Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,235 detections
Filters
Last updated
All Time
Detection languages
734
214
105
78
51
Contributors
206
187
159
111
90
Categories
396
296
264
260
247
Platforms
492
314
281
204
110
Products / Services
379
234
152
109
106
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,235
CVEs
9
9
4
4
4
IDS Classtypes
11
6
4
2
1
IDS Protocols
10
5
3
Detects M365 Copilot users accessing from multiple geographic locations to identify potential account compromise, credential sharing, or impossible travel patterns. The detection aggregates M365 Copilot Graph API events per user, calculating distinct cities and countries accessed, unique IP addresses, and the observation timeframe to compute a locations-per-day metric that measures geographic mobility. Users accessing Copilot from more than one city (cities_count > 1) are flagged and sorted by country and city diversity, surfacing accounts exhibiting anomalous geographic patterns that suggest compromised credentials being used from distributed locations or simultaneous access from impossible travel distances.
Detects M365 Copilot users exhibiting suspicious application usage patterns including multi-location access, abnormally high activity volumes, or access to multiple Copilot applications that may indicate account compromise or automated abuse. The detection aggregates M365 Copilot Graph API events per user, calculating metrics like distinct cities/countries accessed, unique IP addresses, number of different Copilot apps used, and average events per day over the observation period. Users are flagged when they access Copilot from multiple cities (cities_count > 1), generate excessive daily activity (events_per_day > 100), or use more than two different Copilot applications (app_count > 2), which are anomalous patterns suggesting credential compromise or bot-driven abuse.
Detects multiple Event ID 4648 logon attempts using the same target account but from different source accounts within a short time window. This behavior may indicate lateral movement, credential stuffing, or misuse of shared credentials. By correlating explicit credential use across users, it helps identify possible compromise or abuse of privileged accounts.
This detection identifies potentially suspicious usage of sqlcmd.exe, focusing on command patterns that may indicate data exfiltration, reconnaissance, or malicious database operations. The detection looks for both short-form (-X) and long-form (--flag) suspicious parameter combinations, which have been observed in APT campaigns targeting high-value organizations. For example, threat actors like CL-STA-0048 have been known to abuse sqlcmd.exe for data theft and exfiltration from compromised MSSQL servers. The detection monitors for suspicious authentication attempts, output redirection, and potentially malicious query patterns that could indicate unauthorized database access or data theft.
This rule identifies unusual activity from locations not previously observed for a user within a defined lookback period. It leverages Microsoft Entra ID (Azure AD) Behavior Analytics and SigninLogs to baseline legitimate user locations and filter out trusted devices/IPs. The rule flags unusual activity where the source IP location is new for the user and exceeds a configurable threshold of 'unusual' behavior indicators, while also excluding specified trusted countries.
Detects activity related to high-value (VIP) accounts, including:
- Azure AD account modifications
- Conditional Access policy changes affecting the user
- Role assignment changes
- Mailbox rule creation/modification
- Successful sign-ins
Useful for tracking executive account abuse, targeted attacks, or policy misconfigurations.
- Azure AD account modifications
- Conditional Access policy changes affecting the user
- Role assignment changes
- Mailbox rule creation/modification
- Successful sign-ins
Useful for tracking executive account abuse, targeted attacks, or policy misconfigurations.
This rule identifies statistically unusual or first-time Azure operations performed by a principal (user or service principal). It uses a risk-based alerting model, assigning a higher risk score to operations defined as high-risk. The rule establishes a baseline of normal activity over 30 days and alerts when current activity significantly deviates from this baseline or when an operation is observed for the very first time for a given identity.
This analytic detects the creation of privileged user accounts or the elevation of existing accounts to privilege level 15 (the highest administrative privilege level) on Cisco IOS devices. This activity is suspicious as it could indicate an attacker establishing backdoor access or persistence after gaining initial access, potentially through vulnerabilities like CVE-2018-0171. The rule specifically looks for commands related to setting user privilege to 15, modifying user passwords in conjunction with user table modifications, or explicit privilege updates to level 15.
Detects the reconfiguration of a virtual machine where a virtual disk (.vmdk) from a different, often critical, VM is attached. This is a key tactic used by threat actors like UNC3944 to perform offline credential theft by mounting a Domain Controller's disk to a staging VM to access the NTDS.dit file.
Detects scenarios where an attacker would attempt to enumerate hosts resources and execute a payload with a compromised account. Vulnerability scanners, enumeration software or tool like SharepHound/CrackMapexec may generate such behavior.
A potentially malicious user is creating a large amount of requests that overwhelms the IT team. This disrupts response processes and important tickets may be ignored or delayed. This detection detects users that create a large amount of tickets within a short time period.
Detects scenarios where an attacker attempts authenticate to the database using a disabled user accont
Detects scenarios where an attacker attempts to connect to a Windows host using the SSH protocol.
Detects scenarios where a user of a predefined set of group(s) logs on a target machine.
Detects if an attacker logs on using the serial console.
This rule detects GlobalProtect VPN login attempts originating from outside of Canada. This can help identify potential unauthorized access or policy violations where users are expected to connect from specific geographic regions.
This detection rule identifies suspicious logins by service accounts on devices they haven't accessed in the last 14 days. This behavior could indicate a compromised service account being used for lateral movement within the environment. Service accounts typically have a static set of devices they authenticate to, making deviations easier to spot compared to user accounts. However, some service accounts (e.g., MDI service accounts) are known to dynamically log into devices, which may require environment-specific fine-tuning to reduce false positives.
This rule identifies all service accounts in the environment by querying IdentityInfo logs. The goal is to audit the state of these accounts, helping to identify unused or stale service accounts (especially if disabled), ensure only necessary service accounts are active to reduce the attack surface, and support compliance and security posture assessments. This rule does not detect malicious activity but rather provides an inventory for security auditing.
Detects if multiple users logged into a single machine within the same day.
Detects when a non-approved application is granted high-risk permissions via consent in Azure AD.
This is a common method for attackers to achieve persistence and privilege escalation in Microsoft 365 environments.
This is a common method for attackers to achieve persistence and privilege escalation in Microsoft 365 environments.
This detection identifies interactive sign-ins from countries that a user has not accessed from in the past 30 days, based on successful logins. It highlights unusual geographic access patterns, such as remote work via VPNs, possible account compromise, or other travel-related anomalies.
Only interactive sign-ins are included to reduce noise from background service logins and token refreshes.
Recommended Extensions:
1. Trusted Applications Watchlist
Use a Sentinel watchlist (e.g., `TrustedAppsWatchlist`) to maintain known or expected applications (like SAP Cloud Identity Services, Microsoft Teams, Outlook Mobile) that frequently authenticate across multiple countries or devices. This helps suppress expected behavior and avoids alert fatigue.
2. Workation / Remote User Watchlist
Create a watchlist (e.g., `WorkationUsers`) with UPNs or user aliases of employees who are temporarily working abroad or from rotating locations. This allows legitimate, location-shifting activity to be filtered out of alerting, reducing false positives during travel seasons or flexible remote work arrangements.
Only interactive sign-ins are included to reduce noise from background service logins and token refreshes.
Recommended Extensions:
1. Trusted Applications Watchlist
Use a Sentinel watchlist (e.g., `TrustedAppsWatchlist`) to maintain known or expected applications (like SAP Cloud Identity Services, Microsoft Teams, Outlook Mobile) that frequently authenticate across multiple countries or devices. This helps suppress expected behavior and avoids alert fatigue.
2. Workation / Remote User Watchlist
Create a watchlist (e.g., `WorkationUsers`) with UPNs or user aliases of employees who are temporarily working abroad or from rotating locations. This allows legitimate, location-shifting activity to be filtered out of alerting, reducing false positives during travel seasons or flexible remote work arrangements.
Page 45 of 59