Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
This rule monitors audit logs for anomalous OAuth application configurations, specifically focusing on excessive scope counts, Redirect URI mismatches, Client ID mismatches, and cross-client token exchange irregularities, which may indicate malicious OAuth application registration or configuration for token theft.
Detects failed authentication attempts using the BAV2ROPC user agent (Azure CLI / legacy OAuth2 ROPC token requests) in Microsoft 365 Unified Audit Logs. BAV2ROPC bypasses MFA by authenticating directly to the /token endpoint. Error codes 50053 (account lockout), 50126 (invalid credentials), and 50034 (user not found) are characteristic of password spraying activity. Observed in the LSHIY LLC password spray campaign (June 2026).
Detects the creation of Google Cloud Dataflow jobs that exhibit indicators of malicious data exfiltration pipelines, such as usage of suspicious job names (common with exfiltration tools), service account delegation, or execution via scripted user agents.
This rule detects a multi-stage attack chain originating from OAuth device code phishing. It tracks the sequence of events starting from device code authentication, followed by the registration of a new device or Primary Refresh Token (PRT) manipulation, potential password resets, and the creation of malicious inbox rules (e.g., auto-forwarding). The rule correlates these events within a 1-hour window to identify malicious intent, with critical alerts triggered if persistence mechanisms survive a password reset.
GCP Service Account or Key Creation
Cortex XDR
Detects the creation of Google Cloud Platform (GCP) service accounts or service account keys. Service account keys provide long-lived, programmatic access to cloud resources that persist beyond password resets or MFA requirements, making them a common target for attackers looking to maintain persistence, conduct lateral movement, or escalate privileges within a GCP environment.
This rule monitors for the execution of Azure CLI commands used to enumerate role assignments and Azure Container Registry (ACR) details. Adversaries often perform this reconnaissance to identify high-privilege accounts, discover container registries, or map out permissions to facilitate lateral movement or persistence within an Azure environment.
Detects attempts to retrieve Azure Container Registry (ACR) credentials, either by executing specific Azure CLI commands on a host or by initiating the Microsoft.ContainerRegistry/registries/listCredentials/action via Azure Activity Logs. Such activities may indicate an adversary attempting to gain unauthorized access to container registries.
Detects the restart of an Azure Container Instance via the Microsoft.ContainerInstance/containerGroups/restart/action operation. This could indicate an attempt to disrupt service availability or potentially hide malicious modifications made to a container by forcing a state change.
This rule detects a multi-stage attack chain originating from OAuth device code phishing. It tracks the sequence of events starting from device code authentication, followed by the registration of a new device or Primary Refresh Token (PRT) manipulation, potential password resets, and the creation of malicious inbox rules (e.g., auto-forwarding). The rule correlates these events within a 1-hour window to identify malicious intent, with critical alerts triggered if persistence mechanisms survive a password reset.
This rule detects new or anomalous Google Workspace OAuth authorization events by monitoring for actions related to OAuth, consent, tokens, or authorization from IP addresses, geographical locations, or devices that have not been observed for the specific user account within the past 30 days.
Detects instances where users grant broad permissions (e.g., Mail.Read, Files.ReadWrite) to newly registered or unknown applications. It specifically correlates these grants with device code flow authentication, a technique frequently used in OAuth consent phishing to bypass traditional authentication hurdles.
Detects the creation of applications or service principals in Azure AD that involve sensitive OAuth permissions (e.g., Mail.ReadWrite, Files.ReadWrite.All) when performed by users identified with elevated risk levels or outside of standard business hours.
Detects unauthorized attempts by low-privileged API tokens to access sensitive Argo CD endpoints related to Git repository credentials and project configurations. This rule specifically monitors for exploitation patterns associated with CVE-2025-55190, where tokens with read-only access could retrieve secrets they are not authorized to view.
Detects potential zero-click LLM prompt injection attacks against Microsoft 365 Copilot. The rule correlates Microsoft 365 Copilot activity involving external/untrusted URLs or domains with recent inbound email activity to the same user. This pattern is designed to identify scenarios where an attacker leverages an inbound email to trigger a Copilot interaction with malicious external content, potentially leading to unauthorized data access or exfiltration.
Detects high-volume unauthenticated API queries against a ServiceNow instance by a Guest user. This behavior is indicative of an adversary attempting to exfiltrate sensitive information, such as ticket data, configuration secrets, or employee records, via the 'related_list_edit' REST endpoint or standard table APIs.
Detects administrative actions that disable or modify Amazon GuardDuty, which could be an attempt to blind security monitoring or evade detection of malicious activity. This includes disabling a detector, deleting publishing destinations, or modifying threat intel and IP sets.
This rule detects a correlation between an unauthorized IAM user access event and the subsequent execution of cryptocurrency mining tools within the same AWS account within a one-hour window. This is a strong indicator of an adversary leveraging compromised cloud credentials to perform resource hijacking.
This rule monitors for potential lateral phishing activity within an organization by identifying internal accounts sending high volumes of emails, correlating this with MailItemsAccessed audit events from unexpected IPs, and detecting OAuth token abuse patterns (such as granting consent or adding credentials) within the Exchange Online environment.
Detects suspicious activity related to OAuth2PermissionGrant operations, specifically looking for a high volume of successful consent grants by a single user within a short timeframe. This could indicate an attacker attempting to gain broad access to resources by granting permissions to a malicious OAuth application.
Detects indicators of Device Code Lab's PRT Refresh capability, where an administrator's 'Revoke all sessions' (revokeSignInSessions) action is followed by a prt-refresh backend call that reactivates the attacker's session without new user interaction, bypassing standard OAuth refresh token revocation.
Detects high-risk administrative or user actions within Microsoft 365 environments that are frequently associated with adversary persistence, data exfiltration, and privilege escalation. The rule monitors for the creation or modification of inbox forwarding rules, addition of mailbox permissions, OAuth application consent grants, bulk mailbox searches, and programmatic access to mail items via EWS or Graph API.
Page 76 of 135