Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,235 detections
Filters
Last updated
All Time
Detection languages
734
214
105
78
51
Contributors
206
187
159
111
90
Categories
396
296
264
260
247
Platforms
492
314
281
204
110
Products / Services
379
234
152
109
106
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
1,235
CVEs
9
9
4
4
4
IDS Classtypes
11
6
4
2
1
IDS Protocols
10
5
3
Detects user logins for the same user from different cities within 24 hours.
Detects the creation of a specific file path commonly used in Proof-of-Concept (PoC) exploits for the Print Spooler vulnerability CVE-2021-1675, also known as PrintNightmare. This file path is typically created when an attacker successfully exploits the vulnerability to achieve remote code execution or privilege escalation.
This rule detects the use of the OAuth 2.0 device code authentication flow within an environment. While legitimate for input-constrained devices, its presence in other scenarios warrants investigation as it could indicate a misconfigured application or malicious activity. The rule specifically looks for "Device Code" in Azure sign-in logs.
This rule identifies sign-in attempts from geographically distant locations within a short timeframe, which is indicative of an "impossible travel" scenario. It also considers if one of these locations is atypical for the user based on their past behavior. This pattern often suggests that an attacker has compromised user credentials and is attempting to access the account from a new, unusual location, potentially using a VPN or proxy service to mask their true origin.
This rule identifies 'impossible travel' events where a user's activities originate from geographically distant locations within a time period that is too short for physical travel between those locations. This often indicates a compromised account being accessed from multiple locations simultaneously or in rapid succession, potentially using different IP addresses or devices.
This rule detects the use of the Resource Owner Password Credentials (ROPC) authentication flow. ROPC is generally discouraged because it requires applications to directly handle user credentials, increasing the risk of credential compromise. While it can be used for automated testing or legacy applications, its presence in other contexts may indicate a security weakness or an attempt to bypass more secure authentication mechanisms.
Detects sign-in attempts with properties (e.g., device, location, browser) that are unusual or unfamiliar compared to a user's past sign-in history. This rule leverages Azure AD Identity Protection's risk detection capabilities to identify anomalous sign-ins.
Detects the execution of the 'jamf' binary with specific commands that could be used by attackers for privilege escalation, bypassing security controls, or modifying system configurations. This includes creating user accounts, managing the JAMF framework, removing MDM profiles, resetting passwords, and setting computer names.
Detects BGP failures which may be indicative of brute force attacks to manipulate routing.
This rule identifies user sign-ins originating from anonymous IP addresses, which may indicate the use of VPNs, Tor, or other anonymization services. Such activity can be a sign of an adversary attempting to mask their true location or identity during an access attempt.
This rule detects user activity that Azure AD Identity Protection has flagged as 'investigationsThreatIntelligence'. This risk event type indicates that a sign-in or user behavior is unusual for the user or consistent with known attack patterns, often leveraging threat intelligence feeds to identify suspicious activity. It suggests potential compromise of user accounts or malicious sign-in attempts.
This rule detects sign-in attempts originating from a country that is considered new or infrequent for the user based on their past activity locations. This behavior can indicate a compromised account being used by an attacker from an unusual geographic location.
This rule detects the use of weak or commonly abused passwords directly within command-line interfaces. Threat actors often use this method to create new user accounts with easily guessable or known compromised passwords. The rule specifically looks for a predefined list of weak passwords appearing in the command line of a process creation event.
This rule detects anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser. This indicates a potential compromise of user credentials or an attempt to bypass authentication mechanisms.
This rule identifies user activity originating from an IP address that has been flagged as an anonymous proxy. Such activity can indicate an attempt to obscure the true origin of a sign-in, which is often associated with malicious intent like credential stuffing, account takeover, or bypassing geographical restrictions.
Detects the creation or modification of registry keys related to printer drivers that contain specific strings associated with Mimikatz or the PrinterNightmare vulnerability (CVE-2021-1675, CVE-2021-34527). The rule looks for 'QMS 810' or 'mimikatz' in printer driver paths, or a combination of 'legitprinter' and printer environment paths, or specific strings like 'Gentil Kiwi', 'mimikatz printer', or 'Kiwi Legit Printer' in registry objects related to printing.
This rule detects the execution of 'net.exe' or 'net1.exe' with a password provided directly in the command line. This is a security risk as it exposes credentials and can be used for lateral movement, persistence, or privilege escalation. The rule specifically looks for the 'use' keyword, a colon followed by an asterisk and a backslash (indicating a password field), and '/USER:* *' to identify password usage in the command line arguments.
Page 59 of 59