Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,088 detections
Filters
Last updated
All Time
Detection languages
619
191
113
86
47
Contributors
302
211
112
88
54
Categories
481
416
353
192
164
Platforms
726
348
216
136
57
Products / Services
518
292
197
124
88
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,088
CVEs
5
5
5
5
4
IDS Classtypes
3
2
1
1
IDS Protocols
3
Detects anomalous certificate-based authentication attempts to Jasmine network services characterized by rapid, impossible-travel scenarios or geo-inconsistent session patterns. This behavior is indicative of a stolen certificate being reused from a different geographic location or network, bypassing standard authentication patterns.
Detects anomalous certificate-based authentication attempts to Jasmine network services characterized by rapid, impossible-travel scenarios or geo-inconsistent session patterns. This behavior is indicative of a stolen certificate being reused from a different geographic location or network, bypassing standard authentication patterns.
Detects successful authentication events using known default or low-privileged Cisco Firepower Management Center (FMC) service accounts, or IDS alerts (Snort SID 66883) associated with credential abuse activity potentially related to CVE-2026-20316.
Detects successful authentication events using known default or low-privileged Cisco Firepower Management Center (FMC) service accounts, or IDS alerts (Snort SID 66883) associated with credential abuse activity potentially related to CVE-2026-20316.
Detects anomalous sign-in activity originating from the Microsoft Authentication Broker or utilizing the OAuth device code flow, which are frequently abused by adversaries to perform OAuth phishing and obtain access tokens.
This rule detects successful device-code authorization logins to Azure AD that originate from a country or region not previously associated with the user. It evaluates the user's historical sign-in locations to establish a baseline and flags deviations, which may indicate account compromise via device-code phishing or MFA bypass attempts.
This rule monitors for security-related account activities in Azure AD, specifically tracking self-service password resets, admin-led password resets, and changes to user security information. It aggregates these events by user to identify potential account manipulation, unauthorized password changes, or MFA registration abuse.
This rule identifies potentially compromised Entra ID accounts by correlating multiple suspicious behaviors within a 14-day window. It aggregates four specific indicators: successful authentication following repeated MFA failures, impossible travel (sign-ins from multiple countries within a short timeframe), unusual hour logons (00:00-05:00), and sign-ins flagged with medium/high risk or reported as compromised. The rule triggers when an account exhibits two or more of these distinct anomalous behaviors.
Detects multiple successful GitLab authentication events from a specific source IP that contain parameters indicating an attempt to skip or bypass two-factor authentication, consistent with known GitLab 2FA bypass vulnerabilities.
This rule detects user authentication events that deviate significantly from a 14-day historical baseline of known devices, operating systems, browsers, and network locations (ASN). It flags logins where at least two out of four key metadata signals (DeviceId, OS, Browser, ASN) have changed compared to the user's historical pattern, specifically targeting successful authentications that did not trigger a fresh multi-factor authentication (MFA) challenge, potentially indicating token theft or unauthorized session reuse.
Detects Microsoft 365 sign-in events where a session token is reused without a fresh MFA challenge, originating from known residential proxy service providers. This behavior is indicative of threat actors using stolen session tokens (Session Replay) to bypass MFA protections.
Detects multiple successful GitLab authentication events from a specific source IP that contain parameters indicating an attempt to skip or bypass two-factor authentication, consistent with known GitLab 2FA bypass vulnerabilities.
Detects a GitLab personal access token used from multiple distinct source IPs or from IPs associated with the leaked gitlab-triage token, inconsistent with expected CI runner infrastructure.
Identifies service principals or managed identities assigned high-privilege roles or permissions that exhibit anomalous access patterns by interacting with cloud resources not seen in the established historical baseline.
Detects the creation of new AWS access keys or login profiles for a target identity immediately following the deletion or modification of a credential for the same identity, where the actors performing the two actions are different. This pattern indicates an adversary creating persistent access after a security incident responder or automated system has revoked a previously compromised credential.
Detects Microsoft 365 sign-in events where a session token is reused without a fresh MFA challenge, originating from known residential proxy service providers. This behavior is indicative of threat actors using stolen session tokens (Session Replay) to bypass MFA protections.
This rule detects authentication events occurring from devices that have not been seen in the user's history over the previous 14 days and involve non-compliant, unmanaged, or non-Azure AD joined devices. The detection specifically looks for sign-ins that do not utilize interactive credential prompts (token-based), which may indicate an adversary using a stolen session token (e.g., a Primary Refresh Token) from an unrecognized or insecure source.
Detects multiple successful GitLab authentication events from a specific source IP that contain parameters indicating an attempt to skip or bypass two-factor authentication, consistent with known GitLab 2FA bypass vulnerabilities.
Detects successful authentication events using known default or low-privileged Cisco Firepower Management Center (FMC) service accounts, or IDS alerts (Snort SID 66883) associated with credential abuse activity potentially related to CVE-2026-20316.
This rule detects user authentication events that deviate significantly from a 14-day historical baseline of known devices, operating systems, browsers, and network locations (ASN). It flags logins where at least two out of four key metadata signals (DeviceId, OS, Browser, ASN) have changed compared to the user's historical pattern, specifically targeting successful authentications that did not trigger a fresh multi-factor authentication (MFA) challenge, potentially indicating token theft or unauthorized session reuse.
Detects Microsoft 365 sign-in events where a session token is reused without a fresh MFA challenge, originating from known residential proxy service providers. This behavior is indicative of threat actors using stolen session tokens (Session Replay) to bypass MFA protections.
Page 24 of 52