Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
This rule monitors for suspicious persistence activity in Microsoft 365 environments by correlating the creation of email forwarding or transport rules (such as 'ForwardTo', 'RedirectTo', or 'DeleteMessage' operations) with the granting of OAuth application permissions (application consent or app role assignments) for the same user within a one-hour window. This combination of actions is often indicative of an adversary establishing both persistent mail access and broad application-level access to a user account.
This rule detects potentially malicious mailbox search and item access activity in Microsoft 365. It monitors for users who trigger both 'Search' and 'MailItemsAccessed' actions within a one-hour window. The detection logic flags behavior that includes a high volume of mail access (more than 10 events) or access originating from multiple distinct IP addresses, which are common indicators of automated collection or credential compromise.
Detects the initiation of an AWS Systems Manager (SSM) Session Manager session. The 'StartSession' API call is used to establish interactive remote shell sessions to managed instances (such as EC2). Monitoring this activity is critical for identifying potential remote administrative access, which could be abused for unauthorized management of cloud resources.
This rule monitors for suspicious persistence activity in Microsoft 365 environments by correlating the creation of email forwarding or transport rules (such as 'ForwardTo', 'RedirectTo', or 'DeleteMessage' operations) with the granting of OAuth application permissions (application consent or app role assignments) for the same user within a one-hour window. This combination of actions is often indicative of an adversary establishing both persistent mail access and broad application-level access to a user account.
Detects Google Workspace bulk export/Takeout activity occurring shortly after an OAuth grant or app-password creation, or an unusual volume of export/download events, consistent with automated Gmail/Docs/Keep data exfiltration.
Detects when a user authorizes an OAuth application that requests high or critical permissions in a SaaS environment via Netskope logs. This pattern is commonly used in OAuth-based phishing campaigns or illicit application consent grants where adversaries attempt to gain persistent access to cloud resources.
This rule detects a high frequency of sessions related to Azure Cloud Shell or portal consoles initiated from the same IP address within a one-hour window. Frequent access to Azure Cloud Shell can indicate potentially suspicious administrative behavior, reconnaissance, or automated interaction with the cloud environment.
Detects sign-ins from known UNC6671 residential-proxy IPs, ranked by rarity (first-seen for the user) and correlated with a following sensitive account action (MFA registration, mailbox rule change, admin role change).
This rule detects suspicious Microsoft Graph API activity involving the enumeration of user accounts within an organization. It specifically monitors for queries targeting personnel in sensitive roles such as payroll, finance, HR, and administration, as well as bulk enumeration attempts. The detection logic also flags usage of the axios HTTP library, a common tool in such reconnaissance campaigns, and aggregates results by source IP/ASN to identify coordinated efforts, such as those associated with the Storm-2755 threat actor.
GitHub Public Repository Created
Cortex XDR
Detects the creation of a new public repository within GitHub. This activity, while often legitimate, poses a potential data exposure risk by making code or sensitive assets publicly accessible. The rule identifies events where repository visibility is explicitly set to public for governance and security review.
This rule monitors Azure Key Vault operations, specifically focusing on unauthorized or excessive retrieval of secrets, keys, or certificates. It triggers when a specific user or service principal makes 10 or more requests for unique assets within a 10-minute window, which may indicate automated discovery, mass exfiltration, or a brute-force attempt to harvest credentials stored within the vault.
This rule detects a high frequency of sessions related to Azure Cloud Shell or portal consoles initiated from the same IP address within a one-hour window. Frequent access to Azure Cloud Shell can indicate potentially suspicious administrative behavior, reconnaissance, or automated interaction with the cloud environment.
A GitHub maintainer account related to the keyv/cacheable npm package ecosystem was compromised. The attacker published malicious versions of these packages, which affected more than 400 npm packages. The malware is designed to steal cloud credentials, developer secrets, CI/CD secrets, AI tool configuration files, and cryptocurrency wallet data. It also creates persistence using Claude Code hooks and VS Code tasks.json files, and sends stolen data to attacker-controlled GitHub repositories and C2 domains.
Reference article: https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack
Reference article: https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack
Detects anomalous mailbox activity in Microsoft 365 where a user account performs both search operations and mail item access, particularly when the activity originates from multiple IP addresses or exceeds a threshold of mail items accessed within a one-hour window. This behavior often indicates potential mailbox compromise or unauthorized data collection.
Detects OAuth application authorization events where the granted scopes include highly sensitive access such as Gmail, Drive, or Admin APIs. This rule identifies potential consent phishing attacks where users are tricked into granting malicious third-party applications broad, unauthorized access to their Google Workspace account. The rule excludes common, expected applications like Google Cloud SDK or standard Google services.
This rule monitors Azure Key Vault operations, specifically focusing on unauthorized or excessive retrieval of secrets, keys, or certificates. It triggers when a specific user or service principal makes 10 or more requests for unique assets within a 10-minute window, which may indicate automated discovery, mass exfiltration, or a brute-force attempt to harvest credentials stored within the vault.
Detects a Google Workspace OAuth application grant and application-specific password issuance occurring within 30 minutes of a suspicious/AiTM-flagged sign-in, indicating Gmail account takeover.
This rule monitors for high-volume deletion of Azure Recovery Services backup items or vaults performed by a single user across multiple subscriptions or regions within a 2-hour window. This behavior is indicative of an attacker attempting to inhibit system recovery by destroying cloud backups before performing other destructive operations like ransomware or data wiping.
Detects AWS API key creation for a user by another user.
Backdoored users can be used to obtain persistence in the AWS environment.
Also with this alert, you can detect a flow of AWS keys in your org.
Backdoored users can be used to obtain persistence in the AWS environment.
Also with this alert, you can detect a flow of AWS keys in your org.
This rule monitors for high-volume deletion of Azure Recovery Services backup items or vaults performed by a single user across multiple subscriptions or regions within a 2-hour window. This behavior is indicative of an attacker attempting to inhibit system recovery by destroying cloud backups before performing other destructive operations like ransomware or data wiping.
Detects non-interactive sign-in events using specific Microsoft application IDs (Intune for Education, Intune portal) to access Microsoft Graph that do not have a corresponding successful or failed Conditional Access policy record. This suggests potential circumvention of Conditional Access policies or service-level activity bypassing standard authentication auditing.
Page 69 of 135