Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,235 detections
Filters
Last updated
All Time
Detection languages
734
214
105
78
51
Contributors
206
187
159
111
90
Categories
396
296
264
260
247
Platforms
492
314
281
204
110
Products / Services
379
234
152
109
106
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,235
CVEs
9
9
4
4
4
IDS Classtypes
11
6
4
2
1
IDS Protocols
10
5
3
This rule identifies anomalous SonicWall VPN login attempts by tracking successful logins over a rolling 30-day baseline. It alerts when a user successfully authenticates from an IP address not previously seen in their baseline activity, specifically during off-hours (00:00 to 05:00).
This rule monitors SCIM (System for Cross-domain Identity Management) logs for high-volume identity management operations, including account creation, deletion, or entitlement grants within a short 15-minute window. A trigger occurs if an actor performs 10 or more creations, 10 or more deletions, 10 or more entitlement grants, or 3 or more administrative role grants. This behavior may indicate an account compromise performing bulk manipulation of identities to maintain persistence or elevate privileges.
This rule monitors Zscaler Internet Access logs for high volumes of session activity, specifically detecting when a user exceeds a burst threshold of new session creations or consistently operates near the maximum allowed concurrent session limit within a 10-minute window. This behavior may indicate account compromise, automated credential stuffing, or abuse of access policies.
This rule identifies accounts (by SID) that have registered multiple local AI agent instances. It aggregates agent registration information over a 30-day period, summarizing the total count of agents and listing specific device names and IDs associated with each account to identify potential anomalous behavior, such as credential abuse or unauthorized mass deployment of local AI tools.
Detects sign-ins from the same user account occurring from two different countries within a short time window, where the implied travel velocity exceeds physically achievable speeds, indicating impossible travel or anomalous geolocation change consistent with a hijacked account or API key credential, with special attention to sudden access from China-based infrastructure.
Detects sign-in events using 'deviceCode' authentication or single-factor authentication via mobile/desktop clients where the device identifier has not been seen in the previous 30 days. This pattern can indicate an adversary using a new device to access an account, potentially utilizing stolen sessions or bypassing MFA.
Detects Shai-Hulud / ChainDrop activity by correlating known malicious hashes, npm/Node/Bun execution, payload artifacts, IDE persistence, credential discovery, cloud metadata access, GitHub exfiltration, C2 domains, Ethereum RPC activity, staging files, persistence artifacts, and known IOC IP connections.
Detects MFA authentication attempts in Duo where the source IP address is identified by Duo as a known anonymous proxy, VPN, or Tor exit node. Such infrastructure is frequently used by adversaries to mask their true origin during credential stuffing, session hijacking, or post-compromise activity.
Detects sustained spikes in AI/LLM API spend or token consumption for a given API key relative to its own dynamic rolling baseline, which may indicate a stolen/hijacked API key being resold or abused via gray-market proxy services (token jacking).
Detects users or applications whose AI API token consumption or spend is sustained above a dynamic baseline across multiple consecutive time buckets rather than a single burst, which may indicate token jacking, credential theft, or abuse of stolen AI API keys via gray-market proxy services.
Detects instances where an Azure Automation Runbook interacts with or initiates a sign-in log activity that does not correspond to its own Managed Identity. This anomaly may indicate the abuse of a managed identity token to access unauthorized resources or perform lateral movement within the Azure environment.
Detects instances where an Azure Automation Runbook interacts with or initiates a sign-in log activity that does not correspond to its own Managed Identity. This anomaly may indicate the abuse of a managed identity token to access unauthorized resources or perform lateral movement within the Azure environment.
This rule identifies anomalous SonicWall VPN login attempts by tracking successful logins over a rolling 30-day baseline. It alerts when a user successfully authenticates from an IP address not previously seen in their baseline activity, specifically during off-hours (00:00 to 05:00).
Detects developer accounts whose daily count of API key creation or model provisioning operations exceeds their own 15-day historical per-user baseline plus several standard deviations, excluding service principals/apps, which may indicate compromised credentials being abused to provision or harvest AI API keys for resale (token jacking).
Detects Microsoft Defender XDR UrlClickEvents where a clicked URL or extracted clicked domain matches known Coinbase Cartel-related URL, onion, messaging, or infrastructure indicators.
This rule identifies successful user sign-ins originating from IP addresses associated with residential or commercial VPN ASNs that have not been observed in the user's historical sign-in data (past 30 days). By comparing current activity against a baseline of known user locations, it flags potentially unauthorized access through masked connections.
This rule monitors for suspicious activity by detecting two distinct patterns: first, network connections initiated by Java processes located in tomcat/catalina directories on high-risk ports; second, suspicious administrative audit actions (Add admin, Modify credential, Export device list) within N-central where the initiating user context is missing.
Slack Anomalous Activity
Cortex XDR
This rule detects anomalous activity reported by Slack's internal anomaly detection system. This includes events such as impossible travel, new device access, suspicious IP changes, and other behavioral anomalies that Slack identifies. The rule extracts relevant user and context information for further investigation.
Detects the deletion of multiple items from an Office 365 mailbox that match common security-related email subject keywords. This behavior is indicative of an attacker attempting to cover their tracks by removing security alerts, MFA notifications, or password reset confirmations following a compromise.
This rule identifies successful user sign-ins originating from IP addresses associated with residential or commercial VPN ASNs that have not been observed in the user's historical sign-in data (past 30 days). By comparing current activity against a baseline of known user locations, it flags potentially unauthorized access through masked connections.
Detects the deletion of multiple items from an Office 365 mailbox that match common security-related email subject keywords. This behavior is indicative of an attacker attempting to cover their tracks by removing security alerts, MFA notifications, or password reset confirmations following a compromise.
Page 24 of 59