Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,666 detections
Filters
Last updated
All Time
Detection languages
1,077
189
170
102
53
Contributors
520
361
306
67
52
Categories
20,443
11,831
5,872
5,155
4,866
1,666
Platforms
1,091
591
441
252
122
Products / Services
1,130
476
189
125
117
MITRE Techniques
945
843
438
416
413
CVEs
12
12
9
6
5
IDS Classtypes
1
1
This rule detects potential OAuth token abuse by correlating credential consent grants with subsequent unusual cloud access patterns from different geographic locations. It looks for activities like adding a service principal, adding OAuth2 permission grants, or consenting to an application, followed by access to specific cloud applications (Salesforce, Drift, Slack, Microsoft 365, Workday) from an IP address that does not match the IP address from which the consent was granted. The rule aggregates these events and triggers if there are at least 4 related events within a 6-hour window.
Detects the Pony malware credential harvesting sequence where a non-system process performs repeated interactive logon attempts (LogonUserA dictionary brute force via NetUserEnum) against local accounts and achieves at least one successful logon, after which LoadUserProfileA is used to impersonate the compromised account and harvest profile-scoped credentials.
Detects successful user authentications originating from known EvilToken infrastructure hosted on HZ Hosting. This activity is indicative of potential credential compromise or phishing attacks leveraging this specific infrastructure.
Detects successful user authentications originating from IP addresses associated with known EvilToken infrastructure hosted on Railway.com. This indicates potential compromise of user accounts via phishing or other credential access techniques, where the adversary is using their infrastructure to authenticate.
Detects the exchange of FOCI refresh tokens across the Microsoft app family, a tactic utilized by Tycoon 2FA. This KQL query identifies successful sign-ins where a single user's session (CorrelationId) interacts with more than 3 distinct applications within a 5-minute window, indicating potential token abuse.
Detects anomalous access to Privileged Access Management (PAM) platforms (e.g., CyberArk, BeyondTrust, Delinea, HashiCorp Vault, Thycotic, ARCON PAM). The rule identifies successful sign-ins occurring outside typical business hours (7 AM to 7 PM) that also exhibit either a high volume of sign-ins (more than 5 per hour per user/app) or access from multiple new IP addresses (more than 2 unique IPs per hour per user/app). This behavior is indicative of potential abuse of privileged accounts, possibly by threat actors like Silk Typhoon (HAFNIUM).
Identifies login attempts from RedVDS infrastructure IPs deliberately utilizing legacy authentication protocols (IMAP/POP3) to bypass Modern Authentication Conditional Access policies.
Detects successful user authentications originating from known malicious IP addresses associated with EvilToken infrastructure hosted on Railway.com. This indicates potential compromise via phishing or other credential theft methods.
Detects a user interrupt error (50199) followed by a successful authentication within 5 minutes, a pattern observed in device code phishing attacks. This rule specifically looks for sign-in logs where both error code 0 (success) and 50199 (user interrupt) occur for the same user and correlation ID within a 5-minute window.
Detects rapid non-interactive sign-ins utilizing refresh tokens from known VPS hosting providers. This rule identifies a high volume of successful non-interactive sign-ins (more than 20 within a 10-minute window) from a single user and IP address, indicating potential abuse of refresh tokens, possibly from a compromised cloud VPS.
This rule detects potential automated credential stuffing attempts followed by successful authentication and subsequent access to sensitive/privileged APIs within Azure/Entra ID environments. It correlates multiple failed login attempts for service-oriented account names (e.g., svc, api, bot) with a successful login from the same user shortly thereafter, followed by privileged API operations (e.g., KeyVault secret access, user management) within a short time window.
Identifies successful device code authentication flows where the client application is masquerading as a Microsoft Office client. This technique is commonly used by Phishing-as-a-Service (PhaaS) kits like EvilTokens for account takeover, by tricking users into authenticating a malicious application through a device code flow.
Detects unauthorized GlobalProtect VPN logins from known malicious IPs.
Monitors for device code authentication via uncommon Family of Client IDs (FOCI) applications. This rule identifies successful device code authentications where the application ID (AppId) has been observed fewer than 5 times, indicating potentially rare or newly introduced applications. This could be indicative of an adversary attempting to use a malicious application for device code phishing.
This rule detects successful sign-ins using OAuth from residential IP addresses. It joins `SigninLogs` with `IdentityLogonEvents` to correlate successful OAuth authentications with user logon events. The intent is to identify potentially suspicious access, possibly indicating credential abuse or unauthorized access attempts from non-corporate or unexpected locations.
Detects potential credential access attempts indicative of infostealer activity or brute-force attacks, where an account experiences multiple failed login attempts followed by a successful login within a defined timeframe (5 minutes to 8 hours). This pattern suggests an adversary may be using stolen credentials or attempting to brute-force an account.
This rule detects suspicious sign-in attempts to Azure AD where Conditional Access policies were not applied, the sign-in was successful, and the user agent string indicates a bot, crawler, headless browser, or common scripting tools like curl, wget, or python. It specifically looks for multiple such logins or logins from multiple unique devices within a 5-minute window for the same user and risk detail.
Okta Impossible Travel Detection
Cortex XDR
Detects when a single user successfully authenticates to Okta from two different countries within a two-hour window, indicating potential impossible travel which could be a sign of a compromised account.
This rule detects suspicious sign-in attempts to Azure AD where Conditional Access policies were not applied, the sign-in was successful, and the user agent string indicates a bot, crawler, headless browser, or common scripting tools like curl, wget, or python. It specifically looks for multiple such logins or logins from multiple unique devices within a 5-minute window for the same user and risk detail.
Detects potential credential access attempts indicative of infostealer activity or brute-force attacks, where an account experiences multiple failed login attempts followed by a successful login within a defined timeframe (5 minutes to 8 hours). This pattern suggests an adversary may be using stolen credentials or attempting to brute-force an account.
Detects unauthorized GlobalProtect VPN logins from known malicious IPs.
Page 63 of 80