Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,088 detections
Filters
Last updated
All Time
Detection languages
619
191
113
86
47
Contributors
302
211
112
88
54
Categories
481
416
353
192
164
Platforms
726
348
216
136
57
Products / Services
518
292
197
124
88
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,088
CVEs
5
5
5
5
4
IDS Classtypes
3
2
1
1
IDS Protocols
3
Detects multiple AWS API calls (Publish, GetCallerIdentity, ListTopics) originating from a specific IP address (23.234.84.102) associated with a Zapier SNS sender. This rule monitors for potentially unauthorized or anomalous API usage patterns by identifying repeated, successful, and non-error events from a known source that may indicate misuse or compromise of an integration account.
Detects non-interactive sign-in events to common Microsoft 365 applications (OfficeHome, Outlook, My Sign-Ins, My Profile) where the User-Agent identifies as an automated HTTP client library (Axios or Python-requests). This behavior is often indicative of programmatic access via stolen session cookies or application tokens, commonly seen in adversary activity such as payroll-related business email compromise.
Detects anomalous sign-in activity where a single Microsoft 365 or Entra ID user account successfully authenticates from multiple distinct residential or mobile-carrier ASNs within a 24-hour window. This behavior is highly indicative of an adversary replaying stolen session tokens (AiTM) through rotating residential proxy networks to blend into legitimate user traffic and circumvent location-based or datacenter IP-based access restrictions.
Detects anomalous 'Bind' operations in Microsoft 365 Exchange Online audit logs where the user-agent string includes 'Firefox/131.0' and 'Client=REST' while using specific Microsoft Outlook ClientAppId and APIId parameters. This pattern has been observed in automated, cross-tenant mailbox exfiltration campaigns targeting sensitive payroll and financial documentation.
Detects the creation of an email inbox rule that includes both a concealment/deletion action and an external forwarding destination, occurring within 4 hours of a high-risk or compromised device-code authentication event. This pattern is indicative of account takeover where an attacker establishes persistence and exfiltration while hiding their activity.
Detects the creation of an email inbox rule that includes both a concealment/deletion action and an external forwarding destination, occurring within 4 hours of a high-risk or compromised device-code authentication event. This pattern is indicative of account takeover where an attacker establishes persistence and exfiltration while hiding their activity.
Detects the creation of an email inbox rule that includes both a concealment/deletion action and an external forwarding destination, occurring within 4 hours of a high-risk or compromised device-code authentication event. This pattern is indicative of account takeover where an attacker establishes persistence and exfiltration while hiding their activity.
Detects sign-in events where Multi-Factor Authentication (MFA) was satisfied using an External Authentication Method (EAM) that asserts specific possession or inherence claims (e.g., 'hwk' - hardware key). This behavior may indicate an adversary attempting to bypass or forge MFA responses via a rogue EAM provider.
This rule monitors authentication activity within Microsoft Entra ID (formerly Azure AD) involving the Device Code flow. This flow is often abused by attackers through phishing to obtain access tokens. The rule detects and lists occurrences of authentication attempts leveraging the device code grant, facilitating the investigation of potentially malicious token acquisition or replay attacks.
Detects GitHub push events where the actor pushing the changes does not match the commit author or committer identities, and the commit is not cryptographically signed. This pattern may indicate credential theft or account compromise where an adversary is pushing code using stolen credentials or impersonating authorized users.
Detects anomalous authentication patterns in Microsoft 365 logs where a valid session is utilized across multiple distinct devices within a short timeframe (under 5 minutes) without a corresponding multi-factor authentication (MFA) challenge. This behavior is indicative of a session token replay attack, where an adversary uses a stolen session cookie to bypass MFA and access cloud services.
Detects anomalous usage patterns for AI-platform API keys consistent with account takeover, specifically identifying concurrent multi-geographic access and the exercise of elevated administrative, write, or model-registry scopes within a short timeframe.
Detects instances where a user account modifies security information, registers a new MFA method, or resets a password shortly after a successful sign-in from a country not observed for that user within the previous 30 days. This pattern is indicative of potential account takeover where an adversary adds persistence or MFA bypass methods to a newly compromised account.
Detects a suspicious sequence where an account undergoes a help-desk-initiated password or credential reset, followed shortly (within 30 minutes) by the registration of a new multi-factor authentication (MFA) device for that same account. This pattern is characteristic of social engineering attacks, such as those used by UNC3944/Scattered Spider, where an adversary impersonates a user to gain initial access and subsequently establishes persistence by adding an MFA device they control.
Detects anomalous large-volume file download or export activity from cloud repositories (SharePoint, OneDrive, or Salesforce) occurring shortly after a help-desk-mediated credential or MFA reset for the same user. This behavior is indicative of account takeover, specifically vishing-to-exfiltration patterns used by threat actors.
Detects suspicious account management activities, such as password resets or MFA re-enrollment, performed by an operator on a high-privileged or administrator account outside of typical business hours (06:00-20:00). This behavior is often indicative of help-desk impersonation or credential takeover attempts targeting Identity Provider (IdP) administrative roles.
Detects instances where an account assigned a help-desk or support role performs an MFA, password, or credential reset on an account tagged as an executive or VIP. This behavior is indicative of social engineering and help-desk impersonation attacks commonly utilized by threat actors to perform rogue MFA takeovers.
This rule detects high-risk administrative operations in Azure Active Directory (such as role assignment, password resets, and account status changes) that occur within 3 hours of a user's sign-in. This pattern often indicates an account compromise followed by immediate privilege escalation or persistence establishment.
Detects anomalous sign-in patterns indicative of real-time MFA relay attacks, where a user principal authenticates successfully from multiple distinct IP addresses and geographical locations within a short time window (15 minutes), suggesting the active interception of credentials and MFA challenges by a Phishing-as-a-Service platform.
This rule detects a suspicious monetization pattern where a user account experiences a high-risk sign-in event, followed shortly (within 2 hours) by the creation or modification of inbox rules. This pattern is often indicative of account compromise, where an adversary configures mailbox rules (e.g., forwarding or redirection) to facilitate data exfiltration or financial fraud.
This rule detects a suspicious monetization pattern where a user account experiences a high-risk sign-in event, followed shortly (within 2 hours) by the creation or modification of inbox rules. This pattern is often indicative of account compromise, where an adversary configures mailbox rules (e.g., forwarding or redirection) to facilitate data exfiltration or financial fraud.
Page 18 of 52