Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects anomalous, high-velocity enumeration of IAM entities and cloud infrastructure resources by a single principal within a 5-minute window. This behavior is consistent with automated reconnaissance performed by agentic AI or scripted tools, often used to map cloud environments prior to exploitation.
Detects high-privilege OAuth application consent grants occurring shortly after a user identity recovery event (e.g., password or MFA reset). This pattern is indicative of a help-desk social engineering attack where an adversary uses an identity reset to gain access to an account and subsequently establishes persistent access via a malicious OAuth application.
This rule monitors for the creation or modification of inbox rules in Microsoft 365 that contain financial-related keywords (e.g., 'payment', 'wire', 'invoice') and disruptive actions such as deleting, moving, forwarding, or redirecting messages. These patterns are characteristic of Business Email Compromise (BEC) attacks, where adversaries attempt to conceal financial correspondence from the victim to facilitate fraudulent transactions.
This rule detects potentially malicious Microsoft Graph API activity, such as the enumeration of directory roles, groups, applications, or service principals. It identifies patterns indicative of token theft or unauthorized access by flagging scripted clients (non-browser agents) or accounts showing anomalous behavior (multiple IPs/agents) performing rapid or repetitive enumeration queries.
Detects instances where Microsoft 365 Copilot surfaces content labeled with sensitivity markings to a user who only has access to that content via inherited or broad sharing permissions (e.g., Company link, Anonymous link, or inherited permissions), rather than explicit access. This identifies potential AI-retrieval exploitation patterns where Copilot inadvertently exposes sensitive information due to oversharing configurations.
This rule detects high-risk administrative operations in Azure Active Directory (such as role assignment, password resets, and account status changes) that occur within 3 hours of a user's sign-in. This pattern often indicates an account compromise followed by immediate privilege escalation or persistence establishment.
Detects the granting of highly privileged OAuth or API scopes to AI-related applications (such as Copilot plugins, browser-automation agents, or AI connectors) immediately followed by high-volume data access activities (file reads or email transfers) performed by the same user account. This behavior is indicative of an attacker weaponizing a compromised identity to grant an external AI agent broad access to sensitive data for exfiltration or automated reconnaissance.
Detects anomalous, high-velocity enumeration of IAM entities and cloud infrastructure resources by a single principal within a 5-minute window. This behavior is consistent with automated reconnaissance performed by agentic AI or scripted tools, often used to map cloud environments prior to exploitation.
Detects high-privilege OAuth application consent grants occurring shortly after a user identity recovery event (e.g., password or MFA reset). This pattern is indicative of a help-desk social engineering attack where an adversary uses an identity reset to gain access to an account and subsequently establishes persistent access via a malicious OAuth application.
Detects anomalous Agentforce session activity where a user, via the General CRM subagent, queries Lead records followed shortly by an access request to Account records. This pattern is indicative of a potentially hijacked agent session attempting to pivot from lead review into unauthorized data access of broader customer information.
Detects anomalous Agentforce session activity where a user, via the General CRM subagent, queries Lead records followed shortly by an access request to Account records. This pattern is indicative of a potentially hijacked agent session attempting to pivot from lead review into unauthorized data access of broader customer information.
Detects anomalous Agentforce session activity where a user, via the General CRM subagent, queries Lead records followed shortly by an access request to Account records. This pattern is indicative of a potentially hijacked agent session attempting to pivot from lead review into unauthorized data access of broader customer information.
This rule detects potentially suspicious reconnaissance activity against the Microsoft Graph API. It monitors for high volumes of diverse requests originating from a single account within a 30-minute window, specifically targeting multiple distinct object types such as users, groups, sites, and applications. Such behavior is indicative of an adversary attempting to enumerate or map the target cloud environment.
This rule detects potential cloud service enumeration activity originating from a specific, potentially malicious IP address (23.234.84.102). It flags instances where this source IP performs specific API calls ('GetCallerIdentity' and 'ListTopics') without expected user-agent strings typical of legitimate AWS service traffic.
Detects instances where a removed GitHub organization member performed bulk repository access (cloning or downloading) shortly before their removal, potentially indicating exploitation of retained access by a departed employee or an adversary using a valid account before deprovisioning. The rule identifies activity occurring more than 24 hours prior to removal involving multiple repositories or multiple access actions.
Detects instances where a user performs sensitive privilege escalation or administrative modifications (e.g., adding roles, consent to applications) within two hours of authenticating via the Entra ID device-code flow. This correlation is often indicative of OAuth application device-code phishing or token abuse, where an attacker tricks a user into granting permissions to a malicious application.
Detects high-volume activity (BLOCK or COUNT actions) from the AWS Shield Advanced managed DDoS protection rule set within a 1-minute time window. The rule alerts on potential Layer 7 DDoS attacks by monitoring for significant spikes in event volume or the number of unique source IP addresses targeting a specific AWS WAF Web ACL.
Detects the rare 'AssumeRoot' event in AWS STS followed by high-impact administrative or destructive API calls within a one-hour window. This behavior often indicates an adversary attempting to gain elevated, privileged access to perform unauthorized actions such as disabling logging, deleting infrastructure, or modifying IAM policies.
This rule monitors Microsoft Graph API audit events to detect potentially malicious reconnaissance or enumeration activity. It identifies actors who access a diverse range of resource categories (such as directory, tenant, privilege, application, repository, and mailbox) within a short 30-minute window, suggesting automated discovery or unauthorized data mapping rather than standard administrative tasks.
This rule detects potential unauthorized access to the 'My Sign-Ins' portal in Azure AD by monitoring for logins associated with multiple unique source IP addresses or Autonomous System Numbers (ASNs) for a single user account. This behavior is indicative of session hijacking or account compromise where an adversary is accessing the account from a different network than the legitimate user.
Detects high-volume or sequential Microsoft Graph API requests targeting sensitive directory, mailbox, application, and site endpoints. This behavior is consistent with reconnaissance activity where an adversary enumerates users, groups, service principals, and accessible resources within a compromised cloud tenant.
Page 44 of 135