Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,666 detections
Filters
Last updated
All Time
Detection languages
1,077
189
170
102
53
Contributors
520
361
306
67
52
Categories
20,443
11,831
5,872
5,155
4,866
1,666
Platforms
1,091
591
441
252
122
Products / Services
1,130
476
189
125
117
MITRE Techniques
945
843
438
416
413
CVEs
12
12
9
6
5
IDS Classtypes
1
1
Detects a successful SSO administrative login followed by a system configuration download from the same user and source IP address within 5 minutes. This sequence is a strong indicator of compromise related to CVE-2025-59718 and CVE-2025-59719.
This rule detects successful administrative logins to Fortinet devices (FortiGate, FortiWeb, FortiProxy, FortiSwitchManager) that leverage the FortiCloud SSO mechanism from an IP address not on an allowlist. This could indicate exploitation of CVE-2025-59718 and CVE-2025-59719, which allow for an authentication bypass.
Detects when an internal user successfully authenticates as a guest to an external Microsoft Teams tenant. This could be legitimate B2B collaboration, but it can also be abused by attackers to lure users into a malicious tenant where security controls (like Safe Links/Safe Attachments) are not enforced.
Detects when an internal user successfully authenticates as a guest to an external Microsoft Teams tenant. This could be legitimate B2B collaboration, but it can also be abused by attackers to lure users into a malicious tenant where security controls (like Safe Links/Safe Attachments) are not enforced.
Detects a pattern indicative of an NTLM relay attack following an authentication coercion spray. The rule first identifies a single source IP generating a high volume of failed NTLM logon attempts across multiple critical servers in a short time. It then looks for a subsequent successful NTLM logon from that same source IP to a high-value target (like a Certificate Authority) using a machine account. This sequence is a strong indicator that an attacker coerced credentials and is now relaying them to escalate privileges.
This rule detects a high number of failed authentication attempts followed by a successful authentication from the same source IP address and user. It specifically looks for events categorized as 'Insecure_Authentication' within the 'Authentication' datamodel. The rule aggregates authentication events by source IP, user, destination, application, caller user name, target user name, logon type, event code, signature, tag, action, authentication method, authentication service, vendor product, and user priority. It then filters for scenarios where there are more than 5 failures and more than 1 success for the same aggregated criteria.
Query sign-ins with MFA success immediately following multiple failed sign-ins from different regions. Potential session hijack or AiTM (Adversary-in-the-Middle).
Error Code 0
Successful authentication
Normal successful login (validate carefully only when paired with suspicious failures)
Error Code 50053
Account locked or malicious IP
HIGH - Brute force attempts
Error Code 50074
MFA challenge not passed
HIGH - User failed MFA
Error Code 500121
MFA prompt timeout
MEDIUM - Possible MFA fatigue indicator
Error Code 50133
Session revoked or SSO artifact invalid
HIGH - Session hijacking indicator
Error Code 50076
MFA required but not provided
MEDIUM - Possible MFA bypass attempt
Error Code 0
Successful authentication
Normal successful login (validate carefully only when paired with suspicious failures)
Error Code 50053
Account locked or malicious IP
HIGH - Brute force attempts
Error Code 50074
MFA challenge not passed
HIGH - User failed MFA
Error Code 500121
MFA prompt timeout
MEDIUM - Possible MFA fatigue indicator
Error Code 50133
Session revoked or SSO artifact invalid
HIGH - Session hijacking indicator
Error Code 50076
MFA required but not provided
MEDIUM - Possible MFA bypass attempt
* Compare distances and times of consecutive sign-ins for the same user.
* Flag events where travel speed exceeds physical limits as potential unauthorized access.
Example: Same user signing in from Chennai to Mumbai (India) in 30 minutes triggers an alert.
Distance - 5,560 km.
Required speed - 11,000 km/h
The event is flagged as impossible travel.
* Flag events where travel speed exceeds physical limits as potential unauthorized access.
Example: Same user signing in from Chennai to Mumbai (India) in 30 minutes triggers an alert.
Distance - 5,560 km.
Required speed - 11,000 km/h
The event is flagged as impossible travel.
This rule detects new device registrations in Azure Active Directory (AAD) that originate from an IP address not previously associated with the user's account within the last 29 days. It filters out registrations from corporate IP ranges and common mobile operating systems (iOS, Android) to reduce noise. The rule categorizes the risk level of the IP address based on historical sign-in counts, focusing on 'High Risk - New IP' events. It then enriches these events with additional sign-in details like device name, risk level during sign-in, country, and city.
Detects when a successful multi-factor authentication (MFA) occurs due to the use of a bypass code in Cisco Duo. Bypass codes are temporary passcodes created by administrators for specific users to access Duo-protected applications, typically used as backup codes when users cannot use their enrolled devices. This rule identifies instances where such a bypass code facilitates a successful authentication.
Detects a suspicious Salesforce OAuth login followed by high-volume data exfiltration activity within a short period. This pattern is associated with the threat actor UNC6040, which uses malicious or compromised OAuth applications to steal data.
This rule detects potential Pass the Hash (PtH) activity by monitoring Windows Security Event IDs 4624 (successful logon) and 4625 (failed logon) where the LogonType is 3 (Network) and the LogonProcessName is 'NtLmSsp'. It specifically filters out 'ANONYMOUS LOGON' to reduce false positives. This combination of events indicates an attempt to authenticate over the network using NTLM, which is characteristic of PtH attacks for lateral movement.
Detects successful authentication attempts originating from clients using legacy authentication methods, identifiable via specific user agent strings. This activity can indicate an adversary attempting to bypass multi-factor authentication (MFA), potentially as part of a password spray attack. Legacy authentication protocols often do not support modern MFA mechanisms, making them a target for attackers who have obtained valid credentials through other means or are performing brute-force attacks like password spraying.
Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith. The rule specifically looks for 'UserLoggedIn' operations with 'Success' status for the Microsoft Intune Company Portal ApplicationId, while excluding a specific ObjectId often associated with mobile device enrollment to reduce false positives.
Detects the registration of a new device or MFA authentication method in Microsoft Entra ID from an IP address geolocated to Morocco or associated with specific Moroccan ASNs. This is a persistence tactic used by the Jingle Thief group (also tracked as Atlas Lion and STORM-0539).
Detects successful AWS console logins that were performed without Multi-Factor Authentication (MFA). This alert can be used to identify potential unauthorized access attempts, as logging in without MFA can indicate compromised credentials or misconfigured security settings.
Detects successful sign-ins by privileged role accounts that occur outside of normal business hours or from unusual geographic locations. This rule is designed to flag potentially suspicious activity that could indicate compromised credentials or insider threat activity, especially for administrative accounts.
This rule detects successful sign-in attempts to Azure AD from devices that are not registered in Active Directory (non-compliant devices) and where Multi-Factor Authentication (MFA) was not required. The sign-in is also flagged as 'atRisk' by Azure AD. This scenario can indicate an adversary attempting to gain initial access or maintain persistence using compromised credentials from an unregistered device, bypassing stronger authentication controls.
This rule detects a measurable increase of successful authentications, specifically when the count of successful sign-ins increases by 10% or greater. This could indicate an adversary attempting to gain access through brute-force, password spraying, or credential stuffing attacks, or potentially an increase in legitimate user activity that needs to be baselined.
This rule detects suspicious sign-in activities that occur shortly after a network connection to an IP address associated with 'Lab539 Clickfix'. It correlates risky sign-in events from Azure Active Directory (AAD) with network connection logs from devices. Specifically, it looks for AAD sign-ins with a risk level of 30 or higher, from non-guest, non-compliant, and non-managed devices, where the IP address has not been seen for that user in the last 30 days. This is then joined with network connection events to IP addresses found in the 'Lab539 Clickfix' external data, ensuring the sign-in occurs after the network connection within a short timeframe. The 'Lab539 Clickfix' reference suggests a connection to a known threat or campaign, possibly related to phishing or credential compromise.
Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior, often associated with tools like Mimikatz's sekurlsa::pth module. This indicates an adversary is using stolen password hashes to authenticate to a system.
Page 70 of 80