Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,235 detections
Filters
Last updated
All Time
Detection languages
734
214
105
78
51
Contributors
206
187
159
111
90
Categories
396
296
264
260
247
Platforms
492
314
281
204
110
Products / Services
379
234
152
109
106
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,235
CVEs
9
9
4
4
4
IDS Classtypes
11
6
4
2
1
IDS Protocols
10
5
3
Detects anomalous post-authentication activity in n8n where the authentication issuer for an account changes from historical norms. This identifies potential account takeover (ATO) scenarios where a hijacked token or cross-issuer session is used to perform lateral movement, workflow manipulation, credential access, or data exfiltration, consistent with behaviors associated with vulnerabilities like CVE-2026-59208.
Detects the unauthorized PyPI release of mrmustard 0.7.4 uploaded during the known malicious publish window following the maintainer account compromise.
Detects a forged WordPress customize_changeset post that triggers wp_set_current_user with a mismatched or unauthenticated user context, the privilege-escalation bridge used in the wp2shell admin-takeover chain.
Detects a forged WordPress customize_changeset post that triggers wp_set_current_user with a mismatched or unauthenticated user context, the privilege-escalation bridge used in the wp2shell admin-takeover chain.
Detects 'docker login' commands targeting an Azure Container Registry (.azurecr.io) that explicitly include username and password flags in the command line string. This behavior may indicate credential usage for registry authentication.
Detects suspicious use of the OAuth 2.0 device code authentication flow. The rule identifies potential token harvesting and phishing attempts by flagging device code sign-ins that originate from unusual user agents, unknown IP addresses or ASNs, unrecognized applications, or for users who have not previously utilized device code authentication. Legitimate, first-party applications like Azure CLI and Azure PowerShell are explicitly excluded to minimize noise.
Detects Microsoft Entra ID authentication failures (AADSTS700016) where a client ID is provided that does not exist in the directory. This error often indicates attackers attempting to spoof legitimate OAuth client applications to perform reconnaissance or bypass conditional access policies.
Detects the use of spoofed Exchange Online Application IDs in Azure sign-in logs. Attackers use these specific spoofed AppID patterns to bypass controls during Resource Owner Password Credential (ROPC) authentication, often for user enumeration purposes.
This rule monitors for successful Azure Container Registry task write, run, or action operations that involve references to identity configurations, Azure KeyVault (vault.azure.net), or ACR task YAML files. These keywords are often associated with the configuration of managed identities or secret retrieval within the build process, which may indicate unauthorized task creation or manipulation to escalate privileges or exfiltrate secrets.
Detects high-frequency failed logon attempts (>= 6) against accounts with administrative naming conventions within a 3-minute window. The rule specifically flags activity targeting multiple distinct destination hosts, which is a strong indicator of lateral movement or account brute-forcing/spraying attempts across an enterprise network.
Detects Microsoft Entra ID sign-in events where the AppId (OAuth client_id) is a
syntactically valid UUIDv4 but no corresponding AppDisplayName is populated,
indicating the client ID does not correspond to any registered enterprise
application in the tenant. This pattern is consistent with randomly generated,
valid-format spoofed client IDs used in ROPC-based username/password
enumeration.
syntactically valid UUIDv4 but no corresponding AppDisplayName is populated,
indicating the client ID does not correspond to any registered enterprise
application in the tenant. This pattern is consistent with randomly generated,
valid-format spoofed client IDs used in ROPC-based username/password
enumeration.
Detects successful non-interactive sign-ins to Azure CLI using the Resource Owner Password Credentials (ROPC) flow where Conditional Access policies failed to enforce multi-factor authentication (MFA). This typically indicates misconfigured Conditional Access policies, such as exclusions for non-interactive authentication methods or service accounts, which could be exploited by adversaries to bypass MFA.
Detects a high-volume burst of ROPC (Resource Owner Password Credentials) sign-in attempts using a spoofed/unregistered OAuth client ID, identified by a populated Application ID field paired with a blank Application Name field, targeting a single account within a short window. This enumeration pattern has been observed to correlate with mass account lockouts across an organization.
Detects Entra ID users with active medium-to-high identity risk events who perform Microsoft Copilot actions in cloud applications while simultaneously exhibiting impossible travel indicators — successful sign-ins from multiple geographic locations using unmanaged (non-registered) devices within a one-hour window. This triple-signal correlation (identity risk + impossible travel on unmanaged device + Copilot usage) is a strong indicator of account compromise where an adversary has taken over a legitimate identity and is leveraging AI-powered tools to accelerate reconnaissance, data access, or exfiltration against Microsoft 365 resources.
This rule detects potential brute force authentication attempts via LDAP occurring shortly after a specific DLL (ending in 'ode.dll') is loaded on a system. This behavior may indicate an adversary is using a malicious or secondary module to facilitate credential brute forcing or unauthorized authentication attempts.
Detects unauthorized access attempts to MinIO object storage using the default 'minioadmin' credentials. The rule specifically flags attempts to access sensitive files like 'terraform-state' or 'credentials.json' via HTTP GET requests.
This rule detects potential lateral movement or account compromise by identifying instances where a single user account successfully logs into four or more unique computer systems via Remote Desktop (Logon Type 10) within a 30-minute window.
Detects a single authenticated user account or client performing a high volume of requests to sequential object IDs on the same API path within a short window. This pattern is characteristic of Broken Object Level Authorization (BOLA) or Insecure Direct Object Reference (IDOR) exploitation, where an attacker attempts to gain unauthorized access to data records that do not belong to them by iterating through predictable numeric identifiers.
Detects potentially malicious activity within Microsoft 365 involving the creation of inbox rules for message forwarding/redirection, modifications to mailbox forwarding configurations, or mass outbound email sending. These actions are common indicators of persistent access, email exfiltration, or automated reconnaissance after account compromise.
This rule detects potential 'impossible travel' scenarios within Azure AD sign-in logs. It identifies users who successfully sign in to Office 365 from two geographically distant IP addresses within a one-hour window, suggesting a potential compromise or an attempt to bypass security controls.
Detects anomalous process execution chains originating from the Gitea server or Gitea act-runner processes following the exploitation of CVE-2026-20896. This vulnerability allows an attacker to bypass authentication using a forged X-WEBAUTH-USER header when REVERSE_PROXY_TRUSTED_PROXIES is insecurely configured. The rule identifies subsequent command-line activity such as spawning shells, using network utilities (wget, curl, netcat), or executing Gitea administrative commands by unauthorized child processes.
Page 26 of 59