Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,235 detections
Filters
Last updated
All Time
Detection languages
734
214
105
78
51
Contributors
206
187
159
111
90
Categories
396
296
264
260
247
Platforms
492
314
281
204
110
Products / Services
379
234
152
109
106
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,235
CVEs
9
9
4
4
4
IDS Classtypes
11
6
4
2
1
IDS Protocols
10
5
3
This rule detects potential CI/CD security compromises in GitHub by monitoring for modifications to workflow permissions that grant 'write-all' access, access to sensitive workflow secrets via 'pull_request_target' from forked repositories, and the registration of new self-hosted runners. These actions are common indicators of supply chain attacks aimed at poisoning pipeline execution or exfiltrating build secrets.
This rule monitors for additions to the 'Domain Admins' group (Event IDs 4728, 4732, 4756) that occur within 15 minutes of an authentication event (Event ID 4624) involving accounts associated with PaperCut software on a Domain Controller. This pattern is indicative of a potential follow-on action after a PaperCut exploitation incident, where an attacker leverages initial access to perform privilege escalation.
Detects scenarios where a user registers a new WebAuthn/Passkey credential and subsequently performs a sign-in from a different network or device shortly after, preceded by a sign-in from a risky or non-passkey-based method. This pattern is often associated with credential abuse or MFA registration hijacking.
Detects rapid, machine-speed, sequential attack-path adaptation by suspected AI agent binaries. The rule monitors for a correlation of four stages occurring within a tight 20-minute window: 1) Failed service connections across three or more distinct protocols (SMB, SSH, HTTP, RDP, WinRM), 2) Credential access attempts (Logon events or execution of known credential-dumping tools), and 3) A lateral movement pivot to a new, previously un-targeted internal destination. The rule specifically keys on the InitiatingProcessId and InitiatingProcessCreationTime to ensure the sequence is attributed to a single process instance, distinguishing it from human manual penetration testing activity. Covers T1190, T1210, T1078
Detects a suspicious pattern where a user account experiences a burst of multiple MFA failures followed by an anomalous successful authentication within a short 15-minute window. This behavior is indicative of automated MFA fatigue attacks or attempts to exploit MFA bypass vulnerabilities.
The following analytic detects Cisco IOS-XE configuration changes performed by the WebUI WSMA process.
Detects a multi-stage, automated attack chain performed by AI-based development agents (e.g., Claude, Copilot, Cursor). The rule correlates process discovery, credential access, file collection (staging), and exfiltration over web services within a tight 15-minute window, identifying potential autonomous exploitation and data exfiltration. Covered T1046, T1552.001, T1078, T1005, T1567
Detects multiple consecutive MFA challenge events (ResultCode 50074 or 50140) for a single user session occurring on unmanaged devices (trustType is null or unknown) while using the Chrome browser. This pattern may indicate an attempt to bypass or exhaust MFA mechanisms, or credential abuse on non-compliant devices.
This rule detects successful authentication to Azure/M365 identity and security management portals (My Sign-Ins, My Apps, My Profile) shortly after a risky or suspicious sign-in event for the same user. This pattern often indicates an account takeover scenario where an adversary, having potentially compromised credentials, immediately accesses account settings to perform further malicious actions, such as registering MFA devices or updating security proofs.
Detects an anomalous burst of git clone, fetch, or download events performed by a single GitHub user account against a large number of private repositories within a short timeframe (15-minute window). This pattern often indicates unauthorized bulk collection or exfiltration of sensitive source code by an actor using a valid account.
Detects Git force-push events or protected branch policy overrides on main or master branches where the authenticated GitHub user differs from the commit author or committer, and the commit is unsigned. This pattern is indicative of credential abuse or account compromise where an attacker pushes unauthorized code while masquerading as a project maintainer.
This rule captures all successful authentication events with a populated source IP address. It serves as a foundational data collection rule for downstream security analytics, enabling the correlation of sign-in events against historical user geolocation baselines, ASN/ISP reputation feeds, and the detection of proxy or suspicious infrastructure usage.
Detects anomalous authentication or API access patterns where a single user account interacts with both Salesforce and ServiceNow environments simultaneously from multiple distinct source IP addresses. This behavior is indicative of credential abuse or account takeovers consistent with multi-platform SaaS targeting.
Detects instances where a user account experiences multiple failed sign-in attempts followed by a successful sign-in from a different, geographically distant location within a short timeframe, indicating impossible travel and potential credential compromise.
Detects successful remote logons to network devices (routers, VPNs, NAS) using the 'admin' account. This pattern is indicative of credential spraying or brute-force attacks targeting weak default credentials on externally facing management interfaces, often associated with botnets or threat actors performing reconnaissance and initial access operations.
This rule detects the repeated use of known default credentials (specifically common factory passwords) across multiple device hostnames. It monitors process command lines or event log data for password patterns matching specific hardcoded strings associated with camera device vulnerabilities. By aggregating hits across different devices, it identifies potential automated brute-force or credential-stuffing campaigns targeting IoT camera infrastructure.
This rule detects the repeated use of known default credentials (specifically common factory passwords) across multiple device hostnames. It monitors process command lines or event log data for password patterns matching specific hardcoded strings associated with camera device vulnerabilities. By aggregating hits across different devices, it identifies potential automated brute-force or credential-stuffing campaigns targeting IoT camera infrastructure.
Detects anomalous access patterns to Microsoft 365 SaaS applications where a single user session interacts with three or more specific portal applications (such as 'OfficeHome', 'My Apps', 'My Profile') within a five-minute window. This behavior may indicate an adversary attempting to map the environment or interact with multiple integrated services shortly after gaining access.
Detects authentication events associated with known actor infrastructure (AnonyMousKIT/Cluster B/UKT) and identifies anomalous crossover patterns where a single source IP authenticates into multiple distinct accounts within a short time window. This behavior is indicative of a shared backend infrastructure across multiple accounts or storefronts.
Detects anomalous or high-volume activity related to Microsoft Graph API calls targeting email messages, mail folders, or attachments. This behavior is indicative of potential unauthorized bulk email collection or exfiltration attempts, often observed in account compromise scenarios where an attacker enumerates and downloads mail contents.
Detects unauthorized access and data retrieval attempts from a MinIO object storage instance using default administration credentials (minioadmin:minioadmin). The rule monitors both command-line execution of MinIO client (mc) operations and network connections to MinIO service ports (9000/9001) that involve the use of the default credential pair.
Page 13 of 59