Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects an Owner-role GitLab account or token modifying merge-request approval rules, protected-branch settings, or project membership -- controls that, if weakened, defeat code-review safeguards.
Detects an Owner-role GitLab account or token modifying merge-request approval rules, protected-branch settings, or project membership -- controls that, if weakened, defeat code-review safeguards.
Detects an Owner-role GitLab account or token modifying merge-request approval rules, protected-branch settings, or project membership -- controls that, if weakened, defeat code-review safeguards.
Detects a single GitLab token/account holding Owner-level access across an unusually large number of projects (50+), the standing-privilege condition that turned one leaked token into a 55-project supply-chain exposure.
This rule detects rapid enumeration of Azure AD identity and configuration components by identifying a burst of specific, high-level administrative API calls (Get user flows, Get API connectors, Get identity providers, Get user attributes) within a short window. This pattern is indicative of reconnaissance activities aimed at mapping out the identity provider configuration.
Detects anomalous email access patterns across multiple mailboxes using specific application identifiers or access contexts often associated with automated collection tools. This rule flags when an application accesses more than 20 items across distinct mailboxes in a 15-minute window, which is indicative of potential unauthorized bulk email collection or data exfiltration.
This rule monitors Office 365 SharePoint file operations and search queries for patterns indicative of automated discovery and exfiltration of sensitive content. It specifically identifies high-frequency search queries involving wildcard parameters used in SharePoint content indexing, which may suggest an adversary is systematically crawling or enumerating organizational documents.
Detects cloud application events originating from suspicious or specific User-Agent strings, including 'python-requests' and identified outdated or potentially spoofed Chrome versions (146, 150, 151.0.0). This behavior often correlates with automated scripts or bot activity interacting with cloud services.
Detects cloud application events originating from suspicious or specific User-Agent strings, including 'python-requests' and identified outdated or potentially spoofed Chrome versions (146, 150, 151.0.0). This behavior often correlates with automated scripts or bot activity interacting with cloud services.
This rule monitors Office 365 SharePoint file operations and search queries for patterns indicative of automated discovery and exfiltration of sensitive content. It specifically identifies high-frequency search queries involving wildcard parameters used in SharePoint content indexing, which may suggest an adversary is systematically crawling or enumerating organizational documents.
Detects high-frequency access to mail items or attachments using specific One Outlook Web Client AppIDs. This behavior may indicate automated mailbox harvesting or unauthorized bulk data access via an atypical API path.
Detects invocations of the 'grafana_api_request' tool that lack a preceding valid bearer-token authentication event for the same session. This indicates a potential scenario where a server or service account token is being used on behalf of an unauthenticated caller, bypassing normal authentication requirements for the Grafana API.
Detects instances where the Grafana MCP (Model Context Protocol) server's service account identity executes administrative tools (such as 'grafana_api_request') within a session that lacks a verified, prior authentication event (bearer token). This pattern suggests an adversary may be spoofing or hijacking a privileged service account session to perform unauthorized administrative actions.
This rule detects potentially unauthorized access to cloud resources or OAuth applications by identifying sign-ins or API calls originating from IP addresses or locations not previously observed for the user in the 30 days prior to a documented Coder registry compromise exposure window.
Detects anomalous actions within the Coder registry, such as template creation, version updates, or dry-run/workspace builds with module caching disabled, that occurred during a known registry compromise window on August 31, 2026.
Detects anomalous actions within the Coder registry, such as template creation, version updates, or dry-run/workspace builds with module caching disabled, that occurred during a known registry compromise window on August 31, 2026.
This rule detects administrative changes (create, update, delete) to Cloudflare DNS records, load balancer pools, or origin pools specifically associated with 'registry.coder.com', as well as anomalous login and API token activity on the Cloudflare account. Such activity may indicate unauthorized configuration tampering, potential account compromise, or malicious modifications to critical infrastructure endpoints.
This rule detects potentially unauthorized access to cloud resources or OAuth applications by identifying sign-ins or API calls originating from IP addresses or locations not previously observed for the user in the 30 days prior to a documented Coder registry compromise exposure window.
AWS Route 53 DNS Record Modification
Cortex XDR
Detects modifications to AWS Route 53 DNS resource record sets. Monitoring these changes is critical for identifying potential DNS hijacking, traffic redirection, or unauthorized infrastructure configuration changes within the AWS environment.
Detects instances where the Grafana MCP (Model Context Protocol) server's service account identity executes administrative tools (such as 'grafana_api_request') within a session that lacks a verified, prior authentication event (bearer token). This pattern suggests an adversary may be spoofing or hijacking a privileged service account session to perform unauthorized administrative actions.
Detects instances where the Grafana MCP (Model Context Protocol) server's service account identity executes administrative tools (such as 'grafana_api_request') within a session that lacks a verified, prior authentication event (bearer token). This pattern suggests an adversary may be spoofing or hijacking a privileged service account session to perform unauthorized administrative actions.
Page 66 of 135