Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
This rule detects non-interactive Azure AD sign-in attempts that utilize the device code authentication flow, specifically targeting a Microsoft authentication broker App ID while originating from a Python-requests user agent. This combination is often indicative of automated scripts or malicious tools attempting to bypass standard authentication workflows to gain access to cloud resources.
Detects unauthorized or suspicious use of Google Cloud Config Connector (KCC) service accounts to apply high-privilege IAM roles ('roles/owner' or 'roles/resourcemanager.organizationAdmin') at the Organization or Folder scope. This rule monitors for 'SetIamPolicy' API calls where the principal is identified as a KCC-related service account, flagging potential exploitation of KCC's authority to grant excessive permissions.
Detects when a Google Cloud Config Connector (KCC) Workload Identity-bound service account is granted overly permissive organization-level roles (roles/owner or roles/resourcemanager.organizationAdmin). This configuration deviates from the security best practice of using namespaced mode with per-namespace scoped identities, potentially allowing the KCC controller to gain broader access than required, which is a known attack vector for privilege escalation.
Detects a potential privilege escalation attempt where a namespace-scoped user creates a Config Connector (KCC) IAMPolicyMember resource, which is immediately followed by a high-privilege organization or folder-level SetIamPolicy operation executed by the KCC system service account, suggesting the KCC controller was manipulated to perform actions beyond the namespace's intended authorization.
Detects anomalous authentication or API access patterns where a single user account interacts with both Salesforce and ServiceNow environments simultaneously from multiple distinct source IP addresses. This behavior is indicative of credential abuse or account takeovers consistent with multi-platform SaaS targeting.
Detects anomalous non-interactive sign-ins that bypass multi-factor authentication (MFA) requirements from a geographical location not previously seen in the user's historical sign-in baseline. This pattern is indicative of attackers using stolen OAuth access or refresh tokens to maintain persistence and bypass standard authentication controls.
Detects anomalous AWS STS GetCallerIdentity activity characterized by multiple failed authentication attempts (InvalidClientTokenId, SignatureDoesNotMatch, AccessDenied, AuthFailure, InvalidAccessKeyId). This pattern is consistent with an adversary performing bulk validation of stolen or harvested AWS IAM access keys to identify valid credentials.
Detects a suspicious correlation between the registration of new authentication methods or application integrations and the subsequent modification of Conditional Access policies within a 2-hour window. This behavior is indicative of the activation phase of a TrustSink attack, where an adversary sets up a malicious MFA provider and forces its use by expanding Conditional Access policy scope.
Detects a suspicious correlation between the registration of new authentication methods or application integrations and the subsequent modification of Conditional Access policies within a 2-hour window. This behavior is indicative of the activation phase of a TrustSink attack, where an adversary sets up a malicious MFA provider and forces its use by expanding Conditional Access policy scope.
Detects high-frequency, diverse Microsoft Graph API requests initiated by an identity, indicative of automated reconnaissance or enumeration of the cloud environment. The rule tracks requests across multiple categories such as organization settings, user/group identities, privilege information, application configurations, and resource access within a 30-minute window.
Detects high-frequency access to multiple sensitive Microsoft Graph API paths (users, groups, applications, directoryRoles, servicePrincipals, etc.) from a single identity within a short timeframe. This pattern is indicative of automated reconnaissance or enumeration of the cloud environment's identity and application landscape.
Detects high-volume, multi-endpoint enumeration activity against the Microsoft Graph API, involving a high frequency of requests across sensitive tenant resources (users, groups, applications, roles, mailboxes, etc.). This behavior is consistent with post-compromise reconnaissance by an adversary attempting to map the environment.
This rule detects anomalous backend activity associated with phishing kits, specifically monitoring for the dispatch of SMS or WhatsApp messages containing lure links. It identifies logs indicative of automated message dispatch (via send_sms_apix.log or WhatsApp Business API calls), filters for successful delivery indicators while excluding known error states, and verifies the presence of specific message components like recipient details and malicious templates.
Detects a specific device-intelligence workflow pattern where an operator performs device reconnaissance (e.g., serial number checks, device model lookups) followed shortly by the generation of a malicious lure or tracking link (e.g., Five-channel lure), indicative of an attempt to gain unauthorized access to a victim device or account.
This rule detects potentially malicious mailbox access patterns in Microsoft 365. It identifies instances where the 'MailItemsAccessed' action is performed using the Outlook ClientAppId, but in conjunction with an uncommon APIId and a suspicious user agent ('Client=REST' combined with specific Firefox versions). This pattern is indicative of automated session hijacking or unauthorized access via third-party tools rather than legitimate browser-based Outlook access.
Detects Workday self-service banking detail changes occurring shortly after suspicious mailbox reconnaissance activities, such as searching for payroll-related terms or accessing sensitive documents. This behavior is indicative of a payroll diversion fraud scheme following an Adversary-in-the-Middle (AiTM) session hijacking attack.
Detects Microsoft 365 / Entra ID sign-in events where the reported client application is Microsoft Outlook but the User-Agent string is inconsistent with Outlook's standard Edge-based WebView. This behavioral discrepancy often indicates the use of automated HTTP clients to replay stolen session tokens in Adversary-in-the-Middle (AiTM) phishing campaigns, allowing attackers to maintain authenticated access for reconnaissance and data collection.
Detects Microsoft Entra OAuth 2.0 device authorization grant flow completion immediately followed by non-interactive API access from automated user agents like python-requests. This behavior is indicative of device code phishing kits, where an attacker tricks a user into entering a code and then programmatically hijacks the resulting session token.
Detects rapid, non-interactive sign-ins to the Microsoft Device Registration Service following a device-code authentication. This pattern is characteristic of attackers using scripted clients (such as python-requests) to automate the registration of rogue devices after harvesting tokens via device-code phishing.
Detects the issuance of a Primary Refresh Token (PRT) to Microsoft Graph occurring in close temporal proximity to a device code authentication flow. This pattern is indicative of device-code phishing attacks, where an adversary intercepts a device code to obtain long-lived, session-persistent access to a tenant.
Detects potentially malicious OAuth device code sign-ins by identifying sign-in events that exhibit anomalous characteristics, such as atypical geographic locations, rare client-application combinations, unmanaged/noncompliant device status, or elevated risk signals associated with the account. This detection helps identify account compromise or malicious OAuth consent activity often associated with 'EvilTokens' or device-code phishing attacks.
Page 48 of 135