Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,235 detections
Filters
Last updated
All Time
Detection languages
734
214
105
78
51
Contributors
206
187
159
111
90
Categories
396
296
264
260
247
Platforms
492
314
281
204
110
Products / Services
379
234
152
109
106
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,235
CVEs
9
9
4
4
4
IDS Classtypes
11
6
4
2
1
IDS Protocols
10
5
3
This rule detects potentially unauthorized or suspicious administrative actions in an Azure environment following a login to specific AI-related applications (AI Gateway, LLM Proxy, or Model Router). It triggers when a user authenticates without applying Conditional Access policies or without Multi-Factor Authentication (MFA), followed immediately (within 30 minutes) by sensitive Azure administrative operations such as role assignments, Key Vault access, or VM write operations.
This rule detects potentially unauthorized or suspicious administrative actions in an Azure environment following a login to specific AI-related applications (AI Gateway, LLM Proxy, or Model Router). It triggers when a user authenticates without applying Conditional Access policies or without Multi-Factor Authentication (MFA), followed immediately (within 30 minutes) by sensitive Azure administrative operations such as role assignments, Key Vault access, or VM write operations.
Detects inbound email messages authenticated with an amazonses.com DKIM signature that originate from a specific Amazon SES Tokyo-region relay IP address. This may indicate an adversary is leveraging a compromised or unauthorized transactional email account (e.g., SES or third-party platforms like Resend) to send emails on behalf of a victim domain.
This rule detects Azure AD sign-in attempts to the 'OfficeHome' application resulting in error code 90014. This specific error indicates that the OAuth flow was initiated without the required nonce parameter, a behavior frequently observed when adversary-in-the-middle (AiTM) phishing kits relay authentication flows incorrectly. The rule highlights the significance of this error when correlated with implausible user-agent and operating system combinations.
Detects RDP-based lateral movement, including pivots into VDI, AD, and authentication infrastructure, excluding known bastion/jump hosts and flagging sessions from atypical source workstations or off-hours timing.
This rule detects a potential security risk by identifying instances where a user registers a new security information method (e.g., FIDO2/Passkey) and subsequently logs in using that same authentication method within a 15-minute window. This pattern may indicate an attacker who has gained initial access or compromised credentials and is attempting to establish persistence or facilitate further account takeovers by registering their own multifactor authentication device.
This rule detects a high frequency of sessions related to Azure Cloud Shell or portal consoles initiated from the same IP address within a one-hour window. Frequent access to Azure Cloud Shell can indicate potentially suspicious administrative behavior, reconnaissance, or automated interaction with the cloud environment.
This rule monitors for successful GlobalProtect gateway connections from users who have not successfully connected in the preceding 30 days, specifically identifying users connecting with a client fingerprint of 'Microsoft Windows 10 Pro 64-bit'. This behavior is indicative of potential initial access using compromised or new credentials, or specifically flagging suspicious activity patterns associated with specific exploit proof-of-concept client fingerprints.
This rule monitors Azure Key Vault operations, specifically focusing on unauthorized or excessive retrieval of secrets, keys, or certificates. It triggers when a specific user or service principal makes 10 or more requests for unique assets within a 10-minute window, which may indicate automated discovery, mass exfiltration, or a brute-force attempt to harvest credentials stored within the vault.
This rule detects a high frequency of sessions related to Azure Cloud Shell or portal consoles initiated from the same IP address within a one-hour window. Frequent access to Azure Cloud Shell can indicate potentially suspicious administrative behavior, reconnaissance, or automated interaction with the cloud environment.
This rule monitors for successful GlobalProtect gateway connections from users who have not successfully connected in the preceding 30 days, specifically identifying users connecting with a client fingerprint of 'Microsoft Windows 10 Pro 64-bit'. This behavior is indicative of potential initial access using compromised or new credentials, or specifically flagging suspicious activity patterns associated with specific exploit proof-of-concept client fingerprints.
This rule detects scenarios where a new user account is created (Event ID 4720) and is subsequently logged into (Event ID 4624) within a 30-minute window. This behavior can indicate an adversary creating a backdoor or service account for persistence or lateral movement, followed by immediate usage of that account.
Detects Shai-Hulud / ChainDrop activity by correlating known malicious hashes, npm/Node/Bun execution, payload artifacts, IDE persistence, credential discovery, cloud metadata access, GitHub exfiltration, C2 domains, Ethereum RPC activity, staging files, persistence artifacts, and known IOC IP connections.
This rule monitors for high-risk modifications to Zscaler security policies such as disabling SSL inspection or DLP engines, or deleting/modifying firewall and URL filtering rules. It also flags administrative logins from locations previously unseen for that user, which may indicate account compromise or unauthorized access.
Detects anomalous access attempts to Netskope Private Access applications, specifically identifying connections from unmanaged devices, access occurring outside of typical business hours, or access from unusual/unexpected geographic locations.
A GitHub maintainer account related to the keyv/cacheable npm package ecosystem was compromised. The attacker published malicious versions of these packages, which affected more than 400 npm packages. The malware is designed to steal cloud credentials, developer secrets, CI/CD secrets, AI tool configuration files, and cryptocurrency wallet data. It also creates persistence using Claude Code hooks and VS Code tasks.json files, and sends stolen data to attacker-controlled GitHub repositories and C2 domains.
Reference article: https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack
Reference article: https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack
Detects sign-in events using 'deviceCode' authentication or single-factor authentication via mobile/desktop clients where the device identifier has not been seen in the previous 30 days. This pattern can indicate an adversary using a new device to access an account, potentially utilizing stolen sessions or bypassing MFA.
KQL Query from file: Hunting Mirage kitten AKA unc1549
This rule monitors Azure Key Vault operations, specifically focusing on unauthorized or excessive retrieval of secrets, keys, or certificates. It triggers when a specific user or service principal makes 10 or more requests for unique assets within a 10-minute window, which may indicate automated discovery, mass exfiltration, or a brute-force attempt to harvest credentials stored within the vault.
This rule detects scenarios where a new user account is created (Event ID 4720) and is subsequently logged into (Event ID 4624) within a 30-minute window. This behavior can indicate an adversary creating a backdoor or service account for persistence or lateral movement, followed by immediate usage of that account.
This rule identifies accounts (by SID) that have registered multiple local AI agent instances. It aggregates agent registration information over a 30-day period, summarizing the total count of agents and listing specific device names and IDs associated with each account to identify potential anomalous behavior, such as credential abuse or unauthorized mass deployment of local AI tools.
Page 23 of 59