Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
254 detections
Filters
Last updated
All Time
Detection languages
167
41
16
14
10
Contributors
61
60
42
18
13
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
133
108
85
38
34
Products / Services
112
83
65
30
30
MITRE Techniques
75
74
36
36
35
CVEs
7
6
6
6
6
Correlates a high-risk or compromised Microsoft Entra sign-in event with a subsequent device registration (Add device or Register device) performed by the same user account within a 3-hour window.
Box Shield Anomalous Download
Cortex XDR
Surfaces Box Shield anomalous download alerts with full context extraction, including download delta, historical baseline vs anomaly period comparison, and source IPs.
Detects endpoint, network, and security log activity matching known indicators of compromise (IOCs) associated with PEERSTITCH / CL-STA-0954, including specific file hashes, IP addresses, and URLs.
Box Shield Suspicious Location Access
Cortex XDR
Surfaces Box Shield suspicious location alerts with geographic context and accessed content details. Detects access from unusual or excluded geographic locations indicating potential compromised accounts or credential theft.
Box Shield Malicious Content Upload
Cortex XDR
Surfaces Box Shield malware detection alerts with file hash, upload path, source IP, and scan results for immediate correlation and threat response.
Detects potential password spraying activity in Azure Active Directory by identifying a single source IP address that authenticates against multiple distinct user accounts within a short time frame. The rule flags instances where there are numerous authentication attempts across many users, characterized by a low per-user failure count followed by at least one successful authentication, which is indicative of a successful password spray attempt.
Detects coordinated malicious activity on VMware ESXi hosts indicative of ransomware attacks. The rule correlates multiple suspicious events within a 10-minute window, including the appearance of known ESXi ransom notes/banners, mass datastore file renames or encryption extensions, virtual machine stop events, and snapshot deletions designed to prevent recovery.
Correlates a high-risk or compromised Microsoft Entra sign-in event with a subsequent device registration (Add device or Register device) performed by the same user account within a 3-hour window.
Detects endpoint, network, and security log activity matching known indicators of compromise (IOCs) associated with PEERSTITCH / CL-STA-0954, including specific file hashes, IP addresses, and URLs.
Detects endpoint, network, and security log activity matching known indicators of compromise (IOCs) associated with PEERSTITCH / CL-STA-0954, including specific file hashes, IP addresses, and URLs.
Detects endpoint, network, and security log activity matching known indicators of compromise (IOCs) associated with PEERSTITCH / CL-STA-0954, including specific file hashes, IP addresses, and URLs.
Detects Cisco AI Defense prompt events that were allowed and matched a privacy guardrail for personally identifiable information or payment card data.
These events may indicate that sensitive information was submitted to an AI application and should be reviewed against the organization's data handling policy.
These events may indicate that sensitive information was submitted to an AI application and should be reviewed against the organization's data handling policy.
Detects endpoint, network, and security log activity matching known indicators of compromise (IOCs) associated with PEERSTITCH / CL-STA-0954, including specific file hashes, IP addresses, and URLs.
Detects Cisco AI Defense response events that were allowed and matched a privacy guardrail for personally identifiable information or payment card data.
These events may indicate that sensitive information was returned to an AI application user and should be reviewed promptly.
These events may indicate that sensitive information was returned to an AI application user and should be reviewed promptly.
This rule monitors Entra ID Sign-in logs for authentication events flagged by risk detections related to anonymizing infrastructure, such as VPNs, TOR exit nodes, or proxies. It identifies successful logins and aggregate sign-in volume from these IP addresses, flagging successful logins as critical due to the potential for valid account abuse through multi-hop proxy chains.
This analytic summarizes Cisco AI Defense events by application, connection, action, message direction, and severity over ten-minute intervals.
Allowed responses flagged for privacy guardrails are handled by the dedicated sensitive-response detection.
Allowed prompts flagged for privacy guardrails are handled by Cisco AI Defense Allowed Sensitive Prompt.
Repeated prompt injection, code detection, PII, or PCI events are handled by the repeated high-risk activity detection.
Allowed responses flagged for privacy guardrails are handled by the dedicated sensitive-response detection.
Allowed prompts flagged for privacy guardrails are handled by Cisco AI Defense Allowed Sensitive Prompt.
Repeated prompt injection, code detection, PII, or PCI events are handled by the repeated high-risk activity detection.
Detects anomalous sign-in activity for users by comparing current successful login attempts against a 14-day historical baseline. The rule flags logins originating from new IP addresses, new applications, or new geographic locations, specifically identifying instances where at least two of these parameters deviate from the established historical norm for the specific user.
Detects scenarios where an account experiences mail bombing activity followed closely by a suspicious Microsoft Teams chat initiation by an external user within a 2-hour window, potentially indicating a multi-stage social engineering or extortion campaign.
This rule detects when an SAP user generates audit records exceeding a configured hourly threshold (200 for high severity or 4000 for medium severity events) on their system. This behavior may indicate automated scanning, mass data extraction, or anomalous user activity within SAP environments.
Detects bursts of five or more distinct Cisco AI Defense event IDs, or three or more occurrences of the same event ID, matching prompt injection, code detection, PII, or PCI guardrails for the same application and connection within ten minutes.
Allowed PII/PCI prompt events are handled by Cisco AI Defense Allowed Sensitive Prompt.
These patterns can indicate iterative prompt-injection probing or repeated attempts to use an AI application to access restricted data or capabilities.
Allowed PII/PCI prompt events are handled by Cisco AI Defense Allowed Sensitive Prompt.
These patterns can indicate iterative prompt-injection probing or repeated attempts to use an AI application to access restricted data or capabilities.
This rule monitors Entra ID Sign-in logs for authentication events flagged by risk detections related to anonymizing infrastructure, such as VPNs, TOR exit nodes, or proxies. It identifies successful logins and aggregate sign-in volume from these IP addresses, flagging successful logins as critical due to the potential for valid account abuse through multi-hop proxy chains.
Page 1 of 13