Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,666 detections
Filters
Last updated
All Time
Detection languages
1,077
189
170
102
53
Contributors
520
361
306
67
52
Categories
20,401
11,795
5,864
5,145
4,864
1,666
Platforms
1,091
590
440
252
122
Products / Services
1,130
476
189
125
118
MITRE Techniques
944
842
437
416
412
CVEs
12
12
9
6
5
IDS Classtypes
1
1
Detects successful SSH authentication to administrative accounts ('vmanage-admin' or 'admin') on Cisco Catalyst SD-WAN Manager (vManage) devices originating from IP addresses associated with the threat actor UAT-8616. This activity relates to exploits targeting CVE-2026-20127 and CVE-2026-20182 for unauthorized access via authentication bypass or certificate abuse.
Detects instances where a user successfully authenticates from a mobile device (Android or iPhone) that exhibits a geographic mismatch (geo_country vs registered_country), and subsequently performs a sensitive credential or MFA-related action (enrollment or reset) from a different device within one hour. This pattern is indicative of a potential session hijacking or credential compromise where an attacker attempts to establish persistence by enrolling their own MFA device.
This rule detects network connections and user sign-ins originating from IP addresses identified as belonging to Iran. It also identifies sign-ins where the reported country is Iran, but the IP address is not found within the provided Iranian IP list, which could indicate IP geolocation discrepancies or obfuscation attempts.
This rule detects potential brute force or credential stuffing attacks against Azure AD by identifying multiple failed sign-in attempts followed by a successful sign-in from the same user and IP address within a short time frame (1 minute). It specifically looks for scenarios where the successful sign-in occurs after the failed attempts and involves different applications, excluding common Office 365 services to reduce noise.
This rule detects interactive logons (LogonType 10) where a single account from the same domain logs into multiple distinct devices. This could indicate an attacker using compromised credentials to move laterally within the network or access multiple systems.
This rule detects successful SSH login attempts from external IP addresses (not within common private IP ranges). It specifically looks for 'Accepted' messages in syslog from the 'sshd' process and filters out internal source IPs.
This rule detects when a single user principal name (UPN) attempts five or more sign-ins from the same IP address within a one-hour window, and each sign-in is flagged with a 'RiskDetail' other than 'none' but still results in a 'Success' status. This could indicate an attacker attempting to bypass security controls or an account compromise where the attacker is repeatedly trying to access the account from a consistent location, possibly with different credentials or methods, until successful.
Detects a sequence of failed authentication attempts potentially indicative of an offline JWT secret brute-force attack (using tools like jwt_tool), followed by a successful authentication from the same source. This pattern suggests the adversary successfully recovered the secret, forged a valid token, and subsequently used it to gain unauthorized access.
Detects Active Directory logons (Event IDs 4624, 4768, 4769) originating from the Fortinet SSL VPN IP pool. In the context of the FortiBleed credential-harvesting campaign, attackers utilize compromised Fortinet VPN credentials to immediately pivot into internal Active Directory environments. Because pure Sigma rules evaluate a single log source, this rule targets the Windows AD telemetry. To achieve the highest fidelity, this rule should be correlated in your SIEM with FortiGate SSL VPN tunnel-up events (e.g., Event Code 32130, 39424) originating from anomalous external IPs for the same principal within a short time window.
Detects anomalous device code authentication sessions originating from non-corporate IP addresses using common command-line user agents, which are immediately followed by a device registration event by the same user. This pattern is indicative of OAuth device code phishing, where an attacker tricks a user into authorizing a malicious application to access their account.
Monitors successful sign-in events that utilize the OAuth 2.0 Device Code authorization protocol. While legitimate for headless applications or IoT devices, this flow is frequently abused by attackers for credential harvesting and phishing attacks to gain unauthorized access to user accounts and cloud resources.
This rule identifies successful user sign-ins originating from IP addresses known to belong to VPN services. It leverages an external list of VPN IP ranges to correlate with Azure AD SigninLogs. This can indicate an attempt to bypass geo-restrictions, hide true origin, or could be legitimate use of a VPN by an employee.
Detects a suspicious pattern where a user successfully authenticates via MFA, followed by another successful sign-in attempt for the same account within 10 minutes using a different IP address or user agent. This behavior is often indicative of session hijacking or adversary-in-the-middle (AiTM) attacks where a session token is stolen and replayed from an attacker-controlled environment.
Detects a critical authentication bypass in SimpleHelp servers (CVE-2026-48558) where an adversary leverages a forged OIDC identity token. The rule identifies the sequence of an unverified OIDC response, the failure to issue an MFA session token, successful group-level authentication without a challenge, and the subsequent registration of an unauthenticated '[New Anon]' identity.
This rule detects potential developer workstation compromise by monitoring for suspicious child process creation (shells/interpreters) from common development tools (Code.exe, node.exe, python.exe) followed by subsequent authentication to cloud environments (Azure, AWS, or GCP) within a 60-minute window. This behavior is indicative of a developer's machine being compromised to harvest session tokens or credentials to access cloud resources.
Detects potential identity pivoting by correlating signs of developer workstation compromise (e.g., shell spawning from IDE/node processes) with subsequent anomalous cloud console or API access from the same or associated identity within a short timeframe. This rule monitors both Azure Sign-in logs and AWS CloudTrail activity for suspicious patterns following endpoint indicators.
This rule detects a potential MFA fatigue attack by identifying users who experienced a high volume of denied MFA requests (5 or more) followed by at least one successful authentication within a 15-minute window across Okta and Azure Active Directory platforms.
Detects enumeration of Entra ID (Azure AD) users, groups, devices, and service principals using the Microsoft Graph API, specifically when performed by tools like AzureHound or Roadtx. The detection focuses on activity originating from sign-ins that bypassed MFA, potentially leveraging a hidden CA policy scope exclusion (CVE-2025-0309). The rule identifies suspicious user agents and a high volume of requests to multiple Graph API enumeration endpoints.
This rule detects authentication events for service accounts (matching patterns like 'svc', 'sa', 'service') originating from at least two different countries within a short time window (30 minutes or less), indicating potential credential compromise and anomalous geographic movement.
This rule monitors for successful and failed user authentication events (Logon events 4624 and 4625) occurring on Saturdays or Sundays. It calculates a risk score based on the volume of authentication attempts and classifies the activity, providing visibility into potential off-hours credential misuse or insider threat scenarios.
Detects signs of unauthorized persistence establishment on Cisco SD-WAN nodes (vManage, vSmart, vBond). This rule monitors for modifications to authorized_keys files, creation of suspicious local accounts (e.g., troot), and configuration changes to permit root SSH logins, which are known tactics used to maintain persistent backdoor access following exploitation.
Page 53 of 80