Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,088 detections
Filters
Last updated
All Time
Detection languages
619
191
113
86
47
Contributors
302
211
112
88
54
Categories
481
416
353
192
164
Platforms
726
348
216
136
57
Products / Services
518
292
197
124
88
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,088
CVEs
5
5
5
5
4
IDS Classtypes
3
2
1
1
IDS Protocols
3
This rule detects a high volume of successful sign-in attempts to Exchange Online from a single IP address where the UserPrincipalName ends with '@' (indicating an anonymous or malformed UPN) and Conditional Access was not applied. This pattern can be indicative of anonymous SMTP relay abuse, often used for spamming or phishing campaigns.
Detects Microsoft 365 sign-in activity consistent with the Payroll Pirate campaign. This rule monitors for successful sign-ins originating from known residential proxy ASN providers (IPRoyal, Bright Data, Oxylabs) or instances where a successful sign-in occurs with a suspicious browser fingerprint (Firefox 131.0/142.0) during a Microsoft Graph OAuth2 token request, indicating session-token replay.
Detects a browser session that contacts an EvilTokens Device Code phishing endpoint (/api/device/status/) and then immediately navigates to onedrive.live.com. This indicates that the attacker's backend successfully returned 'status:completed' and the phishing kit executed a window.location.replace to redirect the victim to OneDrive after token capture.
This rule detects successful configuration modifications to diagnostic settings or storage services where the destination resource is identified as being outside of the organization's trusted subscriptions or expected storage naming conventions. This activity may indicate an adversary attempting to exfiltrate logs or data to an attacker-controlled storage account.
Detects a multi-stage attack where an adversary reads local AWS credentials or configuration files (e.g., .aws/credentials, mcp.json) on a developer workstation and subsequently performs unauthorized AWS API calls from the same source IP. The rule correlates initial credential access on the endpoint with a sequence of AWS CloudTrail events starting with identity verification (GetCallerIdentity) followed by enumeration and potentially high-impact API calls (e.g., RunInstances, AssumeRole).
Detects a sequence of events where a developer utility (e.g., npm, git) is executed on an endpoint, followed shortly by suspicious cloud API calls originating from the same source IP address. This pattern potentially indicates credential theft or misuse where keys or configuration files were exfiltrated or abused to authenticate against AWS services.
Detects potential exploitation of CVE-2025-0309, where the Intune Company Portal application identifier is used to acquire Microsoft Graph tokens via a password grant mechanism while bypassing Multi-Factor Authentication (MFA). This technique typically relies on exploiting misconfigured Conditional Access policies that exclude the Intune resource from mandatory MFA enforcement.
This rule detects potential automated credential stuffing attempts followed by successful authentication and subsequent access to sensitive/privileged APIs within Azure/Entra ID environments. It correlates multiple failed login attempts for service-oriented account names (e.g., svc, api, bot) with a successful login from the same user shortly thereafter, followed by privileged API operations (e.g., KeyVault secret access, user management) within a short time window.
This rule identifies potential account compromise by detecting successful logins to at least two different SaaS applications monitored by Microsoft Cloud App Security (MCAS) within a 2-hour window, originating from geolocations separated by more than 500 kilometers. This behavior is indicative of credential sharing or account hijacking where an adversary accesses multiple cloud services rapidly from geographically distant locations.
Detects anomalous activities targeting SaaS CRM applications (Salesforce, Microsoft Dynamics 365, HubSpot), including high-volume bulk exports, off-hours access, mass API queries for sensitive objects, and suspicious OAuth token grants.
Detects named pipe activity with remote access enabled, initiated by JsonVMAccessExtension.exe running as SYSTEM. This may indicate abuse of the Azure VM Access Extension for unauthorized remote access.
Detects a multi-stage attack pattern associated with the Qilin ransomware, beginning with suspicious VPN authentication (potential credential stuffing or bypass), moving through lateral movement attempts (SMB/RDP/WMI), and culminating in ransomware behaviors such as shadow copy deletion, mass file encryption, and ransom note creation.
This rule detects potential unauthorized access to Azure Storage Blobs following the retrieval of storage account access keys. It correlates 'ListKeys' API events with subsequent blob access activities from either unrecognized IP addresses or via Shared Access Signature (SAS) tokens, indicating potential credential misuse.
Detects when an application or service principal is assigned an app role containing sensitive permissions in Azure AD/Microsoft Entra ID. Such assignments can grant an application elevated access to mail, directory, or user management, which is a common tactic for persistence and privilege escalation in cloud environments.
Detects when a single user account performs 3 or more Privileged Identity Management (PIM) role activations within a 30-minute window. This behavior may indicate an attacker who has compromised a privileged account and is rapidly assuming multiple roles to perform lateral movement or privilege escalation.
Correlates a successful authentication from a new, untrusted IP address utilizing a Linux/Kali User-Agent, a known signature of the Kali365 framework.
Detects successful sign-ins to Microsoft Graph where Multi-Factor Authentication (MFA) was expected but not applied or not enabled, and the authentication method used was not MFA or passwordlessMFA. This could indicate an MFA bypass or misconfiguration, allowing access to sensitive resources without the required second factor.
Detects the execution of 'aws sts get-caller-identity' spawned by IDE-related processes such as VS Code extension hosts or Amazon Q language servers. This pattern may indicate cloud credential reconnaissance performed by a malicious MCP (Model Context Protocol) server or compromised development extension (CVE-2026-12957).
Detects rapid post-exploitation activity where a developer's workstation, upon executing VS Code (Code.exe), initiates outbound network connections to major cloud service or CI/CD provider APIs (GitHub, AWS, Azure, GCP) within 60 minutes. This behavior is indicative of the Lazarus Group 'Contagious Interview' campaign, where stolen credentials from developer environments are used to pivot into cloud infrastructure or CI/CD pipelines.
This rule detects potential MFA bypass via stolen session cookies by identifying successful single-factor authentications from new or unmanaged/non-compliant devices, especially when originating from a new geographical location for the user or exhibiting medium/high sign-in risk. It correlates impossible travel, new device, and lack of MDM/EDR compliance signals.
This rule detects potentially suspicious AWS API activity by identifying IAM identities that perform high-privilege operations or use developer-oriented user agents (e.g., boto3, python-requests) from multiple distinct IP addresses within a one-hour window. It calculates a risk score based on the combination of source IP diversity, developer tool usage, and the presence of sensitive API calls such as CreateUser, CreateAccessKey, RunInstances, and AssumeRole.
Page 32 of 52