Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
771 detections
Filters
Last updated
All Time
Detection languages
392
128
66
49
47
Contributors
296
150
91
39
27
Categories
388
258
255
124
110
Platforms
523
344
285
121
72
Products / Services
370
328
112
51
43
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
771
CVEs
2
1
IDS Classtypes
15
11
3
1
1
IDS Protocols
29
This rule detects OAuth authorization requests (targeting Microsoft or Google identity providers) that use 'prompt=none' (silent authentication) and redirect the user to an unexpected or untrusted domain. This pattern is commonly used in OAuth consent phishing or token theft attacks, where an attacker attempts to silently acquire an authorization code by redirecting it to a malicious application server instead of the legitimate service provider's domain.
Detects non-interactive sign-ins, such as those using refresh or session tokens, originating from an IP address, ASN, device, or country that does not match the user's recent interactive sign-in history. The absence of an MFA challenge for these new contexts is characteristic of session token replay attacks, often associated with AiTM phishing campaigns.
Detects successful device code authentication flows from users who have not utilized this authentication method within the past 14 days. This rule monitors Entra ID (Azure AD) sign-in logs and non-interactive logs, enriching results with Intune device compliance data and authentication protocol details to assist in identifying anomalous access patterns that may indicate credential abuse or device-code phishing.
Detects behavioral indicators associated with the ChocoShell malware, a fileless PowerShell-based infostealer. The rule monitors for malicious command-line activity including AMSI bypass, credential theft from Token Broker and WLAN profiles, disabling of Microsoft Defender signatures, and communication with local API endpoints typical of the CornFlake controller.
Detects successful device code authentication flows from users who have not utilized this authentication method within the past 14 days. This rule monitors Entra ID (Azure AD) sign-in logs and non-interactive logs, enriching results with Intune device compliance data and authentication protocol details to assist in identifying anomalous access patterns that may indicate credential abuse or device-code phishing.
Detects when a user authorizes an OAuth application that requests high or critical permissions in a SaaS environment via Netskope logs. This pattern is commonly used in OAuth-based phishing campaigns or illicit application consent grants where adversaries attempt to gain persistent access to cloud resources.
Detects anomalous, non-browser process activity interacting with Microsoft Teams APIs associated with the TWINLOOT threat campaign. The rules identify suspicious token retrieval requests and unauthorized authentication headers from processes that do not identify as legitimate browser or Teams application agents, indicating potential abuse of application access tokens and authentication flows.
This analytic detects uncommon processes reading or requesting read access to sensitive files from cloud providers on Windows endpoints.
It monitors Windows Security Event 4663 for ReadData (AccessMask 0x1) operations against sensitive files from cloud providers such as Azure.
Access by any process outside the known toolchain may indicate credential theft or cloud identity reconnaissance activity, including infostealer behavior such as one observed in Vidar Stealer variants.
This detection currently only supports Azure sensitive files, but will be extended to support other cloud providers in the future.
It monitors Windows Security Event 4663 for ReadData (AccessMask 0x1) operations against sensitive files from cloud providers such as Azure.
Access by any process outside the known toolchain may indicate credential theft or cloud identity reconnaissance activity, including infostealer behavior such as one observed in Vidar Stealer variants.
This detection currently only supports Azure sensitive files, but will be extended to support other cloud providers in the future.
Detects Google Workspace bulk export/Takeout activity occurring shortly after an OAuth grant or app-password creation, or an unusual volume of export/download events, consistent with automated Gmail/Docs/Keep data exfiltration.
Detects when a user authorizes an OAuth application that requests high or critical permissions in a SaaS environment via Netskope logs. This pattern is commonly used in OAuth-based phishing campaigns or illicit application consent grants where adversaries attempt to gain persistent access to cloud resources.
Detects OAuth application authorization events where the granted scopes include highly sensitive access such as Gmail, Drive, or Admin APIs. This rule identifies potential consent phishing attacks where users are tricked into granting malicious third-party applications broad, unauthorized access to their Google Workspace account. The rule excludes common, expected applications like Google Cloud SDK or standard Google services.
Detects suspicious OAuth consent or connected app authorization followed by SaaS query, export, download, or bulk API activity from the same account within 24 hours, indicating possible OAuth token abuse or SaaS data exfiltration.
Detects a Google Workspace OAuth application grant and application-specific password issuance occurring within 30 minutes of a suspicious/AiTM-flagged sign-in, indicating Gmail account takeover.
Detects credential and token harvesting behaviors associated with the ChainDrop/Shai-Hulud 2.0 npm worm, specifically targeting CI/CD environments. The rule monitors for unauthorized access to /proc/[pid]/mem to scrape memory for workflow secrets, extraction of OIDC environment variables, and suspicious invocation of the GitHub CLI (gh) to steal authentication tokens.
Detects a single Entra ID session (SessionId) being used from two different countries within one hour at a travel velocity no physical journey could achieve. This is a signature of a stolen session/refresh token being replayed by an actor from a different location than the legitimate user.
This rule detects instances where a user grants an OAuth application consent to perform sensitive actions in an Azure AD environment. It specifically filters for high-risk scopes (such as Mail.Read, Files.ReadWrite, or Directory.ReadWrite) granted to applications with publishers other than Microsoft Corporation, which is often indicative of OAuth consent phishing attacks or malicious application integration.
Detects a Node or Bun process reaching the cloud instance metadata service. The keyv/cacheable
stage-2 collector targets EC2 IMDS and ECS task metadata as the entry point to a broader sweep
covering AWS credential chains and Secrets Manager across all regions, GCP service account
keys, Azure client secrets, HashiCorp Vault tokens, Kubernetes service account tokens, GitHub
Actions OIDC request tokens and npm tokens. On a build agent this pattern is the clearest
signal that credential theft is in progress.
stage-2 collector targets EC2 IMDS and ECS task metadata as the entry point to a broader sweep
covering AWS credential chains and Secrets Manager across all regions, GCP service account
keys, Azure client secrets, HashiCorp Vault tokens, Kubernetes service account tokens, GitHub
Actions OIDC request tokens and npm tokens. On a build agent this pattern is the clearest
signal that credential theft is in progress.
Detects process activity referencing GitHub Actions, GitLab CI, or Azure DevOps pipeline environment variable names (GITHUB_*, CI_*, GITHUB_ACTIONS, GITLAB_CI, Azure DevOps pipeline variables) consistent with a malicious extension harvesting CI/CD runner environment variables.
This rule detects instances where a user grants an OAuth application consent to perform sensitive actions in an Azure AD environment. It specifically filters for high-risk scopes (such as Mail.Read, Files.ReadWrite, or Directory.ReadWrite) granted to applications with publishers other than Microsoft Corporation, which is often indicative of OAuth consent phishing attacks or malicious application integration.
Detects a Node or Bun process reading Kubernetes service account tokens or HashiCorp Vault
token files. The keyv/cacheable collector reads these paths directly as part of its credential
sweep. Companion rule to the IMDS detection (d02b7df0-60e3-4ec9-a077-339507299e11).
token files. The keyv/cacheable collector reads these paths directly as part of its credential
sweep. Companion rule to the IMDS detection (d02b7df0-60e3-4ec9-a077-339507299e11).
This rule detects potential mass email access or collection activities by an application (AppId). It monitors Microsoft 365 CloudAppEvents for actions like 'MailItemsAccessed', 'Send', or 'New-InboxRule' associated with an application. It triggers an alert when a single application interacts with 10 or more distinct mailboxes within a one-hour window, which is indicative of potential Business Email Compromise (BEC) or unauthorized mass data exfiltration via compromised OAuth applications.
Page 23 of 37