Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,235 detections
Filters
Last updated
All Time
Detection languages
734
214
105
78
51
Contributors
206
187
159
111
90
Categories
396
296
264
260
247
Platforms
492
314
281
204
110
Products / Services
379
234
152
109
106
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,235
CVEs
9
9
4
4
4
IDS Classtypes
11
6
4
2
1
IDS Protocols
10
5
3
This rule detects a suspicious sequence of AWS CloudTrail events where a single identity performs a burst of discovery and enumeration activities (reconnaissance) followed shortly by requests to access sensitive secrets, credentials, or sensitive files (e.g., .env files). This pattern is indicative of an attacker who has gained initial access and is pivoting to identify and exfiltrate credentials.
Detects anomalous bursts of cloud secret or parameter retrieval API calls followed shortly by administrative actions that expose data or credentials (such as bucket policy changes or new key creation). This behavior is consistent with an adversary staging compromised credentials to exfiltrate data or maintain persistence.
Detects potential session hijacking of a Claude SaaS account by identifying sign-ins from unrecognized IP addresses followed by a high-volume burst of API usage or message activity that deviates from the account's established baseline.
This rule detects anomalous authentication behavior on SonicWall VPN appliances characterized by either multiple distinct source IP addresses for a single user or a high volume of failed authentication attempts followed by a successful login. These patterns are often indicative of credential stuffing or password spraying campaigns, such as those observed in Akira ransomware affiliate initial access activities.
Detects when a user has been elevated to manage all Azure Subscriptions.
This change should be investigated immediately if it isn't planned.
This setting could allow an attacker access to Azure subscriptions in your environment.
This change should be investigated immediately if it isn't planned.
This setting could allow an attacker access to Azure subscriptions in your environment.
Detects successful user logins to accounts with names containing support-related terminology such as 'IT Support', 'Help Desk', or 'IT Department'. These accounts are often highly privileged or sensitive targets for credential abuse.
This rule monitors successful user sign-ins using the 'deviceCode' authentication protocol that originate from an IP address previously unseen for that specific user within the last 24 hours. The Device Code flow is commonly targeted in phishing campaigns to bypass traditional credential-based MFA, making anomalous logins using this protocol a high-signal indicator of account compromise.
Detects sign-ins to Office Home or Office365 applications from unmanaged or unknown devices, followed by an unusual amount or variety of activity within SharePoint Online or OneDrive for Business within a two-hour window. This behavior is indicative of potential unauthorized access or account compromise where an actor is using a non-corporate device to interact with sensitive cloud documents.
Detects potential device-code phishing abuse where a successful device code authentication is followed by scripted API activity using common automation user agents within a short time window (10 minutes). This behavior is indicative of an attacker who has successfully phished a user's device code and is immediately leveraging the stolen token to interact with Microsoft Graph, Azure, or Intune services.
Detects anomalous usage patterns for AI-platform API keys consistent with account takeover, specifically identifying concurrent multi-geographic access and the exercise of elevated administrative, write, or model-registry scopes within a short timeframe.
Detects the creation or modification of inbox rules (e.g., forwarding, redirecting, deleting, or moving to hidden folders) that target finance, invoice, or payment-related communications, occurring shortly after an initial user sign-in from a new or unseen country/ASN within the last 30 days. This pattern is indicative of a post-compromise activity where an adversary attempts to exfiltrate financial data or hide malicious email activity.
Detects a suspicious sequence of events where a user engagement (voice/video call) involving themes of urgency or helpdesk interaction is closely followed by a high-risk administrative action (e.g., password reset, MFA device enrollment, or financial transfer) by the same user, where the communication session context differs from standard activity, indicative of a deepfake-enabled vishing attack.
Detects specific administrative actions within Entra ID/Azure AD, including directory role assignments, password resets, and account enablement/disablement. This rule monitors for sensitive identity lifecycle and privilege management events that, if performed by unauthorized actors or in an unexpected context, could indicate account compromise, persistence, or privilege escalation.
Detects a suspicious sequence of events where a user engagement (voice/video call) involving themes of urgency or helpdesk interaction is closely followed by a high-risk administrative action (e.g., password reset, MFA device enrollment, or financial transfer) by the same user, where the communication session context differs from standard activity, indicative of a deepfake-enabled vishing attack.
Detects login attempts to internet-exposed FortiGate SSL VPN or firewall management interfaces using suspicious, generic, or potentially leaked administrative account patterns such as fgt-*, FortiManager-*, or tech-support-*. These accounts typically suggest attempts to exploit default, hardcoded, or publicly shared credentials on network infrastructure.
Detects unauthenticated access attempts or requests originating from system/service accounts targeting the PaperCut NG/MF administrative interface, which may indicate exploitation of authentication bypass vulnerabilities (e.g., CVE-2026-81578).
Detects instances where a removed GitHub organization member performed bulk repository access (cloning or downloading) shortly before their removal, potentially indicating exploitation of retained access by a departed employee or an adversary using a valid account before deprovisioning. The rule identifies activity occurring more than 24 hours prior to removal involving multiple repositories or multiple access actions.
This rule detects successful user logins that utilize the 'deviceCode' authentication protocol in conjunction with suspicious network indicators, specifically traffic originating from residential proxies. This combination is highly indicative of potential phishing or unauthorized access attempts using stolen session tokens or bypassed MFA mechanisms.
This rule monitors for suspicious credential-related activity targeting ONVIF interfaces on network devices (such as IP cameras). It detects a pattern where a successful 'global.login' RPC authentication is quickly followed (within 300 seconds) by commands or RPC methods related to credential dumping or user enumeration (e.g., OnvifUser, GetUsers). This sequence is indicative of an adversary using legitimate access to gain unauthorized information from a device.
This rule monitors successful sign-in activity specifically targeting identified critical banking applications. It aggregates login counts, the number of unique users, and the unique IP addresses accessing these applications over the last 24 hours to provide visibility into usage patterns.
Detects anomalous remote access or VPN login activity for a user account, characterized by either logins from multiple distinct countries or logins occurring during off-hours (between 8:01 PM and 5:59 AM). This rule helps identify potential credential abuse where valid accounts are being leveraged from unexpected locations or times.
Page 12 of 59