an administrator account experiences multiple authentication failures within a 15-minute window, followed by a successful authentication attempt from the same client IP address. This pattern is indicative of potential brute force or password spraying activity where the attacker successfully guessed the credentials after multiple failed attempts.
Detects signs of exploitation against FortiOS/FortiProxy authentication bypass vulnerabilities (CVE-2024-55591 / CVE-2025-24472) consistent with Gunra ransomware activity. This rule monitors for administrative logins originating from non-management public IP addresses and identifies potential MFA bypass attempts through the reuse of identical one-time passcodes across multiple distinct accounts or sessions within a one-hour window.
Detects successful SSH authentication to a Linux system using public-key authentication by monitoring system logs for the 'Accepted publickey for' message. This rule identifies remote access attempts and serves as a foundation for monitoring lateral movement via SSH.
Detects instances where an administrator account experiences multiple authentication failures within a 15-minute window, followed by a successful authentication attempt from the same client IP address. This pattern is indicative of potential brute force or password spraying activity where the attacker successfully guessed the credentials after multiple failed attempts.
This rule detects potentially unauthorized or suspicious administrative actions in an Azure environment following a login to specific AI-related applications (AI Gateway, LLM Proxy, or Model Router). It triggers when a user authenticates without applying Conditional Access policies or without Multi-Factor Authentication (MFA), followed immediately (within 30 minutes) by sensitive Azure administrative operations such as role assignments, Key Vault access, or VM write operations.
This rule detects potential brute force or password spraying activity by identifying a user account that experiences at least 5 login failures followed by a successful login for the same application and source IP address within a one-hour window. This pattern is indicative of an attacker who has successfully guessed credentials after multiple attempts.
This rule detects potentially unauthorized or suspicious administrative actions in an Azure environment following a login to specific AI-related applications (AI Gateway, LLM Proxy, or Model Router). It triggers when a user authenticates without applying Conditional Access policies or without Multi-Factor Authentication (MFA), followed immediately (within 30 minutes) by sensitive Azure administrative operations such as role assignments, Key Vault access, or VM write operations.
This rule detects successful connection events to Palo Alto GlobalProtect gateways originating from known malicious source IP addresses associated with the exploitation of CVE-2026-0257, or connections initiated by hosts using suspicious or default placeholder device names/host IDs. It effectively identifies potential exploitation attempts or unauthorized access to corporate VPN gateways.
This rule detects successful connection events to Palo Alto GlobalProtect gateways originating from known malicious source IP addresses associated with the exploitation of CVE-2026-0257, or connections initiated by hosts using suspicious or default placeholder device names/host IDs. It effectively identifies potential exploitation attempts or unauthorized access to corporate VPN gateways.
This rule detects a potential security risk by identifying instances where a user registers a new security information method (e.g., FIDO2/Passkey) and subsequently logs in using that same authentication method within a 15-minute window. This pattern may indicate an attacker who has gained initial access or compromised credentials and is attempting to establish persistence or facilitate further account takeovers by registering their own multifactor authentication device.
Detects sign-ins from known UNC6671 residential-proxy IPs, ranked by rarity (first-seen for the user) and correlated with a following sensitive account action (MFA registration, mailbox rule change, admin role change).
Detects signs of exploitation against FortiOS/FortiProxy authentication bypass vulnerabilities (CVE-2024-55591 / CVE-2025-24472) consistent with Gunra ransomware activity. This rule monitors for administrative logins originating from non-management public IP addresses and identifies potential MFA bypass attempts through the reuse of identical one-time passcodes across multiple distinct accounts or sessions within a one-hour window.
Page 47 of 80