Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,309 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
299
243
Contributors
1,048
740
503
372
239
Categories
20,445
11,833
5,875
5,151
4,864
4,309
Platforms
2,571
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,348
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
This rule detects potential password spraying attacks against Microsoft Entra ID (formerly Azure Active Directory). It identifies a high number of failed sign-in attempts from a single source IP address targeting multiple unique user accounts within a short timeframe, specifically looking for 'Invalid password' or 'invalid credentials' failure reasons. The thresholds are set to 20 or more failures and 10 or more unique users within a 5-minute window.
This correlation rule detects a high number of failed login attempts for a single user account on a specific endpoint, which may indicate a brute-force attack. For this rule to be effective, it is recommended to set the 'Correlation Entity' to 'User' to group alerts by the targeted user.
Detects unusual communication patterns from executive accounts in Office 365, specifically looking for mail activity, inbox rule creation, or mailbox modifications combined with keywords related to wire transfers, payments, or urgent financial actions. The rule flags scenarios where multiple such activities occur within a short timeframe (3 hours) or if new inbox rules are created, indicating potential deepfake/synthetic impersonation or Business Email Compromise (BEC) attempts.
Detects AppleScript execution attempting to harvest user passwords through dialog boxes with hidden answer parameters. This technique is commonly used by macOS infostealers like Poseidon and Banshee.
Detects unusual communication patterns from executive accounts in Office 365, specifically looking for mail activity, inbox rule creation, or mailbox modifications combined with keywords related to wire transfers, payments, or urgent financial actions. The rule flags scenarios where multiple such activities occur within a short timeframe (3 hours) or if new inbox rules are created, indicating potential deepfake/synthetic impersonation or Business Email Compromise (BEC) attempts.
Detects high-volume email campaigns that exhibit characteristics of sophisticated phishing, including spoofed sender domains, urgent subject lines, and multiple URLs in the email body, indicative of credential harvesting attempts. The rule specifically looks for emails delivered to 'Deleted' or 'Junk' folders, from non-company domains that resemble company domains, and containing keywords often used in phishing lures.
Detects new app installations, expansions of OAuth scopes, or the addition of collaborators to Slack applications. These activities can indicate an adversary attempting to establish persistent access, escalate privileges, or exfiltrate data from Slack by leveraging malicious or compromised applications.
This rule detects potential device code phishing attempts by correlating URL click events with sign-in logs using the 'deviceCode' authentication protocol. It specifically looks for successful or failed sign-ins (result types 0, 50074, 50076, 500121) that occur after a user clicks on a URL.
Detects access to Kubernetes secret objects containing sensitive configuration data
Detects retrieval of secrets from AWS Secrets Manager
Detects suspicious reads of the .git-credentials file by non-git processes. This file often contains plaintext Git passwords or tokens, making it a target for credential theft.
Detects `grep` commands searching for the exact JSON structure (`"isSecret": true`) used by GitHub Actions to store masked secrets in memory. This activity could indicate an adversary attempting to discover sensitive information.
Correlates the targeted reading of USERDNSDOMAIN and COMPUTERNAME environment variables with network connections to a known malicious domain (kleymarket.ru), indicating potential data exfiltration by the Silent Rotor malware.
This rule detects attempts by non-browser processes to access browser credential stores (Login Data, Cookies, Web Data). Specifically, it monitors file read, access, or copy actions on known credential database paths for Chrome, Edge, Firefox, Brave, and Opera, and flags any activity originating from processes other than the legitimate browser executables or common security software.
Identifies rapid retrieval of dozens of secrets from Azure Key Vaults within minutes by a single identity. This behavior can indicate an attacker attempting to exfiltrate credentials or sensitive information after gaining initial access to an Azure environment.
Detects sign-ins to M365 using the default Node.js user agent, indicative of the Tycoon 2FA kit relay tier.
Okta Impossible Travel Detection
Cortex XDR
Detects when a single user successfully authenticates to Okta from two different countries within a two-hour window, indicating potential impossible travel which could be a sign of a compromised account.
Detects attempts by non-browser processes to access sensitive Chromium-based browser data files such as Login Data, Cookies, History, Web Data, and Local State. This rule focuses on file creation events and excludes legitimate browser processes from the principal. The UDM rule retains principal and target context for correlation.
This rule detects potential password spraying attacks against Microsoft Entra ID (formerly Azure Active Directory). It identifies a high number of failed sign-in attempts from a single source IP address targeting multiple unique user accounts within a short timeframe, specifically looking for 'Invalid password' or 'invalid credentials' failure reasons. The thresholds are set to 20 or more failures and 10 or more unique users within a 5-minute window.
This rule detects suspicious process creations where the command line contains keywords indicative of keylogger activity (e.g., 'keylog', 'keystroke', 'inputmanipulator', 'spyware') combined with installation-related keywords (e.g., 'install', 'create', 'load', 'run'). It aggregates these events by computer and user over one-hour intervals to identify potential keylogger installation attempts.
Detects the execution of known credential extraction tools such as Mimikatz, LaZagne, Hashcat, or John the Ripper, indicated by specific keywords in the command line arguments. This rule monitors for process creation events (EventID 4688) where these tools are used in conjunction with keywords related to passwords, hashes, or credentials.
Page 129 of 206