Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,443
11,831
5,875
5,151
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
This rule detects the access or creation of Microsoft Office files (docx, xlsx, pptx) that have 'password' or related keywords in their filename or folder path. It also attempts to identify if these files contain password-related content through DLP indicators, suggesting potential sensitive data exposure or staging.
This rule detects the execution of common accessibility tools (osk.exe, powershell.exe, pwsh.exe, cmd.exe, reg.exe) with command-line arguments indicating an attempt to modify or leverage Windows accessibility features for persistence or privilege escalation. Specifically, it looks for command lines referencing 'Software\Microsoft\Windows NT\CurrentVersion\Accessibility' and 'ATConfig\osk' or 'Accessibility\Session'. This behavior is often associated with adversaries attempting to maintain access or elevate privileges by manipulating accessibility programs like the On-Screen Keyboard.
Detects potential adversary-in-the-middle (AiTM) session hijacking by identifying a single session ID being used in successful sign-ins from multiple distinct IP addresses and with different User-Agent strings within a short timeframe. This behavior is indicative of an attacker stealing a session cookie and replaying it from their own machine, a technique commonly used by phishing kits like Tycoon2FA.
AWS EC2 GetPasswordData API Call
Cortex XDR
Detects when the AWS EC2 GetPasswordData API call is made. This API call retrieves the Windows administrator password for an EC2 instance, which could indicate an attempt to gain unauthorized access to an instance.
Detects potential adversary-in-the-middle (AiTM) session hijacking by identifying a single session ID being used in successful sign-ins from multiple distinct IP addresses and with different User-Agent strings within a short timeframe. This behavior is indicative of an attacker stealing a session cookie and replaying it from their own machine, a technique commonly used by phishing kits like Tycoon2FA.
Azure Blob Storage Account Key Access
Cortex XDR
Detects successful access to Azure Blob Storage using storage account keys (key1 or key2). This activity is often indicative of an adversary using compromised credentials to access cloud storage resources.
Detects the invocation of the Windows Credential Manager interface via rundll32.exe loading keymgr.dll with the KRShowKeyMgr export. This technique is used to view or dump stored credentials and is known to be employed by the Warlock ransomware group during post-exploitation lateral movement.
This rule detects suspicious activity where a new device is registered after a user browse or click on a Microsoft device login page. This could indicate an adversary attempting to register a new device to bypass multi-factor authentication or establish persistence.
AWS Console Brute Force Activity
Cortex XDR
Detects repeated failed AWS console login attempts from the same IP address within a one-hour window, indicating a potential brute-force attack against AWS accounts.
This query detects multiple TTPs associated with the Storm-2561 campaign that uses SEO poisoning to distribute fake VPN clients for credential theft. It looks for known file hashes, a specific code-signing certificate, malicious DLL side-loading and C2 communication patterns.
This rule detects potential GraphRunner activity in Azure environments by identifying suspicious authentication attempts to Microsoft Graph using the 'deviceCode' authentication protocol, combined with specific user agent strings associated with the GraphRunner tool. It categorizes detections into high confidence (both device code and suspicious user agent), device code authentication only, or suspicious user agent only.
This rule detects impossible travel scenarios for user sign-ins that occur shortly after a device associated with that user has been wiped, retired, or deleted. It calculates the speed between consecutive sign-in locations for the same user and flags any travel exceeding 900 km/h, indicating a potential compromise or fraudulent activity.
Correlates an email URL click with a subsequent risky sign-in from the same user within a short timeframe. This pattern is a strong indicator of a successful Adversary-in-the-Middle (AiTM) phishing attack, such as those conducted with the Tycoon2FA kit, where a user is tricked into authenticating through a malicious site, allowing the attacker to capture their session.
Detects when a single user account successfully signs in from two or more distinct IP addresses within a short timeframe. This can be an indicator of an adversary-in-the-middle (AiTM) attack where both the legitimate user and the attacker have active, authenticated sessions from different locations.
Detects instances where the telnetd process spawns the login binary with the '-f' flag. This behavior is indicative of exploitation of CVE-2026-24061, which allows an attacker to bypass authentication by injecting arguments into the login process via a crafted USER environment variable.
Detects a FortiGate configuration file download followed by the creation of a new computer account in Active Directory by the 'fortidcagent' service account within a short time window. This pattern may indicate an attacker has compromised a FortiGate appliance, extracted credentials from the configuration, and is now using them to join a rogue device to the domain for lateral movement.
Detects when the same AWS IAM user ARN performs actions from more than one distinct source IP within a 1-hour window. Indicative of session hijacking, credential sharing, or AiTM compromise where attacker egress IP differs from the victim's IP. AssumedRole is excluded by default due to high noise from automation — add back with tuned ARN exclusions if needed.
Detects a FortiGate configuration file download occurring within 10 minutes of a successful administrative login from the same user and source IP address. This rapid sequence of events can indicate an attacker who has gained administrative access and is proceeding to exfiltrate sensitive configuration data, which may contain credentials for other systems.
This rule detects potential brute force or credential stuffing attacks against Azure AD by identifying multiple failed sign-in attempts followed by a successful sign-in from the same user and IP address within a short time frame (1 minute). It specifically looks for scenarios where the successful sign-in occurs after the failed attempts and involves different applications, excluding common Office 365 services to reduce noise.
This rule detects interactive logons (LogonType 10) where a single account from the same domain logs into multiple distinct devices. This could indicate an attacker using compromised credentials to move laterally within the network or access multiple systems.
Detects HTTP POST requests to "/api/get_challenge" or "/api/get_credentials" on port 5000. This is the initial communication pattern of the TunnesshClient backdoor, a component of the BoryptGrab campaign, to retrieve SSH credentials from its C2 server before establishing a reverse SSH tunnel.
Page 154 of 206