Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,666 detections
Filters
Last updated
All Time
Detection languages
1,077
189
170
102
53
Contributors
520
361
306
67
52
Categories
20,443
11,831
5,872
5,155
4,866
1,666
Platforms
1,091
591
441
252
122
Products / Services
1,130
476
189
125
117
MITRE Techniques
945
843
438
416
413
CVEs
12
12
9
6
5
IDS Classtypes
1
1
Hunts for unusual external SSH access patterns indicating Technique T1133
Hunts for unusual external SSH access patterns indicating Technique T1133
Identifies successful Entra ID sign-ins using the Device Code Flow from a geographic location not seen for that user in the last 30 days. The device code flow involves two separate interactions (the attacker's device and the victim's browser), so a mismatch between the sign-in location and the user's established locations is a strong indicator of a session hijacking attempt.
Detects when a VM Run Command is executed successfully, followed by the VM's Managed Identity authenticating to Azure Resource Manager. This pattern may indicate an attacker using Run Command to steal MI tokens for lateral movement.
Detects successful brute force attacks: 10+ login failures within 10 minutes followed by successful login within 1 hour, excluding trusted networks and whitelisted accounts
Detects successful VPN connections from various common security devices logging to CommonSecurityLog. Monitoring successful VPN logins is crucial for tracking remote access and identifying potential unauthorized access, especially when correlated with other events like logins from unusual locations or impossible travel scenarios.
This rule detects successful sign-ins to Azure Active Directory (AAD) from IP addresses outside of Australia and New Zealand, where the User-Agent string matches a list of known suspicious User-Agents. It filters out many legitimate User-Agents to reduce false positives, including those from Microsoft applications, mobile devices, and common tools.
Detects successful anonymous user logins on Windows systems. This activity can be legitimate for accessing public resources but is also commonly used by attackers for enumeration and unauthorized access (e.g., ZeroLogon).
Detects a successful user login from a country that is on a restricted or high-risk list. This can indicate account compromise or policy violation.
Detects Windows logon events where the account name starts with 'WAC_' and belongs to a domain outside of the organization's tenant. This pattern is a key indicator for CVE-2026-20965 exploitation, where an attacker uses a forged token from an external tenant to gain unauthorized access to a Windows Admin Center (WAC) managed machine.
Detects a user successfully logging in from multiple different countries within a short time frame (4 hours). This is a strong indicator of account takeover (T1078).
This rule detects successful sign-ins to Azure Active Directory (AAD) from IP addresses outside of New Zealand and Australia, where the User-Agent string matches a list of known suspicious User-Agents. It filters out many legitimate User-Agents to reduce false positives, including those from Microsoft applications, mobile devices, and common system services. The rule aims to identify potential unauthorized access attempts or compromised accounts leveraging unusual client software or scripts.
Detects Okta MFA device enrollment or life cycle changes that occur shortly after a successful authentication or password reset for the same user. This pattern is a strong indicator of a post-vishing account takeover, as seen in ShinyHunters campaigns.
This rule detects successful user sign-ins to Azure AD from IP addresses located outside of New Zealand and Australia, where the User-Agent string matches a known list of suspicious user agents. It filters out common legitimate user agents to reduce false positives.
Detects when a new Multi-Factor Authentication (MFA) method is registered shortly after a successful sign-in from an unfamiliar or risky location. This pattern is a strong indicator of an Adversary-in-the-Middle (AiTM) attack where the threat actor, having bypassed MFA to gain initial access, immediately adds their own authentication method to establish persistence on the account.
This rule detects successful SSO logins on FortiGate devices using usernames and source IP addresses associated with a known malicious campaign exploiting a SAML SSO bypass. The rule specifically looks for successful SSO logins (logid == "0100032001", method == "sso", status == "success") from a predefined list of malicious usernames or source IP addresses.
This rule detects when a system configuration file is downloaded from a FortiGate device within 60 seconds of a successful SSO login from the same user and source IP. This rapid sequence of events is indicative of automated scripts used by attackers to exfiltrate device configurations immediately after gaining initial access.
This detection identifies successful logon activity (Event ID 4624) on a device that has been reported as stolen or missing. Such activity is highly suspicious and could indicate unauthorized access. The rule enriches the alert with ISP IP information from Azure AD sign-in logs to aid in investigation.
This query detects suspicious sign-in activity from a user who has recently clicked on a phishing link. It correlates email click events with sign-in logs, identifying sign-ins from new or infrequent IP addresses after a user has interacted with a suspicious email. The rule uses configurable parameters for sender email addresses, sender domains, and subject keywords to identify phishing emails.
This rule detects successful sign-ins that used single-factor authentication and were flagged by Azure AD Identity Protection for having unfamiliar properties, such as a new location, device, or ASN. Single-factor authentication is inherently weaker, and when combined with anomalous sign-in properties, it can be an indicator of a compromised account.
Detects successful Microsoft 365 sign-ins using the OAuth 2.0 device code grant flow for applications with low prevalence. This technique is used by threat actors to gain unauthorized access to accounts, bypassing some MFA controls.
Page 69 of 80