Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects when a namespace-scoped identity creates, updates, or patches AWS or Azure IAM-related custom resources in Kubernetes. This pattern monitors for a 'confused deputy' scenario where a user might attempt to leverage high-privilege cloud operators (like ACK or ASO v2) that operate with a shared high-privilege identity to modify cloud IAM configurations.
Detects unauthorized or suspicious use of Google Cloud Config Connector (KCC) service accounts to apply high-privilege IAM roles ('roles/owner' or 'roles/resourcemanager.organizationAdmin') at the Organization or Folder scope. This rule monitors for 'SetIamPolicy' API calls where the principal is identified as a KCC-related service account, flagging potential exploitation of KCC's authority to grant excessive permissions.
Detects unauthorized or suspicious use of Google Cloud Config Connector (KCC) service accounts to apply high-privilege IAM roles ('roles/owner' or 'roles/resourcemanager.organizationAdmin') at the Organization or Folder scope. This rule monitors for 'SetIamPolicy' API calls where the principal is identified as a KCC-related service account, flagging potential exploitation of KCC's authority to grant excessive permissions.
Detects anomalous Agentforce session activity where a user, via the General CRM subagent, queries Lead records followed shortly by an access request to Account records. This pattern is indicative of a potentially hijacked agent session attempting to pivot from lead review into unauthorized data access of broader customer information.
Detects anomalous, high-frequency interaction with AI model endpoints characterized by a high volume of requests with a near 1:1 ratio of distinct inputs. This pattern is indicative of automated knowledge-distillation or model extraction attacks against AI services.
Detects outbound network traffic to Microsoft Graph API originating from a user-agent string identified as 'python-httpx'. This behavior is characteristic of automated scripts or malicious tools using Python libraries to interact with Microsoft cloud services, potentially for data exfiltration or unauthorized API interaction.
Detects modifications or creations of Azure DevOps pipelines and service connections, as well as pipeline executions performed outside of standard business hours (6 AM to 8 PM on weekdays). This activity is intended to identify potential unauthorized infrastructure or pipeline configuration changes that could indicate persistence or lateral movement via CI/CD pipelines.
Detects modifications or creations of Azure DevOps pipelines and service connections, as well as pipeline executions performed outside of standard business hours (6 AM to 8 PM on weekdays). This activity is intended to identify potential unauthorized infrastructure or pipeline configuration changes that could indicate persistence or lateral movement via CI/CD pipelines.
Detects bulk read operations on AWS Secrets Manager or similar cloud secret stores where the accessed resources contain keywords related to cryptocurrency custody, private keys, or wallet material. This pattern is indicative of unauthorized exfiltration attempts by threat actors such as Slim Spider targeting digital asset infrastructure.
This rule detects anomalous, high-volume activity from a single user account interacting with known public generative AI platforms (e.g., ChatGPT, Copilot, Claude). It uses a threshold-based approach on CloudAppEvents logs to identify potential reconnaissance or bulk information gathering activities which could signify unauthorized use or automated data scraping via AI interfaces.
This rule detects anomalous, high-volume activity from a single user account interacting with known public generative AI platforms (e.g., ChatGPT, Copilot, Claude). It uses a threshold-based approach on CloudAppEvents logs to identify potential reconnaissance or bulk information gathering activities which could signify unauthorized use or automated data scraping via AI interfaces.
This rule detects anomalous, high-volume activity from a single user account interacting with known public generative AI platforms (e.g., ChatGPT, Copilot, Claude). It uses a threshold-based approach on CloudAppEvents logs to identify potential reconnaissance or bulk information gathering activities which could signify unauthorized use or automated data scraping via AI interfaces.
Detects instances where a single user account exhibits an anomalously high frequency of requests to public generative-AI platforms within a one-hour window, potentially indicating automated reconnaissance or data staging activities using AI tools.
Detects instances where a single user account exhibits an anomalously high frequency of requests to public generative-AI platforms within a one-hour window, potentially indicating automated reconnaissance or data staging activities using AI tools.
Detects instances where a user account registers a new Multi-Factor Authentication (MFA) method (such as TOTP or Authenticator app) shortly (within 30 minutes) after a high-risk or potentially anomalous sign-in event. This pattern is commonly associated with adversary-in-the-middle (AiTM) phishing attacks where an attacker captures an authenticated session and uses it to enroll a secondary, attacker-controlled MFA device for persistent account access.
Detects instances where a user account registers a new Multi-Factor Authentication (MFA) method (such as TOTP or Authenticator app) shortly (within 30 minutes) after a high-risk or potentially anomalous sign-in event. This pattern is commonly associated with adversary-in-the-middle (AiTM) phishing attacks where an attacker captures an authenticated session and uses it to enroll a secondary, attacker-controlled MFA device for persistent account access.
Detects the creation of applications, service principals, or delegated permission grants in Entra ID where the initiating User-Agent string contains 'python-requests'. This pattern is often indicative of programmatic interaction with Microsoft Graph API using standard Python libraries, which may be associated with automated malicious registration chains or unauthorized application persistence.
Detects the creation of an application or service principal followed quickly (within 1 hour) by a tenant-wide delegated permission grant scoped to 'AllPrincipals' with 'openid' and 'profile' permissions. This sequence is a known indicator of automated rogue Enterprise Application setup, often used in consent phishing or persistence campaigns.
This rule identifies sign-in events using an External Authentication Method (EAM) that occur within the 2-day cache window immediately following a certificate or key credential update for an application or service principal in Entra ID. This detection highlights a timeframe where an attacker potentially possessing a compromised old signing key could use it to forge tokens before the Entra cache refreshes.
This rule detects potential account hijacking via OAuth device-code authorization flow, specifically identifying patterns associated with phishing kits (e.g., EvilTokens, ARToken). It monitors sign-in events where the device code flow is utilized, specifically flagging successful grants that potentially bypass standard interactive credential prompts.
Detects a sequence of events where a user performs a device-code authentication followed rapidly by a device enrollment, and subsequently continues to access cloud services (Microsoft Graph, Exchange Online, Intune) shortly after their account password has been reset. This pattern is indicative of persistent access maintained via a registered device or OAuth token that survives credential remediation.
Page 35 of 135