Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,088 detections
Filters
Last updated
All Time
Detection languages
619
191
113
86
47
Contributors
302
211
112
88
54
Categories
481
416
353
192
164
Platforms
726
348
216
136
57
Products / Services
518
292
197
124
88
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,088
CVEs
5
5
5
5
4
IDS Classtypes
3
2
1
1
IDS Protocols
3
Detects sign-ins from known UNC6671 residential-proxy IPs, ranked by rarity (first-seen for the user) and correlated with a following sensitive account action (MFA registration, mailbox rule change, admin role change).
Detects OfficeHome sign-ins with error 90014 (nonce omission) followed by anomalous successful sign-ins from a different IP, or repeated 90014 failures, consistent with AiTM token replay activity.
Detects use of default SSL-VPN administrator credentials from external or unusual source geographies after production provisioning, where account-lockout controls are absent — the initial-access vector observed in Gunra intrusions.
Detects a single user account signing into OfficeHome from 3+ distinct proxy/anyIP-flagged IP addresses within a 15-minute window, consistent with AiTM session replay from rotating residential proxy infrastructure.
Detects creation of malicious Exchange inbox rules (move to Deleted Items / mark as read) correlated via SessionId to an interactive sign-in from the Datawagon hosting ASN (27176) and a subsequent MailItemsAccessed event, consistent with Storm-2755 AiTM session-replay and mailbox-hiding persistence.
Detects cross-region GraphApiAuditEvents calls for the same AccountObjectId/ApplicationId occurring faster than plausible travel time, indicating a replayed/stolen session token.
Detects Outlook sign-ins that reuse the same SessionId roughly every 8 hours while source IP/ASN change, consistent with attackers replaying a stolen AiTM-captured session token through rotating residential proxy infrastructure.
This rule identifies Service Principals in Microsoft Entra ID that have successfully authenticated after a long period of dormancy (defined as 90 days or more). Reactivation of dormant service principals may indicate that an adversary is attempting to revive a persistent access method or abuse credentials that were previously set aside.
Detects a new-device Okta sign-in followed by three or more failed Admin Console authentication attempts originating from a different device/IP context, consistent with privilege escalation using a stolen AiTM session token.
Detects a single Entra ID session (SessionId) being used from two different countries within one hour at a travel velocity no physical journey could achieve. This is a signature of a stolen session/refresh token being replayed by an actor from a different location than the legitimate user.
Detects sign-ins from the same user account occurring from two different countries within a short time window, where the implied travel velocity exceeds physically achievable speeds, indicating impossible travel or anomalous geolocation change consistent with a hijacked account or API key credential, with special attention to sudden access from China-based infrastructure.
This rule monitors for potentially malicious activities involving Azure AD Connect synchronization accounts. It flags anomalous sign-in events (e.g., interactive sign-ins or sign-ins originating from unauthorized IP addresses) and tracks when these sync accounts are granted privileged roles within the environment.
This rule monitors for potentially malicious activities involving Azure AD Connect synchronization accounts. It flags anomalous sign-in events (e.g., interactive sign-ins or sign-ins originating from unauthorized IP addresses) and tracks when these sync accounts are granted privileged roles within the environment.
This rule monitors GCP Audit logs for the creation or deletion of VPN tunnels. It classifies the actor (human vs. service account) and validates the source of the action against expected patterns such as the use of Terraform and authorized network sources. It highlights activity that deviates from standard infrastructure-as-code deployments or originates from unusual network sources, aiding in the detection of unauthorized or suspicious network configuration changes.
This KQL detects possible impossible travel sign-in patterns by identifying users who had successful Entra ID sign-ins from different countries within a short time window of 4 hours.
This rule detects when a user registers a new multi-factor authentication (MFA) method from an Autonomous System Number (ASN) that the user has not used for authentication in the previous 30 days. This behavior is indicative of potential account takeover or an adversary setting up persistent MFA access from a new location.
Detects the use of sts:AssumeRoot within an AWS Organization. This action allows an entity within the management account to assume root-level access in a member account, effectively bypassing standard IAM restrictions. This is a high-risk event indicative of potential privilege escalation or management account compromise.
This rule identifies Service Principals in Microsoft Entra ID that have successfully authenticated after a long period of dormancy (defined as 90 days or more). Reactivation of dormant service principals may indicate that an adversary is attempting to revive a persistent access method or abuse credentials that were previously set aside.
Detects non-interactive token refreshes occurring at anomalously consistent short intervals or from previously unseen IPs/devices, consistent with AiTM stolen session token replay used to maintain persistent access.
Detects interactive sign-in attempts for accounts commonly associated with Microsoft sync services (e.g., AD Connect, MSOL sync). Service accounts should typically perform background, non-interactive authentication. An interactive login for these accounts may indicate credential misuse or unauthorized access.
Detects interactive sign-in attempts for accounts commonly associated with Microsoft sync services (e.g., AD Connect, MSOL sync). Service accounts should typically perform background, non-interactive authentication. An interactive login for these accounts may indicate credential misuse or unauthorized access.
Page 28 of 52