Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,666 detections
Filters
Last updated
All Time
Detection languages
1,077
189
170
102
53
Contributors
520
361
306
67
52
Categories
20,443
11,831
5,872
5,155
4,866
1,666
Platforms
1,091
591
441
252
122
Products / Services
1,130
476
189
125
117
MITRE Techniques
945
843
438
416
413
CVEs
12
12
9
6
5
IDS Classtypes
1
1
This rule detects suspicious activity involving Azure AD device registration followed by a sign-in from the same user and IP address, particularly when the user agent strings are indicative of non-standard clients (e.g., 'node', 'axios', 'undici', 'node-fetch'). This pattern can indicate an adversary attempting to establish persistence or bypass multi-factor authentication by registering a new device and then immediately using it for access.
This rule detects a successful Remote Desktop Protocol (RDP) login that is immediately preceded by 20 or more failed RDP authentication attempts from the same source IP to the same destination IP within a 15-minute window. This pattern is indicative of a brute force attack that has successfully compromised credentials.
Detects successful Microsoft Entra ID sign-ins originating from geographically distant locations within a short time period where the calculated travel speed exceeds realistic human travel limits (>900 km/h). The detection correlates consecutive sign-ins for the same user and identifies potential account compromise by validating device identifiers and trust attributes. Alerts are generated when a user authenticates from different countries, exceeds configured distance and speed thresholds, and uses a different or unknown device.
This rule detects a highly suspicious sequence of events in Microsoft Entra ID (formerly Azure AD) audit logs: a self-service password reset, followed by the registration of new security information, and then the deletion of existing security information, all performed by the same user within a short time window. This pattern is indicative of an attacker taking over an account, resetting the password, establishing their own MFA/security info, and then removing the legitimate user's security info to lock them out. This behavior has been observed in campaigns like Storm-2949.
This rule detects suspicious sign-in activity for a specific user principal name (UPN) within the last 7 days, immediately preceding a device wipe event. It focuses on identifying the actor's initial access or activity before initiating a mass device wipe.
Kali365 PHaaS Device Code Detection
Cortex XDR
This rule detects potential device code phishing attempts by correlating a device code flow initiated from an unmanaged/non-compliant device with a suspicious user agent (e.g., 'python-requests' or '-live') and an 'unbound' signInTokenProtectionStatus, with a subsequent 'Cmsi:Cmsi' token replay event for the same user. This combination suggests a successful device code phishing attack where an adversary has obtained and is replaying a token after the victim has authenticated.
Monitors Cisco Catalyst SD-WAN Controller logs for successful administrative logins. This may indicate exploitation of an authentication bypass vulnerability granting unauthorized admin access.
Detects authentication or privilege escalation events where a user account that is normally unprivileged suddenly reports as UID 0. This is a direct artifact of modifying the page cache of /etc/passwd in memory, which is the primary post-exploitation phase of the Copy Fail vulnerability (CVE-2026-31431).
This rule detects login events with a high-risk score (0.8 or greater) as determined by the 'castle' log source. It normalizes event and risk fields to ensure consistent detection.
This rule detects successful sign-ins to specific Microsoft 365 applications (identified by ApplicationId '08ad6f98-a4f8-4635-bb8d-f1a3044760f0' or '07c030f6-5743-41b7-ba00-0a6e85f37c17') from devices that have previously established a network connection with a process named 'cowork-svc'. The rule correlates network connection events with Azure AD sign-in events over a 30-day lookback period to identify potentially legitimate or suspicious activity related to 'cowork-svc' application usage.
This rule detects suspicious sign-in activity for a specific user principal name (UPN) within the last 7 days, immediately preceding a device wipe event. It focuses on identifying the actor's initial access or activity before initiating a mass device wipe.
Detects 5 or more failed logins to a firewall management interface, followed immediately by a successful login for the same user and from the same IP.
Detect when users are authenticating without MFA being required.
Detects successful sign-ins using the axios/1.7.9 user agent. Storm-2755 uses this to replay stolen session tokens and maintain persistence via automated sign-ins approximately every 30 minutes. The rule filters for successful authentications and requires at least two authentications from the same user, IP, and user agent within the time window to identify the repeated automated persistence loop.
Detects when an Okta user session starts where the user is behind an anonymising proxy service.
Detect remote login by Administrator user (depending on internal pattern).
Detects successful AWS console logins that were performed without Multi-Factor Authentication (MFA).
This alert can be used to identify potential unauthorized access attempts, as logging in without MFA can indicate compromised credentials or misconfigured security settings.
This alert can be used to identify potential unauthorized access attempts, as logging in without MFA can indicate compromised credentials or misconfigured security settings.
Detects sign-in with properties that are unfamiliar to the user. The detection considers past sign-in history to look for anomalous sign-ins.
Detects the attack technique pass the hash which is used to move laterally inside the network
Detects successful authentication from potential clients using legacy authentication via user agent strings. This could be a sign of MFA bypass using a password spray attack.
Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.
Page 66 of 80