Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,235 detections
Filters
Last updated
All Time
Detection languages
734
214
105
78
51
Contributors
206
187
159
111
90
Categories
396
296
264
260
247
Platforms
492
314
281
204
110
Products / Services
379
234
152
109
106
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
1,235
CVEs
9
9
4
4
4
IDS Classtypes
11
6
4
2
1
IDS Protocols
10
5
3
This rule identifies 'improbable travel' scenarios where a user successfully logs in from two geographically distant locations within a short time frame, suggesting potential account compromise or abuse, possibly related to Remote Employment Fraud (REF). It calculates the speed of travel required between consecutive login locations and flags events where the speed and distance exceed predefined thresholds. It also checks if the login country differs from the user's known work country.
'The alert shows users that join a Zoom meeting from a time zone other than the one the meeting was created in.
You can also whitelist known good time zones in the tz_whitelist value using the tz database name format https://en.wikipedia.org/wiki/List_of_tz_database_time_zones'
You can also whitelist known good time zones in the tz_whitelist value using the tz database name format https://en.wikipedia.org/wiki/List_of_tz_database_time_zones'
'This hunting query identifies a user that add/invite a member to the organization for the first time. This technique can be leveraged by attackers to add stealth account access to the organization.'
Detects suspicious failed logins with different user accounts from a single source system
'This hunting query identifies users joining a meeting from a time zone that a user has not been observed from in the last 30 days.'
Device Logons from Unknown IP Addresses.
This query identifies device logons from IP addresses not associated with any machine in Defender ATP.
This query identifies device logons from IP addresses not associated with any machine in Defender ATP.
This query looks for events that are near in time to a detected event.
It shows how you could avoid typing exact timestamps, and replace it with a simple query to get the timestamp of your pivot event (e.g. a detected event).
This is useful when you have queries that you run often - e.g. as part of your regular investigation of an alert.
Original query: filter for network logon events right before some timestamp.
It shows how you could avoid typing exact timestamps, and replace it with a simple query to get the timestamp of your pivot event (e.g. a detected event).
This is useful when you have queries that you run often - e.g. as part of your regular investigation of an alert.
Original query: filter for network logon events right before some timestamp.
This query helps report on email access by administrators
This rule detects Okta authentication attempts originating from known VPN providers. Threat actors, particularly those involved in Remote Employment Fraud (REF), often use VPNs to mask their true physical location and evade detection. By identifying connections from a listing of commonly used VPN services, this rule aims to flag potentially suspicious access to Okta accounts. The rule extracts user information, client details, geographical context, and debug data to provide comprehensive insights into the VPN usage.
'This query will look for events where guest user was invited but has not accepted/redeemed invite for unusually longer period.
Any invites not redeemed for longer period of time can be misused and pose risk if suspiciously redeemed in other ways'
Any invites not redeemed for longer period of time can be misused and pose risk if suspiciously redeemed in other ways'
Monitor for creation of suspicious files in the /spools/driver/ folder. This is a broad-based search that will surface any creation or modification of files in the folder targeted by this exploit. False Positives for legitimate driver activity (when that activity should be present) in this folder are possible
'This hunting query identifies Accounts in GitHub that have granted access to another account which then grants access to yet another account that may be a sign of compromise.'
'Identifies when a new user is granted access and any subsequent audit related activity. This can help you identify rogue or malicious user behavior.'
This query looks for events that are near in time to a detected event.
It shows how you could avoid typing exact timestamps, and replace it with a simple query to get the timestamp of your pivot event (e.g. a detected event).
This is useful when you have queries that you run often - e.g. as part of your regular investigation of an alert.
Original query: filter for network logon events right before some timestamp.
It shows how you could avoid typing exact timestamps, and replace it with a simple query to get the timestamp of your pivot event (e.g. a detected event).
This is useful when you have queries that you run often - e.g. as part of your regular investigation of an alert.
Original query: filter for network logon events right before some timestamp.
Under some circumstances it is only allowed that users
from country X logon to devices from country X.
This query finds logon from users from other countries than X.
The query requires a property to identify the users from
country X. In this example a specific Email Address.
from country X logon to devices from country X.
This query finds logon from users from other countries than X.
The query requires a property to identify the users from
country X. In this example a specific Email Address.
The analytic detects cloud API calls executed by user roles that have not previously run these commands. It leverages the Change data model in Splunk to identify commands executed by users with the user_type of AssumedRole and a status of success. This activity is significant because new commands from different user roles can indicate potential malicious activity or unauthorized actions. If confirmed malicious, this behavior could lead to unauthorized access, data breaches, or other damaging outcomes by exploiting new or unmonitored commands within the cloud environment.
This rule detects unusually high video latency in Zoom sessions. Elevated latency, particularly above 300ms, can be an indicator of suspicious activity such as Remote Employment Fraud (REF), where threat actors might be operating from geographically distant locations or using compromised network infrastructure, leading to poor connection quality. The rule extracts and analyzes average and overall video latency from Zoom Quality of Service (QoS) logs for participants.
'Identifies when a recently created Group was added to a privileged built in domain local group or global group such as the Enterprise Admins, Cert Publishers or DnsAdmins. Be sure to verify this is an expected addition.
References: For AD SID mappings - https://docs.microsoft.com/windows/security/identity-protection/access-control/active-directory-security-groups.'
References: For AD SID mappings - https://docs.microsoft.com/windows/security/identity-protection/access-control/active-directory-security-groups.'
This rule detects user logins from multiple distinct states or countries within a one-hour window, leveraging GeoIP enrichment. It specifically looks for successful login events where a user logs in from at least two different states or at least one country, indicating potential 'impossible travel' or suspicious access patterns.
This rule detects successful user logins where the user's termination date is in the past, indicating a login from a terminated employee. This could signify unauthorized access or a failure in account deprovisioning processes. The rule requires a context data source that provides user termination dates, such as Azure AD Context or Workday.
This rule detects a sequence of events indicating the creation of a user account, a successful login by that user, and the subsequent deletion of the same user account within a 4-hour timeframe. This pattern is often indicative of an adversary creating temporary accounts for malicious activities, using them, and then removing them to cover their tracks or evade detection. The rule specifically targets Windows login events (event code 4624).
Page 55 of 59