Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
This rule detects potential data exfiltration by monitoring for anomalous user behavior across integrated SaaS applications. It flags accounts that perform high-frequency read, search, or view activities across three or more monitored SaaS platforms (Confluence, Jira, Slack, Google Workspace, Microsoft 365, or Bitbucket) within a 5-minute window, followed immediately by an upload or post activity to an external, non-integrated domain.
Detects anomalous access to the Azure Portal Single Page Application (SPA) by monitoring sign-in logs. The rule flags users accessing this specific application from multiple devices or over an unusually long time span (exceeding 24 hours), which may indicate session hijacking, token theft, or unauthorized access attempts via stolen session tokens.
This rule detects the addition or update of credentials (certificates and secrets) to Azure AD applications or service principals using AuditLogs. Adversaries often perform this activity to establish persistent access to a cloud environment by 'backdooring' a trusted application or service principal with their own secret, allowing them to authenticate as that identity later.
Detects Microsoft Entra device registration events where the device name adheres to the 'Forg365-' prefix naming convention. This pattern is indicative of persistence mechanisms used by the Forg365 Phishing-as-a-Service (PhaaS) platform, which registers devices to bypass conditional access or MFA.
This rule detects modifications to Google Cloud Compute Engine instance metadata that involve sensitive keys, specifically those related to SSH key injection (ssh-keys, sshKeys, windows-keys) or automated execution via startup scripts (startup-script, startup-script-url). Attackers often modify these fields to achieve persistence or perform privilege escalation on compromised virtual machines.
This rule monitors Azure Active Directory (Microsoft Entra ID) audit logs for the addition or modification of application registrations that contain specific, potentially malicious redirect URI patterns ('brk-' or 'brk-multihub'). These patterns are associated with OAuth consent phishing or malicious application authorization where an adversary registers an app to intercept authorization codes.
Detects modifications to the service account assigned to a Google Compute Engine (GCE) instance. An adversary might alter the attached service account to escalate privileges, gain access to additional resources, or maintain persistence by leveraging an identity with higher permissions.
This rule detects modifications to Google Cloud Platform (GCP) Cloud Routers by monitoring audit logs for non-read operations. It flags changes made by human users, service accounts not utilizing Terraform, or service accounts originating from unexpected network sources as high-priority, while tracking general router creations and deletions.
This rule detects the deletion or disabling of Google Cloud IAM service accounts in GCP Audit Logs. These actions are often associated with cleanup activities by an adversary trying to remove persistence or hinder forensic investigations and incident response.
Detects access to Google Cloud Platform virtual machine serial port output. This API call (v1.compute.instances.getSerialPortOutput) allows users to view the console output of a VM instance, which may contain sensitive information, including boot logs, system diagnostic messages, or credentials that were inadvertently logged to the console by services or applications running on the instance.
Subnet lifecycle changes made by a human, a non-Terraform service account, or a service account operating from an unexpected network.
Detects Microsoft 365 service principals using application-only (client-credentials) authentication to access the Microsoft Graph API, specifically targeting the calendarView endpoint of user mailboxes. This behavior matches the HOLLOWGRAPH attack technique, which leverages M365 calendars as a covert command-and-control (C2) channel.
Detects Office 365 calendar events created or modified with a specific far-future date (2050-05-13) or dates scheduled more than 10 years into the future. This behavior is associated with the HOLLOWGRAPH backdoor, which uses calendar items as a C2 channel to hide tasking or exfiltration events from the mailbox owner.
This rule detects potentially malicious attempts to leverage different Microsoft cloud applications (FOCI family) in a short time frame following a conditional access block (AADSTS53003). The rule identifies scenarios where a single user account, within a 10-minute window, generates a 53003 failure while attempting to use multiple different client applications (such as Teams, O365, or Azure Portal), which may indicate an adversary attempting to bypass or probe security controls or testing token validity across multiple services.
This rule detects modifications or registrations of Pass-Through Authentication (PTA) agents and changes to federation settings within an identity tenant. Such actions can indicate an adversary attempting to establish persistence, bypass authentication mechanisms, or intercept credentials by manipulating the authentication infrastructure.
Detects the creation of a new Service Principal followed by an immediate application of an app role assignment within one hour. The rule specifically targets service principals with names suggestive of automation, AI, or assistant-related roles (e.g., 'copilot', 'llm', 'bot'), which may indicate the use of newly created service principals for potential persistence or unauthorized access.
This rule detects modifications or registrations of Pass-Through Authentication (PTA) agents and changes to federation settings within an identity tenant. Such actions can indicate an adversary attempting to establish persistence, bypass authentication mechanisms, or intercept credentials by manipulating the authentication infrastructure.
This rule detects potentially malicious attempts to leverage different Microsoft cloud applications (FOCI family) in a short time frame following a conditional access block (AADSTS53003). The rule identifies scenarios where a single user account, within a 10-minute window, generates a 53003 failure while attempting to use multiple different client applications (such as Teams, O365, or Azure Portal), which may indicate an adversary attempting to bypass or probe security controls or testing token validity across multiple services.
This takes the earliest available snapshot per agent instead of comparing two states. If an agent is born already carrying MCP access and org-wide sharing there is no baseline to drift from, so this needs its own check rather than a diff.
This rule detects when a user (excluding service accounts) explicitly sets IAM permissions on a Google Cloud Storage bucket, potentially indicating unauthorized privilege escalation or modification of access controls to facilitate data exfiltration or persistence.
This rule detects unsuccessful attempts by human users to delete objects from Google Cloud Storage buckets that are protected by bucket-level retention policies. By filtering out service accounts, the rule specifically focuses on non-automated, human-initiated actions that violate data retention requirements.
Page 71 of 135