Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,443
11,831
5,875
5,151
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects possible addition of shadow credentials to an active directory object.
Detects curl or wget accessing the default Kubernetes service account token path. Adapted from Unit 42 reporting on Slow Pisces and React2Shell (CVE-2025-55182) campaigns.
Detects when a user has potentially entered their password into the
username field, which will cause the password to be retained in log files.
username field, which will cause the password to be retained in log files.
This rule detects the exposure of Kuwaiti Civil ID numbers in various log sources, including process command lines, additional device event fields, and email subjects/sender addresses. A Kuwaiti Civil ID is identified by a 12-digit number starting with 1, 2, or 3.
Detects attempts to access or exfiltrate the default Kubernetes service account token file using web utilities like curl or wget. This activity is commonly observed in attacks by threat actors such as Slow Pisces to escalate privileges or move laterally from a compromised pod into backend cloud infrastructure.
This rule detects the exposure of Kuwaiti Civil ID numbers in various log sources, including process command lines, additional device event fields, and email subjects/sender addresses. A Kuwaiti Civil ID is identified by a 12-digit number starting with 1, 2, or 3.
Detects the execution of the native macOS dscl utility with the -authonly flag. This technique is used by malware, such as Miolab Stealer, to silently validate phished user credentials captured via fake authentication prompts before escalating privileges or exfiltrating data.
This rule detects two related scenarios: 1. Device Code Phishing: Correlates successful device code authentications with subsequent device registrations for the same user within a short time frame. This can indicate an attacker using a phished device code to register a new device. 2. Primary Refresh Token (PRT) Device Registration: Identifies device registrations that occur after an authentication to the Device Registration Service using a Primary Refresh Token. This pattern is indicative of an attacker minting a PRT and then using it to register or join a device, potentially bypassing conditional access policies.
KQL Query from file: KQL Detection for MDI Password Protection Insight
This rule detects multiple failed sign-in attempts using the 'Device Code' authentication flow from various IP addresses or locations for a single user. This behavior can indicate an adversary attempting to bypass multi-factor authentication (MFA) or gain unauthorized access through device code phishing or brute-force attacks against the device code flow. The rule specifically looks for more than 3 attempts from more than 2 distinct IP addresses or locations, targeting common Microsoft applications like Office, Teams, Azure Portal, or Graph.
Detects indicators of the TeamPCP LiteLLM supply chain compromise. This includes the creation or modification of specific malicious files (litellm_init.pth, tpcp.tar.gz, sysmon.py, sysmon.service), execution of commands related to persistence (systemctl for sysmon.service), data archiving (tar for tpcp.tar.gz), or direct execution of the backdoor (sysmon.py). It also identifies network connections or DNS queries to known command and control (C2) domains (models.litellm.cloud, checkmarx.zone) and HTTP requests to checkmarx.zone. Furthermore, the rule detects unauthorized AWS API calls (ListSecrets, GetSecretValue, DescribeParameters) made using the 'python-urllib' user agent, which is indicative of custom scripting rather than standard boto3 usage.
Detects unauthorized processes attempting to access or interact with the dynamically generated Azure Arc identity token .key files. These files reside in a protected directory and are limited to SYSTEM-level ARC agent processes
This rule detects activity associated with TruffleHog, an open-source tool used for finding credentials and sensitive data, within cloud audit logs. It specifically looks for the 'trufflehog' string in the user_agent field, indicating that the tool was used to interact with cloud resources.
Detects Azure AD application registrations with redirect URIs pointing to known tunneling, reverse proxy, or attacker interaction/callback infrastructure. This can indicate an adversary attempting to establish persistence or exfiltrate data.
This rule detects attempts to exploit a vulnerability in ShareFile (CVE-2026-2699/CVE-2026-2701) by monitoring for HTTP GET requests to the `/ConfigService/api/StroageZoneConfig` URI path with a `h=` query parameter. This pattern is indicative of an attacker trying to leak API secrets.
This rule detects sign-in attempts to Azure AD where the User-Agent string contains 'TruffleHog'. TruffleHog is an open-source tool used for finding sensitive data like credentials in various data sources, including code repositories. Its presence in sign-in logs could indicate an adversary or security researcher attempting to verify leaked credentials or discover exposed secrets related to Azure AD service principals.
This rule detects multiple failed authentication attempts for a single user from a specific source IP and host. This behavior can indicate a brute-force attack or password guessing attempt against user accounts.
This rule detects suspicious activity where a non-browser process attempts to decrypt credentials stored by Google Chrome or Microsoft Edge using DPAPI (Data Protection API). This could indicate an adversary attempting to steal stored browser credentials.
Azure Suspicious Redirect URI Detection
Cortex XDR
This rule detects the modification or addition of redirect URIs for Azure Active Directory applications or service principals that point to suspicious domains. These suspicious domains include known reverse proxy/tunneling services (e.g., ngrok, cloudflare tunnel), callback infrastructure (e.g., burpcollaborator, interact.sh), or localhost/loopback addresses. Such modifications can indicate an adversary attempting to establish persistence, exfiltrate data, or redirect authentication flows to attacker-controlled infrastructure.
Detects potential NetScaler administrative session hijacking by monitoring for the usage of SESSID or NITRO_SK administrative cookies from multiple source IPs. Attackers leverage CVE-2026-3055 to steal these specific session cookies to gain unauthorized administrative access.
This rule detects suspicious device registration activity in Microsoft 365. It correlates users who have recently visited Microsoft device login or OAuth2 device authentication URLs with subsequent device registration events in Azure AD. This could indicate an adversary attempting to register a new device to bypass MFA or gain persistent access, potentially through device code phishing.
Page 152 of 206