Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,235 detections
Filters
Last updated
All Time
Detection languages
734
214
105
78
51
Contributors
206
187
159
111
90
Categories
396
296
264
260
247
Platforms
492
314
281
204
110
Products / Services
379
234
152
109
106
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,235
CVEs
9
9
4
4
4
IDS Classtypes
11
6
4
2
1
IDS Protocols
10
5
3
This rule detects the exploitation of CVE-2026-48558, a critical OIDC authentication bypass vulnerability in SimpleHelp. The detection logic correlates log events for 'Registering technician login' involving 'New Anon' sessions with subsequent configuration save requests occurring within 30 seconds. This pattern signifies the unauthorized creation of a privileged technician account by an unauthenticated attacker, bypassing standard identity verification.
This rule computes a composite risk score for user authentication events across multiple identity and network providers (Okta, Azure AD, VPNs, etc.). It flags suspicious patterns including impossible travel, credential stuffing indicators (multiple failures followed by success), new or unknown devices, and lateral movement attempts (concurrent access to both VPN and SSO services). Only users meeting a risk score threshold of 40 or higher with at least one successful authentication are reported.
Detects instances where a user account modifies sensitive payroll or banking information (e.g., direct deposit details) shortly after performing a sign-in from an unmanaged device or suspicious context. This behavior is indicative of an Adversary-in-the-Middle (AiTM) token replay attack targeting HR SaaS applications like Workday to perform financial fraud.
This rule detects potential 'impossible travel' scenarios within Azure AD sign-in logs. It identifies users who successfully sign in to Office 365 from two geographically distant IP addresses within a one-hour window, suggesting a potential compromise or an attempt to bypass security controls.
Detects sign-in events using the device code authentication flow (OAuth 2.0 device authorization grant) where the originating IP address is external to the organization's private network. This flow is often abused by attackers to bypass traditional MFA or interact with headless environments via common HTTP client libraries like Python requests, Go-http, or Axios.
Detects a single user account authenticating via RDP (Logon Type 10) to three or more distinct target hosts within a 15-minute window, which is often indicative of an adversary performing lateral movement using compromised credentials.
This rule detects successful authentication attempts directed at network devices from sources not explicitly marked as authorized management systems. It identifies users or systems that are not recognized service accounts authenticating against network infrastructure and flags activity that involves multiple unique destination targets as high risk.
This rule monitors for successful and failed user authentication events (Logon events 4624 and 4625) occurring on Saturdays or Sundays. It calculates a risk score based on the volume of authentication attempts and classifies the activity, providing visibility into potential off-hours credential misuse or insider threat scenarios.
This rule detects potential lateral movement activity by identifying a single user account attempting to log on to five or more distinct computers with at least ten logon attempts within a five-minute window. It specifically looks for successful logons (EventID 4624) with network, remote interactive, or remote desktop logon types (LogonType 3, 9, 10) and excludes machine accounts (TargetUserName not ending with '$'). This pattern can indicate an adversary attempting to spread across the network using compromised credentials.
Detects instances where a guest user or an external account (identified by the #EXT# suffix) performs an operation to add a new member to a Microsoft 365 Group. This behavior can be indicative of a guest account being compromised or misused to escalate privileges or gain unauthorized access by modifying group memberships.
This rule monitors authentication events across various SaaS platforms (Jira, Okta, Azure AD, Google Workspace, Auth0, OneLogin) to detect suspicious activity. It calculates a risk score based on indicators such as impossible travel, high volume of distinct source IPs or geographic locations, and anomalous user agent activity, flagging sessions that exceed a defined risk threshold.
This rule detects multiple (3 or more) logon attempts using the 'RunAs' feature (Event ID 4648) for accounts containing 'Admin' or 'SYSTEM' in their username within a one-hour window. This could indicate an adversary attempting to escalate privileges or execute code as a privileged user.
Detects successful SSH authentication to administrative accounts ('vmanage-admin' or 'admin') on Cisco Catalyst SD-WAN Manager (vManage) devices originating from IP addresses associated with the threat actor UAT-8616. This activity relates to exploits targeting CVE-2026-20127 and CVE-2026-20182 for unauthorized access via authentication bypass or certificate abuse.
This rule detects unauthorized exploitation attempts against Gitea environments vulnerable to CVE-2026-20896. When Gitea is configured with REVERSE_PROXY_TRUSTED_PROXIES set to permit all sources, an attacker can bypass authentication by injecting the 'X-WEBAUTH-USER: admin' header in HTTP requests. This allows the attacker to gain administrative privileges and perform unauthorized actions, such as creating new admin accounts or accessing restricted API endpoints.
This rule detects potential lateral movement or account compromise by identifying instances where a single user account successfully logs into four or more unique computer systems via Remote Desktop (Logon Type 10) within a 30-minute window.
Detects instances where a user successfully authenticates from a mobile device (Android or iPhone) that exhibits a geographic mismatch (geo_country vs registered_country), and subsequently performs a sensitive credential or MFA-related action (enrollment or reset) from a different device within one hour. This pattern is indicative of a potential session hijacking or credential compromise where an attacker attempts to establish persistence by enrolling their own MFA device.
Detects the use of legitimate SSH clients (ssh.exe, plink.exe) to initiate outbound network connections to internal IP ranges on port 22. This activity is consistent with Obsidian Sandstorm lateral movement tactics, where compromised credentials are used to establish SSH tunnels for internal network pivoting.
This rule detects interactive logons (LogonType 10) where a single account from the same domain logs into multiple distinct devices. This could indicate an attacker using compromised credentials to move laterally within the network or access multiple systems.
This rule detects when a single user principal name (UPN) attempts five or more sign-ins from the same IP address within a one-hour window, and each sign-in is flagged with a 'RiskDetail' other than 'none' but still results in a 'Success' status. This could indicate an attacker attempting to bypass security controls or an account compromise where the attacker is repeatedly trying to access the account from a consistent location, possibly with different credentials or methods, until successful.
Detects successful network or explicit credential logons (4624/4648) on Windows workstations where the username or workstation name contains keywords associated with Tenable Nessus scanning activity, indicating an authenticated vulnerability scan.
Detects Active Directory logons (Event IDs 4624, 4768, 4769) originating from the Fortinet SSL VPN IP pool. In the context of the FortiBleed credential-harvesting campaign, attackers utilize compromised Fortinet VPN credentials to immediately pivot into internal Active Directory environments. Because pure Sigma rules evaluate a single log source, this rule targets the Windows AD telemetry. To achieve the highest fidelity, this rule should be correlated in your SIEM with FortiGate SSL VPN tunnel-up events (e.g., Event Code 32130, 39424) originating from anomalous external IPs for the same principal within a short time window.
Page 27 of 59