Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,235 detections
Filters
Last updated
All Time
Detection languages
734
214
105
78
51
Contributors
206
187
159
111
90
Categories
396
296
264
260
247
Platforms
492
314
281
204
110
Products / Services
379
234
152
109
106
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,235
CVEs
9
9
4
4
4
IDS Classtypes
11
6
4
2
1
IDS Protocols
10
5
3
This rule detects suspicious activity involving Azure AD device registration followed by a sign-in from the same user and IP address, particularly when the user agent strings are indicative of non-standard clients (e.g., 'node', 'axios', 'undici', 'node-fetch'). This pattern can indicate an adversary attempting to establish persistence or bypass multi-factor authentication by registering a new device and then immediately using it for access.
This rule detects Telnet login attempts using the default credential 'admin'. It specifically looks for the string 'admin' (case-insensitive) in Telnet traffic flowing to the server. A threshold of 5 attempts within 60 seconds from the same source IP triggers the alert, indicating a potential brute-force or credential stuffing attack against Telnet services.
This rule detects a potential RDP brute force attack by monitoring for a high number of TCP SYN packets directed to port 3389 (RDP) on the home network from a single source IP address within a short timeframe. Specifically, it triggers an alert if 10 or more SYN packets are observed from the same source within 60 seconds, indicating an attempt to establish multiple RDP connections, which is characteristic of a brute force attempt.
This rule detects potential GitHub token theft or abuse activity by identifying GitHub tokens that are used from an unusually high number of distinct IP addresses or for an unusually high number of uses within a one-hour window. Specifically, it looks for tokens with more than 5 uses and more than 2 distinct IP addresses in an hour. This behavior could indicate that a compromised token is being used by an attacker from multiple locations or in an automated fashion.
This rule detects anomalous mass device wipe or deletion activity in Microsoft Intune by comparing current activity against an actor's historical behavior. It identifies four patterns: first-time wipers with high volume, known actors statistically far above their norm (Z-score), thin-history actors exceeding their personal peak, and time-compressed bursts of wipes. The rule calculates a severity based on the volume and rate of wipes.
KQL Query
Detects successful Microsoft Entra ID sign-ins originating from geographically distant locations within a short time period where the calculated travel speed exceeds realistic human travel limits (>900 km/h). The detection correlates consecutive sign-ins for the same user and identifies potential account compromise by validating device identifiers and trust attributes. Alerts are generated when a user authenticates from different countries, exceeds configured distance and speed thresholds, and uses a different or unknown device.
This rule detects the use of Azure Managed Identity tokens originating from non-Azure IP spaces. This scenario is indicative of token theft, likely via the Instance Metadata Service (IMDS) endpoint (169.254.169.254), followed by an external replay of the stolen token from an attacker's infrastructure. Legitimate Managed Identity calls are expected to originate from Azure infrastructure IPs. The rule filters out legitimate Microsoft/Azure ASNs and RFC1918 private IP ranges to reduce false positives. It also categorizes the potential attack stage based on the operation name, including Key Vault access, Storage access, VM Code Execution, Privilege Escalation, and Directory Enumeration.
Sublime Threat Intelligence and Research (STIR) identified a phishing campaign using a recently published open-source Javascript virtual machine and obfuscation tool called KrakVM. The initial KrakVM-encoded HTML file arrives as an attachment in phishing emails. These emails are short, often not even including a body, with subjects and HTML attachment filenames suggesting the target has a new voicemail, a vendor credit, or unpaid invoices
KQL Query
Monitors Cisco Catalyst SD-WAN Controller logs for successful administrative logins. This may indicate exploitation of an authentication bypass vulnerability granting unauthorized admin access.
Tycoon2FA Known Infrastructure Detection
Cortex XDR
This rule detects suspicious sign-in attempts to Microsoft 365 accounts that originate from known Tycoon2FA infrastructure. It specifically looks for device code flow authentications from IP addresses and Autonomous System Numbers (ASNs) associated with Tycoon2FA, combined with indicators like unmanaged/non-compliant devices, specific user agent patterns (axios, node, undici), and particular application IDs, and an unbound sign-in token protection status. This combination of indicators suggests an attempt to hijack Microsoft 365 accounts using device code phishing.
Detects AiTM compromise where user click phishing URL, completed MFA, and signed in from a different IP within 10 minutes
https://thehackernews.com/2026/04/microsoft-confirms-active-exploitation.html
This hunt targets a documented Iranian MOIS-affiliated behaviour: re-executing DCSync
(MITRE ATT&CK T1003.006 — OS Credential Dumping: DCSync) after defenders reset
compromised account passwords, allowing actors to recollect current and historical NTLM
hashes and restore domain-wide access without repeating initial access stages.
(MITRE ATT&CK T1003.006 — OS Credential Dumping: DCSync) after defenders reset
compromised account passwords, allowing actors to recollect current and historical NTLM
hashes and restore domain-wide access without repeating initial access stages.
Detects changes to Microsoft.ManagedServices resources (registration definitions and assignments) where the affected resource group matches your known Sentinel resource group. In other words: someone touched your delegation.
This covers both expected changes (your own team onboarding or offboarding a customer) and unexpected ones (a customer admin making unauthorised modifications). The rule fires on both write and delete operations with a successful status.
This covers both expected changes (your own team onboarding or offboarding a customer) and unexpected ones (a customer admin making unauthorised modifications). The rule fires on both write and delete operations with a successful status.
Detects when the same SessionId is used to sign in from more than one location across interactive and non-interactive sign-ins.
This is a classic Adversary-in-the-Middle (AiTM) pattern. By proxying the authentication process in real-time, the FlowerStorm-like actors are bypassing standard MFA by intercepting the session token.
The query is a triple-threat hunting as it looks for the delivery (the domain), the access (the ASNs), and the persistence/evasion (the "LinkedIn" rule) all at once.
The query is a triple-threat hunting as it looks for the delivery (the domain), the access (the ASNs), and the persistence/evasion (the "LinkedIn" rule) all at once.
This rule detects anomalous mass device wipe or deletion activity in Microsoft Intune by comparing current activity against an actor's historical behavior. It identifies four patterns: first-time wipers with high volume, known actors statistically far above their norm (Z-score), thin-history actors exceeding their personal peak, and time-compressed bursts of wipes. The rule calculates a severity based on the volume and rate of wipes.
Detects potential NTLM credential leakage caused by SnippingTool.exe making outbound network connections (SMB / Web) that result in NTLM authentication, consistent with CVE‑2026‑33829 exploitation.
Detects suspicious modifications to Power Automate flow permissions, including sharing flows or changing role assignments. This could indicate a compromised account attempting to gain unauthorized access or persistence within the Power Platform environment.
Page 36 of 59