Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects anomalous access to email items in Microsoft 365 Exchange environments by monitoring the 'MailItemsAccessed' operation. The rule flags specific, non-standard pairings of 'ClientAppId' and 'APIId' associated with malicious activity, indicating potential unauthorized data collection or exfiltration by attackers bypassing standard Outlook client behavior.
Detects suspicious O365 'MailItemsAccessed' activity using a specific OAuth application (AppId c999ed3e-27ae-4cb3-b3a2-46b056af63d3) and ClientId (5d661950-3475-41cd-a2c3-d671a3162bc1) with an 'Bind' operation type. This pattern is often associated with unauthorized email access across multiple tenant accounts. The rule triggers when at least 5 events are detected across 2 or more distinct tenant accounts within a 1-minute window, using a specific Firefox user agent.
Detects anomalous 'Bind' operations in Microsoft 365 Exchange Online audit logs where the user-agent string includes 'Firefox/131.0' and 'Client=REST' while using specific Microsoft Outlook ClientAppId and APIId parameters. This pattern has been observed in automated, cross-tenant mailbox exfiltration campaigns targeting sensitive payroll and financial documentation.
Detects sign-in events using the OAuth 2.0 device code flow, which is a mechanism often abused in phishing campaigns (such as GhostCode) to lure users into authorizing malicious applications or granting access tokens without needing their actual credentials.
Detects 'GetSecretValue' API calls to AWS Secrets Manager originating from programmatic agents like Boto3, Python requests, or the AWS CLI. This monitors for automated retrieval of stored secrets, which may indicate unauthorized credential access or exfiltration from an AWS environment.
Detects potentially malicious OAuth device code sign-ins by identifying sign-in events that exhibit anomalous characteristics, such as atypical geographic locations, rare client-application combinations, unmanaged/noncompliant device status, or elevated risk signals associated with the account. This detection helps identify account compromise or malicious OAuth consent activity often associated with 'EvilTokens' or device-code phishing attacks.
Detects potential device code phishing patterns where a successful OAuth device-code authentication is rapidly followed by Microsoft Graph resource access from the same account. The rule identifies suspicious polling sessions (e.g., EvilTokens) by monitoring for successful device-code sign-ins and immediate, subsequent Graph API activity. It filters known first-party applications and incorporates risk-based triggers and reconnaissance behavioral patterns to minimize false positives.
Detects potential abuse of stolen OAuth session tokens, where refresh tokens are used to authenticate after a user has performed a password reset. This rule identifies accounts that continue to sign in from previously unseen devices or IP addresses within 24 hours post-password reset, a technique consistent with session persistence mechanisms used by adversary tools and platforms like EvilTokens.
Detects the scripted, non-human-paced registration of a rogue external authentication method by monitoring a sequence of specific Azure Audit Log operations (Add application, Add service principal, Add delegated permission grant) occurring within 60 seconds of each other by the same actor. The detection is further corroborated by analyzing Microsoft Graph Activity Logs for associated Python requests to specific Graph API URIs.
Detects the scripted, non-human-paced registration of a rogue external authentication method by monitoring a sequence of specific Azure Audit Log operations (Add application, Add service principal, Add delegated permission grant) occurring within 60 seconds of each other by the same actor. The detection is further corroborated by analyzing Microsoft Graph Activity Logs for associated Python requests to specific Graph API URIs.
Detects the scripted, non-human-paced registration of a rogue external authentication method by monitoring a sequence of specific Azure Audit Log operations (Add application, Add service principal, Add delegated permission grant) occurring within 60 seconds of each other by the same actor. The detection is further corroborated by analyzing Microsoft Graph Activity Logs for associated Python requests to specific Graph API URIs.
Detects when a user has been elevated to manage all Azure Subscriptions.
This change should be investigated immediately if it isn't planned.
This setting could allow an attacker access to Azure subscriptions in your environment.
This change should be investigated immediately if it isn't planned.
This setting could allow an attacker access to Azure subscriptions in your environment.
This rule monitors authentication activity within Microsoft Entra ID (formerly Azure AD) involving the Device Code flow. This flow is often abused by attackers through phishing to obtain access tokens. The rule detects and lists occurrences of authentication attempts leveraging the device code grant, facilitating the investigation of potentially malicious token acquisition or replay attacks.
Detects high-volume API requests to Exchange REST services using a specific application ID or Outlook Web branding, where the account object ID is missing. This pattern is indicative of potential OAuth token abuse, where an attacker utilizes a stolen token to perform automated actions without the presence of a legitimate user session.
This rule hunts for indicators associated with the TrustSink technique, which involves using rogue External Authentication Methods (EAM) or malicious OIDC providers to bypass authentication or maintain persistence within a cloud environment. It monitors Azure AD sign-in and audit logs, alongside DNS and network events, for references to known malicious domains and URLs used for EAM-based attacks.
Detects npm package publishing events performed via GitHub Actions OIDC trusted publishing that occur without the use of a traditional npm token. This rule targets potentially unauthorized package releases triggered by automated CI/CD identities, which may indicate abuse of compromised workflows or misconfigured auto-publish settings.
This rule detects forced pushes to the main branch of a GitHub repository where a specific file named 'indexe.cjs' is added or a specific commit ID (d1d55e13) is pushed. This behavior is indicative of a supply chain compromise where an attacker rewrites git history to inject malicious loaders or backdoors into the source code.
Detects the use of specific malicious versions (v2.2.1) of GitHub Actions (actions-cool/issues-helper or actions-cool/maintain-one-comment) in workflow runs that also involve the exposure or referencing of the GITHUB_TOKEN, indicating potential credential theft and CI/CD pipeline compromise.
Detects the use of specific malicious versions (v2.2.1) of GitHub Actions (actions-cool/issues-helper or actions-cool/maintain-one-comment) in workflow runs that also involve the exposure or referencing of the GITHUB_TOKEN, indicating potential credential theft and CI/CD pipeline compromise.
Detects the use of specific malicious versions (v2.2.1) of GitHub Actions (actions-cool/issues-helper or actions-cool/maintain-one-comment) in workflow runs that also involve the exposure or referencing of the GITHUB_TOKEN, indicating potential credential theft and CI/CD pipeline compromise.
Detects a specific pattern indicative of malicious GitHub Actions reactivation. The rule identifies a workflow run that fails quickly (e.g., due to repository access issues) followed immediately by a successful run of the same workflow with a significantly longer duration. This behavior is consistent with resolving issues related to malicious actions-cool repository workflows.
Page 42 of 135