Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,666 detections
Filters
Last updated
All Time
Detection languages
1,077
189
170
102
53
Contributors
520
361
306
67
52
Categories
20,443
11,831
5,872
5,155
4,866
1,666
Platforms
1,091
591
441
252
122
Products / Services
1,130
476
189
125
117
MITRE Techniques
945
843
438
416
413
CVEs
12
12
9
6
5
IDS Classtypes
1
1
sap impossible travel
YARA-L
Identifies two successful logons for the same User ID from two different geographic locations in a timeframe that is physically impossible to travel between, indicating credential sharing or theft.
This rule detects and monitors sign-in attempts to third-party Artificial Intelligence (AI) applications within an organization's environment. It identifies sign-ins to known AI vendors and tools by matching keywords in application display names and resource display names from Entra ID (formerly Azure AD) sign-in logs. The rule specifically excludes Microsoft's own Copilot products to focus on 'shadow AI' usage. It aggregates sign-in attempts, successes, failures, unique users, and common failure reasons to provide insights into the adoption and potential risks associated with unsanctioned AI tool usage.
Atypical Travel
Sigma
Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.
Monitor and alert for device registration or join events where MFA was not performed.
Detects risky authentication from a non AD registered device without MFA being required.
Monitor and alert for sign-ins where the device was non-compliant.
Monitor and alert for Sign-ins by unknown devices from non-Trusted locations.
Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith.
Detects when a Microsoft Cloud App Security reported when a user signs into your sanctioned apps from a risky IP address.
Detects when a successful MFA authentication occurs due to the use of a bypass code.
A bypass code is a temporary passcode created by an administrator for a specific user to access a Duo-protected application. These are generally used as "backup codes," so that enrolled users who are having problems with their mobile devices (e.g., mobile service is disrupted, the device is lost or stolen, etc.) or who temporarily can't use their enrolled devices (on a plane without mobile data services) can still access their Duo-protected systems.
A bypass code is a temporary passcode created by an administrator for a specific user to access a Duo-protected application. These are generally used as "backup codes," so that enrolled users who are having problems with their mobile devices (e.g., mobile service is disrupted, the device is lost or stolen, etc.) or who temporarily can't use their enrolled devices (on a plane without mobile data services) can still access their Duo-protected systems.
Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.
Detects logon events that specify new credentials
Hacktool Ruler
Sigma
This events that are generated when using the hacktool Ruler by Sensepost
KQL Query from file: M365 Connector for Claude Detection
This rule detects two related scenarios: 1. Device Code Phishing: Correlates successful device code authentications with subsequent device registrations for the same user within a short time frame. This can indicate an attacker using a phished device code to register a new device. 2. Primary Refresh Token (PRT) Device Registration: Identifies device registrations that occur after an authentication to the Device Registration Service using a Primary Refresh Token. This pattern is indicative of an attacker minting a PRT and then using it to register or join a device, potentially bypassing conditional access policies.
sap multi terminal logon
YARA-L
Identifies successful logons for the same User ID from multiple different terminal IDs or client hostnames in a short timeframe, indicating potential credential sharing or session theft.
This rule detects successful device registrations to the 'Device Registration Service' in Azure Entra. It specifically looks for sign-in events where the ResourceDisplayName is 'Device Registration Service', the ErrorCode is '0' (indicating success), and the ConditionalAccessStatus is not '1' (which typically means that conditional access did not block the authentication flow for device registration). The rule is pivotal for hunting devices registered for persistence, post-successful phishing campaign execution, where >= 1 accounts were compromised.
Detects authentication attempts utilizing a specific synthetic mobile user agent (iOS 18 paired with Safari Version/26.x) observed in the EvilTokens device code phishing campaign. Version 26 does not exist on iOS 18.
Detects when a single user account successfully signs in from two or more distinct IP addresses within a short timeframe. This can be an indicator of an adversary-in-the-middle (AiTM) attack where both the legitimate user and the attacker have active, authenticated sessions from different locations.
Detects the creation of a new computer account (Event ID 4741) where the creating user is a known service account used by FortiGate appliances. Attackers who compromise FortiGate devices can steal embedded LDAP credentials and use them to join rogue workstations to the domain, leveraging the `mS-DS-MachineAccountQuota` attribute.
This rule detects successful SSH login attempts from external IP addresses (not within common private IP ranges). It specifically looks for 'Accepted' messages in syslog from the 'sshd' process and filters out internal source IPs.
Page 67 of 80