Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects a GitLab personal access token/response indicating Owner-level (access_level 50) group access combined with the broad 'api' scope on the sensitive gnutls/gnutls project -- the excessive standing-privilege pattern that turned one leaked token into a 55-project exposure.
Detects the gitlab-triage automation tool being invoked with a personal access token scoped to the broad 'api' permission rather than a narrower issue/MR-only scope, inflating the blast radius if the token leaks.
This rule detects potentially malicious activity where a user performs a device code authentication followed by multiple rapid token exchanges (often of different types) within an extremely short time window. This pattern is indicative of an attacker attempting to leverage a compromised device code grant to programmatically retrieve access or refresh tokens before the user has completed a legitimate flow or to automate malicious access.
Detects instances where a user authenticates via the device code flow and subsequently performs a device enrollment or registration action from an unusual or non-compliant device naming convention. This pattern is indicative of an adversary enrolling their own device to bypass MFA or gain persistent access to corporate resources.
Detects instances where a user successfully authenticates using the OAuth Device Code flow followed by subsequent mailbox operations (such as reading, sending, or deleting items) from a different IP address within a 10-minute window. This behavior is a strong indicator of adversary-in-the-middle phishing attacks where an attacker captures a session token and utilizes it from a remote location.
This rule monitors Entra ID Audit Logs for device registration events where the display name of the registered device matches a specific naming pattern used by the GhostCode phishing kit. The pattern typically consists of three dash-separated words, a dash-separated hex string, and an optional suffix, which is indicative of automated phishing-based device enrollment.
This rule monitors Entra ID Audit Logs for device registration events where the display name of the registered device matches a specific naming pattern used by the GhostCode phishing kit. The pattern typically consists of three dash-separated words, a dash-separated hex string, and an optional suffix, which is indicative of automated phishing-based device enrollment.
Detects suspicious Microsoft Intune device enrollment activities characterized by the use of a spoofed User-Agent (matching Microsoft Office/Outlook strings) and rapid, multiple enrollment attempts within a short timeframe. This behavior is associated with adversary use of device-code phishing kits to enroll rogue devices using stolen session tokens.
Detects rapid rotation of multiple unique IP addresses originating from the same user account shortly after a device code authentication event. This behavior is indicative of threat actors using proxy rotation services (like FlashProxy) to obfuscate their origin and bypass location-based security controls or impossible-travel detections after hijacking a session.
Detects rapid rotation of multiple unique IP addresses originating from the same user account shortly after a device code authentication event. This behavior is indicative of threat actors using proxy rotation services (like FlashProxy) to obfuscate their origin and bypass location-based security controls or impossible-travel detections after hijacking a session.
Detects non-interactive Entra ID sign-ins utilizing the python-requests library, which suggests an automated polling mechanism. This is indicative of 'GhostCode' or similar device code phishing attacks where an adversary uses a stolen device code token to programmatically poll for a successful authorization grant.
Detects anomalous, rapid registration of rogue devices following a device-code authentication flow. The rule identifies instances where an 'unbound' device registration is immediately followed by a 'bound' call to obtain Azure AD and Microsoft Graph tokens, or where a Primary Refresh Token (PRT) is acquired shortly after a device-code sign-in, indicating potential abuse of the device authorization grant flow by an attacker using phishing kits.
Detects anomalous device registration activity where a single user principal registers three or more distinct devices within a short duration (2 minutes). This behavior is characteristic of device-code phishing attacks where adversaries abuse stolen device authorization codes to register multiple rogue devices, potentially for PRT (Primary Refresh Token) acquisition.
Detects anomalous device registration or Intune enrollment activity where a single user principal name (UPN) is associated with three or more distinct source IP addresses performing registration actions within a 90-second window. This behavior is indicative of automated, rapid rogue device registration campaigns aiming to bypass conditional access policies or establish unauthorized persistence.
Detects interaction with known infrastructure associated with the PREY-0058 campaign, which utilizes Adversary-in-the-Middle (AiTM) phishing lures mimicking passkey or MFA registration pages to target Microsoft 365 and other SaaS applications.
Detects rapid, sequential identity-validation API calls (such as GetCallerIdentity, GetSessionToken, or AssumeRole) performed across a large number of distinct AWS access keys from a single source within a short time window. This pattern is indicative of automated tooling validating a harvested corpus of AWS access keys to identify active credentials.
This rule monitors Office 365 activity for anomalous search behavior, specifically targeting high volumes of distinct search queries involving site collections, web structures, or index ID patterns. Such patterns are indicative of automated data discovery or enumeration activities performed against SharePoint or OneDrive environments.
Detects a sequence of events starting with a device code OAuth sign-in, followed within two hours by the creation or modification of inbox rules and high-frequency enumeration of email items (contacts, folders, messages, threads, people) via Microsoft Graph API. This behavior is indicative of post-compromise activity where an adversary uses OAuth device code grants to maintain access and subsequently automates inbox analysis or data harvesting.
Detects anomalous GitLab project enumeration where an account performs an excessive number of requests to the Projects API using the 'membership=true' parameter within a one-hour window. This behavior is indicative of an attacker attempting to discover all accessible repositories associated with a compromised or over-privileged GitLab token.
Detects unreviewed commits to .gitlab-ci.yml that alter how the gitlab-triage tool invokes the sensitive API_TOKEN variable, with no associated merge request.
Detects the gitlab-triage automation tool being invoked with a personal access token scoped to the broad 'api' permission rather than a narrower issue/MR-only scope, inflating the blast radius if the token leaks.
Page 59 of 135