Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,088 detections
Filters
Last updated
All Time
Detection languages
619
191
113
86
47
Contributors
302
211
112
88
54
Categories
481
416
353
192
164
Platforms
726
348
216
136
57
Products / Services
518
292
197
124
88
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,088
CVEs
5
5
5
5
4
IDS Classtypes
3
2
1
1
IDS Protocols
3
Detects anomalous login activity in Google Workspace characterized by a high volume of login failures (5 or more) originating from a single IP address. The rule identifies potential brute force or credential stuffing campaigns and flags instances where a successful login occurs following a burst of failure events from the same source.
Detects a single device requesting Entra ID access/refresh tokens on behalf of multiple distinct users in a short window, indicative of Primary Refresh Token (PRT) theft used to impersonate other users, as CISA's red team did against an application owner.
Detects a suspicious sequence of interactive sign-ins to Microsoft management and profile-related applications from unmanaged devices occurring within a tight 15-minute window. This behavior is indicative of post-compromise activity, potentially associated with activity clusters such as UNC6671, where an attacker interacts with account settings shortly after compromising a session.
This rule detects user authentication events that deviate significantly from a 14-day historical baseline of known devices, operating systems, browsers, and network locations (ASN). It flags logins where at least two out of four key metadata signals (DeviceId, OS, Browser, ASN) have changed compared to the user's historical pattern, specifically targeting successful authentications that did not trigger a fresh multi-factor authentication (MFA) challenge, potentially indicating token theft or unauthorized session reuse.
Detects instances where a user performs an interactive login followed by a non-interactive login within a 1-hour window, where the source IP address and geographical location of both sessions differ. This behavior is indicative of potential session hijacking or token theft where an attacker is using stolen session artifacts from a different location.
Detects non-interactive sign-in events involving OIDC or external authentication tokens shortly after a known Coder registry compromise. The rule flags high-risk or at-risk single-factor authentication sessions, which may indicate the replay of stolen tokens harvested during the compromise window.
This rule identifies potentially compromised Entra ID accounts by correlating multiple suspicious behaviors within a 14-day window. It aggregates four specific indicators: successful authentication following repeated MFA failures, impossible travel (sign-ins from multiple countries within a short timeframe), unusual hour logons (00:00-05:00), and sign-ins flagged with medium/high risk or reported as compromised. The rule triggers when an account exhibits two or more of these distinct anomalous behaviors.
This rule identifies potentially compromised Entra ID accounts by correlating multiple suspicious behaviors within a 14-day window. It aggregates four specific indicators: successful authentication following repeated MFA failures, impossible travel (sign-ins from multiple countries within a short timeframe), unusual hour logons (00:00-05:00), and sign-ins flagged with medium/high risk or reported as compromised. The rule triggers when an account exhibits two or more of these distinct anomalous behaviors.
Detects successful authentication events to the Okta Admin Console originating from known proxy services, anonymization networks, or suspicious infrastructure. This activity may indicate an attempt to use compromised administrative credentials to gain unauthorized access to the Identity Provider (IdP) for downstream reconnaissance or persistence.
Detects successful device code authentication flows from users who have not utilized this authentication method within the past 14 days. This rule monitors Entra ID (Azure AD) sign-in logs and non-interactive logs, enriching results with Intune device compliance data and authentication protocol details to assist in identifying anomalous access patterns that may indicate credential abuse or device-code phishing.
This rule detects scenarios where a user account registers or adds a new device and subsequently performs a sign-in session within one hour that is either marked as high/medium risk or occurs via sensitive applications like the Azure Portal or Microsoft Graph. This pattern often indicates account compromise, where an attacker has registered a rogue device to gain persistent access or perform administrative tasks.
Detects anomalous human-like interactive browsing behavior from the 'qa@snowflake.net' Jira service account. This account is typically restricted to automated ticket creation via GitHub Actions; broad exploration of Jira boards, timelines, and reports indicates a potential account compromise where an API token has been exfiltrated and repurposed for reconnaissance.
Identifies Microsoft Entra Privileged Identity Management (PIM) role activations occurring outside normal business hours or during weekends.
The query reviews role management audit events, converts timestamps to a defined local timezone, and highlights successful privileged role activations that occur outside business hours and on weekends.
This detection helps security teams identify unusual, privileged access activity that may warrant additional investigation, especially for highly privileged roles.
The query reviews role management audit events, converts timestamps to a defined local timezone, and highlights successful privileged role activations that occur outside business hours and on weekends.
This detection helps security teams identify unusual, privileged access activity that may warrant additional investigation, especially for highly privileged roles.
This rule monitors Microsoft 365 SharePoint and OneDrive audit logs for the 'SharingSet' operation to detect when internal items are shared with external guests. It classifies sharing events based on permission level and site type (Personal vs. SharePoint site) to highlight potentially high-risk external collaboration.
Detects successful device code authentication flows from users who have not utilized this authentication method within the past 14 days. This rule monitors Entra ID (Azure AD) sign-in logs and non-interactive logs, enriching results with Intune device compliance data and authentication protocol details to assist in identifying anomalous access patterns that may indicate credential abuse or device-code phishing.
Detects anomalous human-like interactive browsing behavior from the 'qa@snowflake.net' Jira service account. This account is typically restricted to automated ticket creation via GitHub Actions; broad exploration of Jira boards, timelines, and reports indicates a potential account compromise where an API token has been exfiltrated and repurposed for reconnaissance.
Correlates Microsoft Entra Privileged Identity Management (PIM) role eligibility with actual activation activity to identify how privileged roles are being used across the environment.
The query combines eligible PIM assignments with activation events and submitted business justifications, allowing security teams to determine which privileged roles are frequently activated, rarely used, or never activated.
This is useful for privileged access reviews, least-privilege initiatives, role cleanup exercises, and validating whether users are providing meaningful activation justifications.
The query combines eligible PIM assignments with activation events and submitted business justifications, allowing security teams to determine which privileged roles are frequently activated, rarely used, or never activated.
This is useful for privileged access reviews, least-privilege initiatives, role cleanup exercises, and validating whether users are providing meaningful activation justifications.
Provides a role-centric view of Microsoft Entra Privileged Identity Management (PIM) usage by correlating role eligibility, activation history, and recently activated assignments.
The query helps security and identity teams understand:
Which privileged roles have the most eligible users.
Which roles are actively being used.
Which roles are rarely or never activated.
Which users currently hold activated privileged access.
How broadly privileged roles are distributed across the organization.
This is useful for privilege governance reviews, role rationalization, least-privilege initiatives, and identifying over-provisioned privileged access.
The query helps security and identity teams understand:
Which privileged roles have the most eligible users.
Which roles are actively being used.
Which roles are rarely or never activated.
Which users currently hold activated privileged access.
How broadly privileged roles are distributed across the organization.
This is useful for privilege governance reviews, role rationalization, least-privilege initiatives, and identifying over-provisioned privileged access.
Reviews Microsoft Entra Privileged Identity Management (PIM) role activations and correlates them with activation justifications supplied by users.
The query allows security teams to identify:
Who is activating privileged roles
Which roles are being activated
How often activations occur
When activations occurred
Business justifications provided during activation requests
This is useful for privileged access reviews, audit preparation, compliance reporting, least-privilege initiatives, and identifying users who repeatedly activate privileged roles with weak or repetitive justifications.
The query allows security teams to identify:
Who is activating privileged roles
Which roles are being activated
How often activations occur
When activations occurred
Business justifications provided during activation requests
This is useful for privileged access reviews, audit preparation, compliance reporting, least-privilege initiatives, and identifying users who repeatedly activate privileged roles with weak or repetitive justifications.
This rule detects potentially malicious service principal activity by correlating the granting of sensitive app roles with subsequent spikes in sign-in volume. It monitors AuditLogs for 'Add app role assignment to service principal' events involving high-privilege roles, then joins this data with AADServicePrincipalSignInLogs to identify if the service principal experiences a sudden, significant increase in hourly sign-ins compared to its historical baseline within 24 hours of the permission change.
Detects sign-ins with impossible browser/OS combinations and Outlook-labeled sign-ins presenting non-native user agents, consistent with Storm-2755 AiTM session token replay and impersonation.
Page 27 of 52