Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects a specific pattern indicative of malicious GitHub Actions reactivation. The rule identifies a workflow run that fails quickly (e.g., due to repository access issues) followed immediately by a successful run of the same workflow with a significantly longer duration. This behavior is consistent with resolving issues related to malicious actions-cool repository workflows.
Detects a specific pattern indicative of malicious GitHub Actions reactivation. The rule identifies a workflow run that fails quickly (e.g., due to repository access issues) followed immediately by a successful run of the same workflow with a significantly longer duration. This behavior is consistent with resolving issues related to malicious actions-cool repository workflows.
Detects a specific pattern indicative of malicious GitHub Actions reactivation. The rule identifies a workflow run that fails quickly (e.g., due to repository access issues) followed immediately by a successful run of the same workflow with a significantly longer duration. This behavior is consistent with resolving issues related to malicious actions-cool repository workflows.
Detects a specific pattern indicative of malicious GitHub Actions reactivation. The rule identifies a workflow run that fails quickly (e.g., due to repository access issues) followed immediately by a successful run of the same workflow with a significantly longer duration. This behavior is consistent with resolving issues related to malicious actions-cool repository workflows.
Detects the suspicious reactivation of 'actions-cool/issues-helper' or 'actions-cool/maintain-one-comment' repositories within a known malicious window (September 14-19, 2026). These repositories were involved in the 'Mini Shai-Hulud' supply-chain attack. This rule identifies when previously disabled repositories are re-enabled or modified to become active, potentially re-exposing malicious release tags to downstream users.
Detects the suspicious reactivation of 'actions-cool/issues-helper' or 'actions-cool/maintain-one-comment' repositories within a known malicious window (September 14-19, 2026). These repositories were involved in the 'Mini Shai-Hulud' supply-chain attack. This rule identifies when previously disabled repositories are re-enabled or modified to become active, potentially re-exposing malicious release tags to downstream users.
Detects the suspicious reactivation of 'actions-cool/issues-helper' or 'actions-cool/maintain-one-comment' repositories within a known malicious window (September 14-19, 2026). These repositories were involved in the 'Mini Shai-Hulud' supply-chain attack. This rule identifies when previously disabled repositories are re-enabled or modified to become active, potentially re-exposing malicious release tags to downstream users.
Detects high-volume, automated enumeration of cloud resources (SharePoint, OneDrive, or Exchange) via Graph API or search queries immediately following a user sign-in event. This behavior is indicative of session hijacking (token replay) followed by unauthorized scripted discovery, as opposed to legitimate user browsing activity.
This rule detects unauthorized mailbox access by identifying specific ClientAppId and API ID pairs known to be associated with an Office 365 email exfiltration toolkit. This activity is indicative of an attacker attempting to programmatically access or exfiltrate sensitive email data from the organization's environment.
Detects anomalous, high-volume access to email items by specific applications known to be associated with suspicious activity or unusual access patterns within the Exchange environment, potentially indicating email harvesting or data exfiltration.
Detects sign-ins to Office Home or Office365 applications from unmanaged or unknown devices, followed by an unusual amount or variety of activity within SharePoint Online or OneDrive for Business within a two-hour window. This behavior is indicative of potential unauthorized access or account compromise where an actor is using a non-corporate device to interact with sensitive cloud documents.
Detects anomalous authentication patterns in Microsoft 365 logs where a valid session is utilized across multiple distinct devices within a short timeframe (under 5 minutes) without a corresponding multi-factor authentication (MFA) challenge. This behavior is indicative of a session token replay attack, where an adversary uses a stolen session cookie to bypass MFA and access cloud services.
Detects potential device-code phishing abuse where a successful device code authentication is followed by scripted API activity using common automation user agents within a short time window (10 minutes). This behavior is indicative of an attacker who has successfully phished a user's device code and is immediately leveraging the stolen token to interact with Microsoft Graph, Azure, or Intune services.
Detects anomalous AI orchestration or API gateway activity that suggests potential command and control (C2) communication. The rule monitors for unauthorized external endpoints, high-frequency low-payload beaconing patterns, and unauthorized cross-tenant agent-to-agent calls.
Detects anomalous spikes in AI/ML API usage for specific callers, including request volume, token count, and estimated costs, relative to a 7-day historical baseline. This activity is indicative of Cost Harvesting or Resource Exhaustion against pay-per-use AI services, mapped to the MITRE ATLAS framework.
Detects anomalous query patterns against an AI inference API, characteristic of a membership inference attack. The rule identifies callers submitting a high volume of near-duplicate or minimally-perturbed inputs while requesting raw confidence scores, suggesting an attempt to probe the model to determine if specific data points were used in its training set.
Detects anomalous usage patterns for AI-platform API keys consistent with account takeover, specifically identifying concurrent multi-geographic access and the exercise of elevated administrative, write, or model-registry scopes within a short timeframe.
This rule detects when a user grants OAuth application permissions for high-risk scopes (e.g., Mail, Files) to an application that was registered within the last 7 days. It correlates this event with subsequent suspicious actions performed by the same user, specifically mailbox rule modifications or file download activity, which are common indicators of post-compromise activity following OAuth consent phishing.
Detects Azure AD sign-in events using the device code authorization flow where only single-factor authentication was performed. This pattern is indicative of potential device code phishing attacks where users are tricked into entering codes on attacker-controlled pages to grant access tokens, bypassing standard MFA requirements.
Detects the granting of highly privileged OAuth or API scopes to AI-related applications (such as Copilot plugins, browser-automation agents, or AI connectors) immediately followed by high-volume data access activities (file reads or email transfers) performed by the same user account. This behavior is indicative of an attacker weaponizing a compromised identity to grant an external AI agent broad access to sensitive data for exfiltration or automated reconnaissance.
Detects the granting of highly privileged OAuth or API scopes to AI-related applications (such as Copilot plugins, browser-automation agents, or AI connectors) immediately followed by high-volume data access activities (file reads or email transfers) performed by the same user account. This behavior is indicative of an attacker weaponizing a compromised identity to grant an external AI agent broad access to sensitive data for exfiltration or automated reconnaissance.
Page 43 of 135