Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,088 detections
Filters
Last updated
All Time
Detection languages
619
191
113
86
47
Contributors
302
211
112
88
54
Categories
481
416
353
192
164
Platforms
726
348
216
136
57
Products / Services
518
292
197
124
88
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,088
CVEs
5
5
5
5
4
IDS Classtypes
3
2
1
1
IDS Protocols
3
Detects modifications to the service account assigned to a Google Compute Engine (GCE) instance. An adversary might alter the attached service account to escalate privileges, gain access to additional resources, or maintain persistence by leveraging an identity with higher permissions.
This rule detects modifications to Google Cloud Platform (GCP) Cloud Routers by monitoring audit logs for non-read operations. It flags changes made by human users, service accounts not utilizing Terraform, or service accounts originating from unexpected network sources as high-priority, while tracking general router creations and deletions.
This rule detects when a user registers a new multi-factor authentication (MFA) method from an Autonomous System Number (ASN) that the user has not used for authentication in the previous 30 days. This behavior is indicative of potential account takeover or an adversary setting up persistent MFA access from a new location.
Slack Anomalous Activity
Cortex XDR
This rule detects anomalous activity reported by Slack's internal anomaly detection system. This includes events such as impossible travel, new device access, suspicious IP changes, and other behavioral anomalies that Slack identifies. The rule extracts relevant user and context information for further investigation.
This rule detects potentially malicious attempts to leverage different Microsoft cloud applications (FOCI family) in a short time frame following a conditional access block (AADSTS53003). The rule identifies scenarios where a single user account, within a 10-minute window, generates a 53003 failure while attempting to use multiple different client applications (such as Teams, O365, or Azure Portal), which may indicate an adversary attempting to bypass or probe security controls or testing token validity across multiple services.
This rule detects potentially malicious attempts to leverage different Microsoft cloud applications (FOCI family) in a short time frame following a conditional access block (AADSTS53003). The rule identifies scenarios where a single user account, within a 10-minute window, generates a 53003 failure while attempting to use multiple different client applications (such as Teams, O365, or Azure Portal), which may indicate an adversary attempting to bypass or probe security controls or testing token validity across multiple services.
This rule detects instances where a Google Cloud Platform (GCP) identity attempts to grant themselves highly privileged IAM roles at the project level. It monitors 'SetIamPolicy' events in GCP audit logs, filtering for activities where the actor (user) is included in the set of members receiving high-privilege roles such as owner, editor, or various administrative roles (e.g., storage.admin, compute.admin).
This rule detects potential credential abuse by monitoring for a burst of GCP access or ID token generation requests by a single user across five or more distinct resource targets within a single project. Such behavior is often indicative of an adversary enumerating resources or performing reconnaissance to identify reachable services or systems after successfully assuming a principal's identity.
Detects Azure AD sign-ins to Microsoft Teams flagged with an elevated risk state, which may indicate cloud account abuse following external Teams-based social engineering contact preceding a broader spike in malicious M365 activity.
Detects Azure AD sign-ins to Microsoft Teams flagged with an elevated risk state, which may indicate cloud account abuse following external Teams-based social engineering contact preceding a broader spike in malicious M365 activity.
Detects Azure AD sign-ins to Microsoft Teams flagged with an elevated risk state, which may indicate cloud account abuse following external Teams-based social engineering contact preceding a broader spike in malicious M365 activity.
Detects creation of logAzure.txt, the relative configuration
file the Project CAV3RN AzureCommunication.dll module reads and writes to the process's current working directory. On first run the module has no such file, so it serializes its hardcoded Microsoft Entra tenant ID,
application client ID/secret, target mailbox, DNS bootstrap host, and RSA key pair to this exact filename before establishing Microsoft Graph C2. Its presence on disk is a durable artifact of this specific implant.
file the Project CAV3RN AzureCommunication.dll module reads and writes to the process's current working directory. On first run the module has no such file, so it serializes its hardcoded Microsoft Entra tenant ID,
application client ID/secret, target mailbox, DNS bootstrap host, and RSA key pair to this exact filename before establishing Microsoft Graph C2. Its presence on disk is a durable artifact of this specific implant.
This rule detects potentially malicious activity on WordPress servers by correlating the creation of a new administrator account via the REST API with subsequent plugin installation activity and the creation of PHP files within the plugin directory within a one-hour window. This sequence is characteristic of an adversary establishing persistence or backdooring a WordPress site after gaining unauthorized access.
Detects successful authentication events using the OAuth device code flow. This flow is often abused by adversaries to perform OAuth phishing, where a user is tricked into authorizing a malicious application, granting it access tokens to cloud resources.
Detects successful Azure AD sign-in events authenticated via the device code flow that subsequently access Microsoft 365 resources such as Outlook, SharePoint, OneDrive, or Teams. This pattern is consistent with post-compromise use of OAuth tokens obtained through device-code phishing.
Detects successful authentication events using the OAuth device code flow. This flow is often abused by adversaries to perform OAuth phishing, where a user is tricked into authorizing a malicious application, granting it access tokens to cloud resources.
Detects successful Azure AD sign-in events authenticated via the device code flow that subsequently access Microsoft 365 resources such as Outlook, SharePoint, OneDrive, or Teams. This pattern is consistent with post-compromise use of OAuth tokens obtained through device-code phishing.
Detects successful Azure AD sign-in events authenticated via the device code flow that subsequently access Microsoft 365 resources such as Outlook, SharePoint, OneDrive, or Teams. This pattern is consistent with post-compromise use of OAuth tokens obtained through device-code phishing.
This rule analyzes Microsoft Entra (Azure AD) sign-in logs over a 30-day period for access to sensitive administrative applications (e.g., Azure Portal, Microsoft Intune, Defender). It flags user-application-IP sessions that exhibit unusual characteristics, such as login successes following failures, access from multiple geographic locations, or the use of multiple client types, which may indicate account compromise or unauthorized access.
This rule detects non-interactive sign-in events involving the 'Microsoft Authentication Broker' where the authentication was performed using only single-factor authentication and originated from a device that is not recognized or lacks trust information (unmanaged/unknown device). This pattern is consistent with token replay attacks or session hijacking, where an adversary uses stolen authentication artifacts to access resources without undergoing standard multi-factor authentication.
Detects successful authentication events using the OAuth device code flow. This flow is often abused by adversaries to perform OAuth phishing, where a user is tricked into authorizing a malicious application, granting it access tokens to cloud resources.
Page 29 of 52