Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
This rule monitors for various types of events (user logons, network connections, API audits, cloud app events, and email traffic) originating from a specific CIDR block (160.79.104.0/21), which is flagged as suspicious or unauthorized.
This rule detects various event types (email, identity authentication, network connections, and cloud audit logs) originating from or interacting with the specific IP address range 160.79.104.0/22 to 160.79.111.0/22, which is associated with known malicious activity.
Detects Google Workspace login activity that's classified as suspicious by Google.
This rule detects the creation or modification of inbox rules in Microsoft 365 that exhibit suspicious behaviors, such as hiding messages, deleting them, moving them, or automatically forwarding/redirecting them to external addresses. It also flags rules that contain finance-related keywords, often used in Business Email Compromise (BEC) campaigns.
This rule detects potentially unauthorized access to Microsoft Graph API resources (Mail or Files) following a device-code authentication event for the same user. It identifies scenarios where a previously unknown application client performs read operations within 24 hours of a device-code login, which is characteristic of 'ARToken' or 'EvilProxy' type device-code phishing and session proxy attacks.
Detects suspicious Entra ID device registration and Primary Refresh Token (PRT) issuance occurring shortly after an OAuth Device Code sign-in. This pattern is indicative of ARToken-style post-compromise persistence, where an attacker leverages a stolen device code to register a rogue device and establish a persistent session.
Detects automated mailbox access operations such as 'MailItemsAccessed' or 'Search-Mailbox' that are filtered by specific, high-risk financial or Business Email Compromise (BEC) keywords in the email subject line. This behavior is indicative of an automated 'inbox-monitor' style attack, where a compromised OAuth token is used to systematically scrape mailboxes for sensitive financial data.
This rule monitors Office 365 activity for anomalous search behavior, specifically targeting high volumes of distinct search queries involving site collections, web structures, or index ID patterns. Such patterns are indicative of automated data discovery or enumeration activities performed against SharePoint or OneDrive environments.
This rule detects modifications to Group Policy Objects (GPO) or Microsoft Entra (formerly Azure AD) policies that weaken established security controls. For GPO, it monitors Event ID 5136 for changes to security-relevant attributes (e.g., disabling firewall or real-time monitoring) in Active Directory. For Entra, it monitors audit logs for administrative operations that reduce security posture, such as disabling MFA, lowering authentication trust, or deleting Conditional Access policies. It includes filters to exclude legitimate, documented change management activities.
Detects the creation of new AWS access keys or login profiles for a target identity immediately following the deletion or modification of a credential for the same identity, where the actors performing the two actions are different. This pattern indicates an adversary creating persistent access after a security incident responder or automated system has revoked a previously compromised credential.
Detects a suspicious sequence of events within JFrog Artifactory where an account accesses sensitive code-signing material (rubygems/gemspec/signing keys) and subsequently performs administrative actions (user addition/role assignment/privilege escalation) within a one-hour window, indicating potential account takeover or exploitation.
Detects a suspicious sequence of events within JFrog Artifactory where an account accesses sensitive code-signing material (rubygems/gemspec/signing keys) and subsequently performs administrative actions (user addition/role assignment/privilege escalation) within a one-hour window, indicating potential account takeover or exploitation.
Detects pull requests created in GitHub repositories by entities labeled as 'Bot', 'App', or 'integration', or containing the term 'codex', specifically targeting repositories where such entities have not performed these actions in the previous 30 days. This baseline approach identifies potentially hijacked or unauthorized automation accounts performing activities outside of their standard repository scope.
Detects pull requests created in GitHub repositories by entities labeled as 'Bot', 'App', or 'integration', or containing the term 'codex', specifically targeting repositories where such entities have not performed these actions in the previous 30 days. This baseline approach identifies potentially hijacked or unauthorized automation accounts performing activities outside of their standard repository scope.
Detects pull requests created in GitHub repositories by entities labeled as 'Bot', 'App', or 'integration', or containing the term 'codex', specifically targeting repositories where such entities have not performed these actions in the previous 30 days. This baseline approach identifies potentially hijacked or unauthorized automation accounts performing activities outside of their standard repository scope.
Detects instances where a user grants OAuth application permissions to GitHub or Slack shortly (within 30 minutes) after signing into a low-trust application (Discourse or OpenAI Community), suggesting a potential session hijacking or trusted-relationship abuse scenario where an attacker leverages an existing SSO session to authorize malicious applications.
Detects instances where a user grants OAuth application permissions to GitHub or Slack shortly (within 30 minutes) after signing into a low-trust application (Discourse or OpenAI Community), suggesting a potential session hijacking or trusted-relationship abuse scenario where an attacker leverages an existing SSO session to authorize malicious applications.
Detects instances where a user grants OAuth application permissions to GitHub or Slack shortly (within 30 minutes) after signing into a low-trust application (Discourse or OpenAI Community), suggesting a potential session hijacking or trusted-relationship abuse scenario where an attacker leverages an existing SSO session to authorize malicious applications.
This rule detects a user account performing its first-ever GitHub OAuth or repository access within a short timeframe (30 minutes) after authenticating to a designated low-trust OpenAI community forum. This pattern is designed to identify potential adversary activity where a compromised or newly created account is used to pivot from a low-trust environment to corporate repository access.
This rule detects a user account performing its first-ever GitHub OAuth or repository access within a short timeframe (30 minutes) after authenticating to a designated low-trust OpenAI community forum. This pattern is designed to identify potential adversary activity where a compromised or newly created account is used to pivot from a low-trust environment to corporate repository access.
Detects GitHub OAuth authorization, repository cloning, or ZIP downloads from source IP addresses that have not been observed for the specific actor within the past 30 days. This rule helps identify potential account compromise or token theft where an attacker attempts to access repository data from a new location, while specifically excluding bot/service accounts known for rotating CI infrastructure IPs.
Page 54 of 135