Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
This rule detects instances where a Google Cloud Platform (GCP) identity attempts to grant themselves highly privileged IAM roles at the project level. It monitors 'SetIamPolicy' events in GCP audit logs, filtering for activities where the actor (user) is included in the set of members receiving high-privilege roles such as owner, editor, or various administrative roles (e.g., storage.admin, compute.admin).
This rule detects potential credential abuse by monitoring for a burst of GCP access or ID token generation requests by a single user across five or more distinct resource targets within a single project. Such behavior is often indicative of an adversary enumerating resources or performing reconnaissance to identify reachable services or systems after successfully assuming a principal's identity.
Detects the creation or update of IAM custom roles in Google Cloud Platform. This activity can be indicative of privilege escalation or the establishment of persistence by an adversary modifying access controls.
This rule detects anomalous patterns of Microsoft Graph API activity involving the /calendar, /events, and /calendarView endpoints. It identifies application identities performing high-frequency create (POST/PATCH) and read (GET) operations within a short time window. This behavior is indicative of a compromised mailbox being used as a C2 dead-drop channel, where the calendar is used to exchange commands and results between the adversary and the compromised environment.
This hunting query identifies GitHub activites where there are a large number of deletions that may be a sign of compromise.
Detects anomalous access to the Azure Portal Single Page Application (SPA) by monitoring sign-in logs. The rule flags users accessing this specific application from multiple devices or over an unusually long time span (exceeding 24 hours), which may indicate session hijacking, token theft, or unauthorized access attempts via stolen session tokens.
This rule monitors Azure Active Directory (Microsoft Entra ID) audit logs for the addition or modification of application registrations that contain specific, potentially malicious redirect URI patterns ('brk-' or 'brk-multihub'). These patterns are associated with OAuth consent phishing or malicious application authorization where an adversary registers an app to intercept authorization codes.
This rule detects anomalous activity involving the legacy Microsoft Azure AD Graph API (graph.windows.net) originating from users who lack corresponding entries in standard Entra ID (AuditLogs) sign-in or management activity logs. A high frequency of these undocumented API calls (more than 5 in an hour) from a specific user and IP address indicates potential unauthorized reconnaissance or access attempts attempting to bypass standard audit logging.
Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken
model safety controls and allow unsafe or unauthorized model responses.
model safety controls and allow unsafe or unauthorized model responses.
This rule detects anomalous activity involving the legacy Microsoft Azure AD Graph API (graph.windows.net) originating from users who lack corresponding entries in standard Entra ID (AuditLogs) sign-in or management activity logs. A high frequency of these undocumented API calls (more than 5 in an hour) from a specific user and IP address indicates potential unauthorized reconnaissance or access attempts attempting to bypass standard audit logging.
Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove
model safety controls and allow unsafe or unauthorized model responses.
model safety controls and allow unsafe or unauthorized model responses.
This rule detects modifications to Azure Service Principal and Application object redirect URIs that match known patterns for reverse proxies, tunneling services, temporary callback infrastructure, or potential local token theft. Such changes may indicate an adversary attempting to establish persistent access, intercept authentication tokens, or bypass network controls via unauthorized application configurations.
Detects successful authentication events using the OAuth device code flow. This flow is often abused by adversaries to perform OAuth phishing, where a user is tricked into authorizing a malicious application, granting it access tokens to cloud resources.
Detects successful Azure AD sign-in events authenticated via the device code flow that subsequently access Microsoft 365 resources such as Outlook, SharePoint, OneDrive, or Teams. This pattern is consistent with post-compromise use of OAuth tokens obtained through device-code phishing.
Detects successful authentication events using the OAuth device code flow. This flow is often abused by adversaries to perform OAuth phishing, where a user is tricked into authorizing a malicious application, granting it access tokens to cloud resources.
Detects successful Azure AD sign-in events authenticated via the device code flow that subsequently access Microsoft 365 resources such as Outlook, SharePoint, OneDrive, or Teams. This pattern is consistent with post-compromise use of OAuth tokens obtained through device-code phishing.
Detects successful Azure AD sign-in events authenticated via the device code flow that subsequently access Microsoft 365 resources such as Outlook, SharePoint, OneDrive, or Teams. This pattern is consistent with post-compromise use of OAuth tokens obtained through device-code phishing.
Detects GET requests to the Microsoft Graph API 'organization' endpoint, often used by malicious tools to validate a tenant environment or gather metadata before initiating C2 communication or secondary stages of an attack.
Entra ID Device Registration Event
Cortex XDR
Detects device registration events within Entra ID. Attackers may register their own device to a compromised account to maintain persistent access or satisfy device-compliance conditional access policies.
Detects Microsoft Graph API requests targeting user mailboxes within a tenant or organization structure likely associated with Israeli legal entities, identified by .co.il domain patterns in the Request URI.
Detects Microsoft 365 Outlook calendar events with highly anomalous future dates (specifically the year 2050) or specific subject patterns, which are indicative of a command-and-control (C2) communication channel established via calendar item properties.
Page 72 of 135