Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,235 detections
Filters
Last updated
All Time
Detection languages
734
214
105
78
51
Contributors
206
187
159
111
90
Categories
396
296
264
260
247
Platforms
492
314
281
204
110
Products / Services
379
234
152
109
106
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,235
CVEs
9
9
4
4
4
IDS Classtypes
11
6
4
2
1
IDS Protocols
10
5
3
Detects instances where a guest user or an external account (identified by the #EXT# suffix) performs an operation to add a new member to a Microsoft 365 Group. This behavior can be indicative of a guest account being compromised or misused to escalate privileges or gain unauthorized access by modifying group memberships.
Detects the registration of a new authentication method (phone, authenticator app, passkey, or security key) in Azure Active Directory after a session exhibits unusual location or token behavior, indicated by a high or medium risk level, anonymous proxy usage, or unfamiliar features.
Detects device registration or join activity by an account shortly after a risky sign-in or policy-lure interaction, indicating potential compromise of the account.
Detects when a single session identifier is used to access multiple cloud applications, where at least three distinct applications are accessed within an hour, and these applications were not part of the original interactive sign-in. This behavior can indicate a token replay attack, specifically as described in the Elastic Security Labs research on Tycoon 2FA AiTM detection engineering.
Detects modifications to the 'LimitBlankPasswordUse' registry setting to '0'. This modification enables remote network logons for accounts with blank passwords, a technique abused by threat actors like DragonForce for persistence.
Detects Python executing a web-administration exploit with valid credential input and explicit two-factor bypass logic, matching the AI-assisted semantic trust-flaw exploitation described by GTIG.
Detects workstations establishing multiple connections to non-standard, internal management ports (SSH, Telnet, SNMP). This behavior is often associated with lateral movement or unauthorized network scanning using tools that leverage management protocols.
This rule detects successful OAuth logins originating from IP addresses identified as residential proxies. This behavior can indicate an adversary attempting to bypass geo-blocking or other IP-based restrictions, potentially using stolen credentials (Valid Accounts) or after a successful phishing campaign (Spearphishing Link) to gain initial access or maintain persistence.
Detects HTTP POST requests to MyBB Admin Control Panel modules restricted to superadministrators (e.g., user management, group configuration, settings) initiated by non-privileged accounts. This activity is consistent with privilege escalation exploitation patterns where internal authorization checks might be bypassed.
Identifies logins from geographically distant locations occurring faster than physically possible, highlighting proxy infrastructure. This KQL query analyzes Google Workspace login success events, grouping them by account and a 10-minute time window. It then filters for instances where an account has successfully logged in from two or more distinct locations within that short timeframe, indicating potential impossible travel.
Detects Key Vault access policy or role changes that grant secret-reading capabilities.
Detects administrative mail, forwarding, or content compliance rule changes performed from an IP address classified as an anonymous proxy. This behavior is often associated with threat actors like UNC6508, who use obfuscation networks and proxies to access administrator accounts and exfiltrate data.
Detects access to App Service Kudu deployment or command endpoints by an identity not normally associated with deployment operations.
Detects access to Azure App Service Kudu deployment or command endpoints by an identity not normally associated with deployment operations. This could indicate an attacker using compromised credentials to interact with the application's underlying infrastructure.
This rule detects an unusually high volume of operations related to GitHub Enterprise repositories, such as adding users, creating teams, pushing to repositories, or changing permissions, within a short timeframe. This could indicate a compromised account or automated malicious activity targeting source code repositories.
Detects an administrative forwarding, redirect, BCC, or content compliance rule change when Defender for Cloud Apps identifies attributes that are uncommon for the account. UNC6508 replayed harvested credentials to access an administrator account before creating its covert exfiltration rule. The anomaly requirement increases confidence while preserving coverage for infrastructure that is not recognised as a proxy.
Detects Microsoft Authentication Broker (MAB) accessing enterprise applications outside of the expected first-party subset. This could indicate an attempt to bypass multi-factor authentication (MFA) or gain unauthorized access to resources.
Detects sign-ins to Entra ID using Axios, Undici, or Node-Fetch user agents, which are fingerprints of Tycoon 2FA attacks. This rule helps identify potential multi-factor authentication bypass attempts.
Detects inbound emails containing links to the Upflow.io billing portal that include an embedded token parameter. This technique is actively abused by attackers to grant unauthorized viewing access to fraudulent invoices without requiring login credentials.
Detects accounts with first-time RDP logins to multiple systems (3 or more) within a short time window (30 minutes or less). This behavior is indicative of lateral movement, often seen after initial access via stolen VPN credentials, as observed with the Akira ransomware group.
Identifies login attempts from RedVDS infrastructure IPs deliberately utilizing legacy authentication protocols (IMAP/POP3) to bypass Modern Authentication Conditional Access policies.
Page 33 of 59