Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
983 detections
Filters
Last updated
All Time
Detection languages
638
105
82
64
34
Contributors
242
226
216
58
46
Categories
20,443
11,831
5,872
5,155
4,866
983
Platforms
483
405
224
192
62
Products / Services
416
383
182
108
81
MITRE Techniques
496
496
263
234
233
CVEs
4
4
4
3
3
IDS Classtypes
1
This rule detects logon events from Windows Admin Center (WAC) virtual accounts where the associated user principal name (UPN) belongs to an external or unknown tenant. This activity is a key indicator of compromise for CVE-2026-20965, where an attacker uses a forged token from an external tenant to gain unauthorized access.
Detects suspicious process executions where 'ctfmon.exe' or 'cloudfiles.exe' are initiated by a non-SYSTEM user but contain 'SYSTEM' in their command line. This could indicate an attempt to impersonate or escalate privileges, especially when combined with a successful logon event for the same user.
Detects stolen session token reuse to bypass MFA by correlating a successful SSO/VPN login from one IP with a subsequent successful login from a different IP using the same user agent context, or a user-agent change between sessions for the same user within a short window. Targets access broker technique where infostealer-harvested session cookies are replayed from different source IPs.
Detects stolen session token reuse to bypass MFA by correlating a successful SSO/VPN login from one IP with a subsequent successful login from a different IP using the same user agent context, or a user-agent change between sessions for the same user within a short window. Targets access broker technique where infostealer-harvested session cookies are replayed from different source IPs.
Detects failed Windows logon attempts (Event ID 4625) where the supplied username conforms to typical password complexity requirements (minimum 10 characters, including uppercase, lowercase, digit, and special character). This behavior often indicates that a user has mistakenly entered their password into the username field, which may expose credentials in cleartext logs and suggests a potential security awareness issue or an attempt to bypass authentication.
Detects NTLM-authenticated network logons (Logon Type 3) originating from loopback IP addresses (127.0.0.1, ::1, or 0.0.0.0). This behavior is often associated with NTLM relay attacks or credential reflection bypass techniques where an adversary forces a local service to authenticate to itself to gain unauthorized access.
Detects the installation of the Kazuar backdoor, indicated by the creation of a scheduled task or service, following initial access via stolen credentials. This detection correlates suspicious persistence mechanisms with a remote session login on a host previously identified with StealC activity, suggesting a multi-stage attack where initial compromise (StealC) leads to credential theft, followed by remote access and persistence (Kazuar).
This rule detects an unusual number of local or remote interactive logons (LogonType 2 or 10) by the 'SYSTEM' account within a one-hour window. While the SYSTEM account is legitimate, direct interactive logons are rare and multiple occurrences could indicate an attempt to escalate privileges or maintain persistence by an attacker.
Detects potential Browser-in-the-Middle (BitM) session hijacking by identifying scenarios where a single user account authenticates successfully from multiple geographically distinct external IP addresses within a short (10-minute) window, suggesting a parallel session is being used by an attacker.
Identifies instances where a user account established an interactive logon session from a known RedVDS IP address and subsequently executed PowerShell commands containing download patterns (Net.WebClient or DownloadString), indicative of secondary payload retrieval.
Correlates the successful establishment of a reverse proxy (ngrok/cloudflared) with an incoming interactive logon event originating from the local loopback, indicating the tunnel is actively being used for malicious purposes such as Terminal Server Phishing.
Detects anomalous SSH lateral movement originating from the Cisco SD-WAN Manager (vManage) to other control plane components (vSmart/vBond). This rule correlates network connections on port 22 with successful SSH logins using privileged or service-related accounts, which is indicative of potential post-exploitation activity or pivoting within an SD-WAN control plane environment.
Detects anomalous authentication patterns where a single source IP address exhibits multiple failed login attempts followed by at least one successful login within a 10-minute time window, indicative of credential stuffing or password spraying.
Detects high-frequency failed network logon attempts (Logon Type 3) originating from a single IP address. This behavior is indicative of password guessing or password spraying activity against network services.
Detects a potential brute force or password spraying attempt by identifying high volumes of NTLM logon failures (Event ID 4625) originating from a single IP address, targeting multiple distinct user accounts within a 10-minute window.
Detects high-frequency failed network logon attempts (Logon Type 3) originating from a single IP address. This behavior is indicative of password guessing or password spraying activity against network services.
Detects NTLM network logons (LogonType 3) where the workstation name does not match the target computer name and is not a machine account. This pattern is commonly associated with lateral movement techniques such as Pass-the-Hash or other credential relay attacks, where an adversary authenticates to a remote system using compromised credentials.
Detects successful sign-ins by accounts that appear to be Azure AD Connect synchronization service accounts (e.g., 'MSOL_', 'Sync_', 'AADConnect') but are not initiating from the expected Microsoft Azure Active Directory Connect application. This may indicate an adversary attempting to use these highly privileged service accounts for unauthorized access or lateral movement.
Detects high-frequency authentication failure events targeting multiple unique user accounts from the same source IP address within a 10-minute window. This behavior is indicative of password spraying or credential stuffing attacks against Azure Active Directory (Microsoft Entra ID). The rule specifically monitors for common error codes related to incorrect passwords or account lockout conditions.
Detects successful sign-ins by accounts that appear to be Azure AD Connect synchronization service accounts (e.g., 'MSOL_', 'Sync_', 'AADConnect') but are not initiating from the expected Microsoft Azure Active Directory Connect application. This may indicate an adversary attempting to use these highly privileged service accounts for unauthorized access or lateral movement.
Detects potential Pass-the-Hash lateral movement where a single account uses NTLM authentication as a local administrator to access three or more distinct devices within a 30-minute window, a pattern often indicative of automated credential propagation.
Page 36 of 47