Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,088 detections
Filters
Last updated
All Time
Detection languages
619
191
113
86
47
Contributors
302
211
112
88
54
Categories
481
416
353
192
164
Platforms
726
348
216
136
57
Products / Services
518
292
197
124
88
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,088
CVEs
5
5
5
5
4
IDS Classtypes
3
2
1
1
IDS Protocols
3
Detects potential help-desk impersonation or social engineering activity involving account credential or MFA method resets, followed shortly by a sign-in from an unknown device or geography. The rule excludes activity tied to established ticketing systems or standard automated password expiration processes.
Detects a multi-stage attack pattern involving a non-MFA login to a Citrix portal, followed by lateral movement, and concluding with ransomware deployment behaviors such as shadow copy deletion, recovery disablement, or the dropping of ransom notes associated with ALPHV/BlackCat ransomware.
Detects a multi-stage attack pattern involving a non-MFA login to a Citrix portal, followed by lateral movement, and concluding with ransomware deployment behaviors such as shadow copy deletion, recovery disablement, or the dropping of ransom notes associated with ALPHV/BlackCat ransomware.
Detects a multi-stage attack pattern involving a non-MFA login to a Citrix portal, followed by lateral movement, and concluding with ransomware deployment behaviors such as shadow copy deletion, recovery disablement, or the dropping of ransom notes associated with ALPHV/BlackCat ransomware.
Detects a multi-stage attack pattern involving a non-MFA login to a Citrix portal, followed by lateral movement, and concluding with ransomware deployment behaviors such as shadow copy deletion, recovery disablement, or the dropping of ransom notes associated with ALPHV/BlackCat ransomware.
Detects potential lateral movement or compromised account use where a single user identity authenticates to multiple distinct cloud or administrative resources within a short time window (15 minutes). The rule uses a threshold of six or more unique applications or resources to identify anomalous patterns typical of reconnaissance or mass resource access often associated with stolen credentials. Administrative, service, and automation-related accounts are excluded to minimize noise.
Detects potential lateral movement or compromised account use where a single user identity authenticates to multiple distinct cloud or administrative resources within a short time window (15 minutes). The rule uses a threshold of six or more unique applications or resources to identify anomalous patterns typical of reconnaissance or mass resource access often associated with stolen credentials. Administrative, service, and automation-related accounts are excluded to minimize noise.
Detects potential lateral movement or compromised account use where a single user identity authenticates to multiple distinct cloud or administrative resources within a short time window (15 minutes). The rule uses a threshold of six or more unique applications or resources to identify anomalous patterns typical of reconnaissance or mass resource access often associated with stolen credentials. Administrative, service, and automation-related accounts are excluded to minimize noise.
Detects potential lateral movement or compromised account use where a single user identity authenticates to multiple distinct cloud or administrative resources within a short time window (15 minutes). The rule uses a threshold of six or more unique applications or resources to identify anomalous patterns typical of reconnaissance or mass resource access often associated with stolen credentials. Administrative, service, and automation-related accounts are excluded to minimize noise.
Detects cloud service principals identified as AI agents or assistants performing sensitive API operations such as IAM policy modifications or storage configuration changes. This pattern may indicate that an AI service account has been compromised or misused to perform reconnaissance, privilege escalation, or persistence, exceeding its intended scope of operation.
This rule monitors for unauthorized changes to GitHub Actions workflows that involve release or publishing processes, specifically looking for indicators of supply chain compromise like the introduction of 'id-token: write' or changes to publish scripts. It correlates these modifications with subsequent workflow executions and npm registry publish events attributed to the same actor to identify potential account takeover and malicious package distribution.
This rule monitors for suspicious activity related to AI service accounts and API keys. It detects potential account or key compromise by identifying impossible travel sign-ins coupled with AI API usage, simultaneous usage of a single API key from multiple disjoint network locations, and sudden, high-volume activity from previously dormant service account API keys.
Detects instances where a user successfully authenticates via the OAuth Device Code flow using an unmanaged or non-compliant device, followed closely by high-privileged Azure/Graph API administrative actions within a short timeframe. This behavior is indicative of a device-code phishing attack aimed at bypassing MFA controls, including FIDO2/passkeys, by compromising an active session.
This rule detects potentially malicious activity involving Service Principals in Microsoft Entra ID. It identifies two scenarios: 1) Impossible travel, where a service principal authenticates from two distinct geographic locations within a 60-minute window, and 2) Administrative modifications to a service principal's credentials or authentication methods (e.g., adding secrets, certificates, or MFA methods), which may indicate persistence or credential abuse.
Detects a suspicious sequence of events: an anomalous login (new device, new location, or high-risk sign-in) followed by the assumption of a highly privileged role (via AssumeRole, PIM, or role elevation) and subsequent sensitive administrative actions (e.g., creating access keys, modifying IAM policies, or disabling security auditing). This pattern is indicative of cloud identity compromise and privilege escalation, commonly seen in attacks involving groups like Scattered Spider.
Detects successful VPN logins that bypass multi-factor authentication (MFA) and originate from unusual ASN/IP addresses or occur during atypical hours. This behavior is indicative of potential unauthorized access using compromised credentials, consistent with threat actor patterns that exploit environments lacking mandatory MFA enforcement.
Detects high-risk administrative actions in Entra ID, such as role assignments, user creation, or password resets, occurring shortly after a user authenticates using the device code flow. This pattern is indicative of a post-compromise takeover where an adversary utilizes a stolen or coerced device code session to escalate privileges.
Detects the creation of an email inbox rule that includes both a concealment/deletion action and an external forwarding destination, occurring within 4 hours of a high-risk or compromised device-code authentication event. This pattern is indicative of account takeover where an attacker establishes persistence and exfiltration while hiding their activity.
Detects anomalous large-scale data export operations in Google BigQuery (via jobs.insert or jobs.query) performed by identities (service accounts, API keys) not previously observed in the environment. This activity is indicative of credential abuse where stolen third-party analytics or monitoring service tokens are utilized for illicit data exfiltration, a behavior consistent with tactics employed by threat actors such as ShinyHunters.
Detects high-volume, anomalous data read operations performed by the Gainsight integration service account within Salesforce, which may indicate unauthorized use of the integration token for data exfiltration.
Detects a pattern associated with ShinyHunters/UNC6040, where a user authorizes a new or rarely-used OAuth connected application shortly after performing a help-desk initiated password reset or MFA re-enrollment, originating from a different geographic location.
Page 11 of 52