Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects when a user that doesn't have permissions to invite a guest user attempts to invite one.
Detects when PIM alerts are set to disabled.
Detects when changes are made to PIM roles
Detects when a user is added to a privileged role.
Monitor and alert for device registration or join events where MFA was not performed.
Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments.
If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted.
This can be a misconfigured application or potentially something malicious.
If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted.
This can be a misconfigured application or potentially something malicious.
Detects when an account is disabled or blocked for sign in but tried to log in
Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith.
Detects the addition of a new Federated Domain.
Detects when a Microsoft Cloud App Security reported when a user signs into your sanctioned apps from a risky IP address.
KQL Query from file: Admin consent for M365 Connector for Claude
Detects when a API token is created
Detects when a API Token is revoked.
KQL Query
KQL Query from file: M365 Connector for Claude Detection
Detects indicators of the TeamPCP LiteLLM supply chain compromise. This includes the creation or modification of specific malicious files (litellm_init.pth, tpcp.tar.gz, sysmon.py, sysmon.service), execution of commands related to persistence (systemctl for sysmon.service), data archiving (tar for tpcp.tar.gz), or direct execution of the backdoor (sysmon.py). It also identifies network connections or DNS queries to known command and control (C2) domains (models.litellm.cloud, checkmarx.zone) and HTTP requests to checkmarx.zone. Furthermore, the rule detects unauthorized AWS API calls (ListSecrets, GetSecretValue, DescribeParameters) made using the 'python-urllib' user agent, which is indicative of custom scripting rather than standard boto3 usage.
This rule detects activity associated with TruffleHog, an open-source tool used for finding credentials and sensitive data, within cloud audit logs. It specifically looks for the 'trufflehog' string in the user_agent field, indicating that the tool was used to interact with cloud resources.
Detects Azure AD application registrations with redirect URIs pointing to known tunneling, reverse proxy, or attacker interaction/callback infrastructure. This can indicate an adversary attempting to establish persistence or exfiltrate data.
Detects various sensitive configuration modifications in AWS that could indicate malicious activity, such as privilege escalation, defense evasion, or data exposure. This rule looks for a curated list of API calls related to changes in IAM, EC2 security groups, S3 bucket policies, and logging configurations.
Detects when an external user is invited to the Entra ID tenant. This could indicate legitimate collaboration or an attempt by an attacker to gain initial access or establish persistence by inviting a malicious external account.
Detects various sensitive configuration modifications in AWS that could indicate malicious activity, such as privilege escalation, defense evasion, or data exposure. This rule looks for a curated list of API calls related to changes in IAM, EC2 security groups, S3 bucket policies, and logging configurations.
Page 104 of 135