Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,666 detections
Filters
Last updated
All Time
Detection languages
1,077
189
170
102
53
Contributors
520
361
306
67
52
Categories
20,401
11,795
5,864
5,145
4,864
1,666
Platforms
1,091
590
440
252
122
Products / Services
1,130
476
189
125
118
MITRE Techniques
944
842
437
416
412
CVEs
12
12
9
6
5
IDS Classtypes
1
1
This rule detects when a user registers a new multi-factor authentication (MFA) method from an Autonomous System Number (ASN) that the user has not used for authentication in the previous 30 days. This behavior is indicative of potential account takeover or an adversary setting up persistent MFA access from a new location.
This rule detects potential credential stuffing or brute force attacks against a SonicWall VPN device. It identifies scenarios where a single source IP experiences multiple failed authentication attempts within a 15-minute window, followed by at least one successful authentication on the same destination host.
This rule detects Remote Interactive (RDP) logon events performed by a local administrator account where the source of the connection is identified as the local host (127.0.0.1, ::1) or the device itself. This pattern is indicative of attackers using tunneling tools, such as the SNOWGLAZE SOCKS proxy, to relay RDP traffic through a compromised host to bypass network-level security controls.
This rule detects 'impossible travel' activity performed by users assigned to sensitive Microsoft 365 Communication Compliance roles. It monitors Azure Sign-in logs for successful authentication events occurring within a short timeframe (1 hour) from multiple distinct geographic locations (countries) or different autonomous system numbers (ASNs). This behavior is characteristic of an adversary utilizing stolen session tokens or compromised credentials to access protected administrative functions.
Detects signs of Adversary-in-the-Middle (AiTM) token or session replay attacks by correlating device browsing activity on known phishing domains with subsequent user sign-in events. The rule triggers if a sign-in occurs within 10 minutes of a phishing-domain visit from a different, non-corporate IP address, or if a single session exhibits multiple distinct non-corporate IP addresses within that same window.
This rule detects potential Pass-the-Hash (PtH) lateral movement by identifying administrative accounts performing NTLM network logons across multiple domain controllers within a 15-minute window. To reduce false positives, the rule excludes authentication events where there is concurrent evidence of interactive (Type 2/10) or Kerberos-based authentication on those same hosts, which helps isolate suspicious non-Kerberos administrative activity.
Detects instances where an Azure Automation Runbook interacts with or initiates a sign-in log activity that does not correspond to its own Managed Identity. This anomaly may indicate the abuse of a managed identity token to access unauthorized resources or perform lateral movement within the Azure environment.
Detects anomalous session activity where a single authentication session ID is associated with multiple IP addresses and multiple distinct countries within a 20-minute window. This behavior is indicative of session hijacking, such as an Adversary-in-the-Middle (AiTM) attack, where a session token is stolen and reused by an attacker from a different location.
This rule identifies Service Principals in Microsoft Entra ID that have successfully authenticated after a long period of dormancy (defined as 90 days or more). Reactivation of dormant service principals may indicate that an adversary is attempting to revive a persistent access method or abuse credentials that were previously set aside.
Detects anomalous session activity where a single authentication session ID is associated with multiple IP addresses and multiple distinct countries within a 20-minute window. This behavior is indicative of session hijacking, such as an Adversary-in-the-Middle (AiTM) attack, where a session token is stolen and reused by an attacker from a different location.
Detects instances where an Azure Automation Runbook interacts with or initiates a sign-in log activity that does not correspond to its own Managed Identity. This anomaly may indicate the abuse of a managed identity token to access unauthorized resources or perform lateral movement within the Azure environment.
This rule identifies anomalous SonicWall VPN login attempts by tracking successful logins over a rolling 30-day baseline. It alerts when a user successfully authenticates from an IP address not previously seen in their baseline activity, specifically during off-hours (00:00 to 05:00).
This rule detects a potential password spraying attack followed by a successful sign-in from a non-UK location. It monitors for a threshold of failed sign-in attempts from distinct source IPs for a specific user within a 4-hour window, followed by a subsequent successful sign-in event from a different geographical location.
Detects instances where a user who has not enrolled in Duo MFA successfully authenticates due to being connected to a defined trusted network. This behavior indicates an MFA coverage gap, potentially allowing an attacker to authenticate as an unenrolled user without MFA if they gain access to a trusted network or VPN.
Detects Azure AD sign-ins using the OAuth device code authentication flow that are followed by impossible-travel patterns (country change within a short window) or that occur near captive-portal network connections on the same device, consistent with Midnight Blizzard's CaptiveCrunch device-code phishing tradecraft targeting corporate travelers.
This rule identifies successful user sign-ins originating from IP addresses associated with residential or commercial VPN ASNs that have not been observed in the user's historical sign-in data (past 30 days). By comparing current activity against a baseline of known user locations, it flags potentially unauthorized access through masked connections.
Detects anomalous access to the Azure Portal Single Page Application (SPA) by monitoring sign-in logs. The rule flags users accessing this specific application from multiple devices or over an unusually long time span (exceeding 24 hours), which may indicate session hijacking, token theft, or unauthorized access attempts via stolen session tokens.
This rule identifies potential account compromise or session hijacking by correlating anomalous outbound email patterns with risky sign-in events. It monitors for users who send outbound emails to a threshold of previously unseen external recipients within a short window after authenticating under suspicious conditions, such as high-risk sign-in flags, atypical locations, or unfamiliar applications. This pattern is indicative of attackers using stolen session tokens or compromised credentials to perform mass outbound phishing, spamming, or data exfiltration from an internal mailbox.
Detects interactive sign-in attempts for accounts commonly associated with Microsoft sync services (e.g., AD Connect, MSOL sync). Service accounts should typically perform background, non-interactive authentication. An interactive login for these accounts may indicate credential misuse or unauthorized access.
Detects interactive sign-in attempts for accounts commonly associated with Microsoft sync services (e.g., AD Connect, MSOL sync). Service accounts should typically perform background, non-interactive authentication. An interactive login for these accounts may indicate credential misuse or unauthorized access.
This rule detects when a user registers a new multi-factor authentication (MFA) method from an Autonomous System Number (ASN) that the user has not used for authentication in the previous 30 days. This behavior is indicative of potential account takeover or an adversary setting up persistent MFA access from a new location.
Page 49 of 80