Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,235 detections
Filters
Last updated
All Time
Detection languages
734
214
105
78
51
Contributors
206
187
159
111
90
Categories
396
296
264
260
247
Platforms
492
314
281
204
110
Products / Services
379
234
152
109
106
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,235
CVEs
9
9
4
4
4
IDS Classtypes
11
6
4
2
1
IDS Protocols
10
5
3
Detects JFrog Artifactory access-token issuance events on/after the suspected compromise window (2026-08-28) where the token is tied to the anonymous identity, granted administrator scope, or has no attributable initiating user, per Fastly's remediation guidance.
Detects the creation of a new AWS S3 bucket followed by a large volume of data uploads (more than 200 objects) within a 2-hour window. The detection focuses on activity attributed to a single identity with limited source IP diversity, which is highly indicative of scripted data staging and potential exfiltration preparation by an unauthorized actor.
Detects unauthorized access and data retrieval attempts from a MinIO object storage instance using default administration credentials (minioadmin:minioadmin). The rule monitors both command-line execution of MinIO client (mc) operations and network connections to MinIO service ports (9000/9001) that involve the use of the default credential pair.
Detects unauthorized access and data retrieval attempts from a MinIO object storage instance using default administration credentials (minioadmin:minioadmin). The rule monitors both command-line execution of MinIO client (mc) operations and network connections to MinIO service ports (9000/9001) that involve the use of the default credential pair.
Detects lateral movement activity where a host identified as running the Langflow framework attempts to connect to internal MySQL (3306) or Nacos (8848) services while utilizing root credentials, potentially indicating an attacker pivoting from a compromised application server.
Detects lateral movement activity where a host identified as running the Langflow framework attempts to connect to internal MySQL (3306) or Nacos (8848) services while utilizing root credentials, potentially indicating an attacker pivoting from a compromised application server.
This rule identifies sign-in events or alerts that are explicitly flagged by security intelligence as originating from IP addresses associated with known malicious or attacker infrastructure.
This rule detects anomalous activity where users access Microsoft 365 services (SharePoint, OneDrive, Exchange) through identified anonymous proxy connections. It identifies potentially malicious exfiltration or bulk activity by flagging users who perform a high number of operations (1,000+ events) or download a significant volume of data (5GB+) within a 2-hour window.
This rule detects successful user authentication events within the environment. It acts as a base filter to capture login success, which can be further refined with context such as IP addresses or usernames to monitor for anomalous login patterns, though it does not inherently provide detection of complex attacks like session token hijacking on its own.
Detects a successful authentication event where standard endpoint identification metadata (endpoint name and IP address) is absent. This often indicates logs originating from sources without proper endpoint telemetry integration or potential attempts to obfuscate the source of an authentication request.
This rule detects potentially malicious or automated data access patterns within Microsoft 365 or similar cloud environments. It identifies user accounts or applications that exhibit a high volume of file/email access operations across a diverse set of paths, which is often indicative of automated data exfiltration, scraping, or suspicious collection by a compromised identity.
Detects anomalous data access or collection activity across multiple M365 workloads (SharePoint, OneDrive, Exchange). The rule identifies users exhibiting high volumes of file or mail access across at least two distinct workloads within a one-hour window, which may indicate account compromise, bulk data exfiltration, or unauthorized persistence via mailbox rules.
Detects a suspicious sequence of events where a user's password is changed or reset by an administrator (or help-desk role) followed within a short time window by that same user registering a new MFA device, potentially indicating a vishing-based account takeover attack (e.g., PREY-0058/UNC6671).
Detects anomalous or high-volume activity related to Microsoft Graph API calls targeting email messages, mail folders, or attachments. This behavior is indicative of potential unauthorized bulk email collection or exfiltration attempts, often observed in account compromise scenarios where an attacker enumerates and downloads mail contents.
Detects anomalous or high-volume activity related to Microsoft Graph API calls targeting email messages, mail folders, or attachments. This behavior is indicative of potential unauthorized bulk email collection or exfiltration attempts, often observed in account compromise scenarios where an attacker enumerates and downloads mail contents.
Detects a GitLab personal access token/response indicating Owner-level (access_level 50) group access combined with the broad 'api' scope on the sensitive gnutls/gnutls project -- the excessive standing-privilege pattern that turned one leaked token into a 55-project exposure.
Detects the gitlab-triage automation tool being invoked with a personal access token scoped to the broad 'api' permission rather than a narrower issue/MR-only scope, inflating the blast radius if the token leaks.
Detects successful authentication events to the Cisco Secure Firepower Management Center (FMC) web management interface involving low-privileged or read-only user accounts. This pattern is potentially associated with exploitation of vulnerabilities such as CVE-2026-20316, which may be leveraged for privilege escalation or unauthorized access.
Detects successful authentication events to the Cisco Secure Firepower Management Center (FMC) web management interface involving low-privileged or read-only user accounts. This pattern is potentially associated with exploitation of vulnerabilities such as CVE-2026-20316, which may be leveraged for privilege escalation or unauthorized access.
Detects instances where a user successfully authenticates using the OAuth Device Code flow followed by subsequent mailbox operations (such as reading, sending, or deleting items) from a different IP address within a 10-minute window. This behavior is a strong indicator of adversary-in-the-middle phishing attacks where an attacker captures a session token and utilizes it from a remote location.
Detects when a user who has successfully authenticated to a system is subsequently added to the 'Domain Admins' group within a 15-minute window. This behavior often indicates an adversary performing privilege escalation after gaining initial access to an account.
Page 17 of 59