Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
181 detections
Filters
Last updated
All Time
Detection languages
114
27
13
10
5
Contributors
63
37
19
10
5
Categories
67
53
53
44
40
Platforms
81
80
40
28
15
Products / Services
63
40
32
27
14
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
5
4
1
IDS Classtypes
3
2
2
1
IDS Protocols
3
1
This rule detects potential exploitation attempts (CVE-2026-59822) against LiteLLM MCP tool endpoints. It identifies HTTP requests where the authorization bearer token is unusually short (<= 12 chars), lacks the 'sk-' prefix, and does not appear to be a valid JWT, yet successfully results in a 200 OK status, indicating a potential bypass of authentication logic.
This rule detects potential exploitation attempts (CVE-2026-59822) against LiteLLM MCP tool endpoints. It identifies HTTP requests where the authorization bearer token is unusually short (<= 12 chars), lacks the 'sk-' prefix, and does not appear to be a valid JWT, yet successfully results in a 200 OK status, indicating a potential bypass of authentication logic.
Detects unauthenticated execution of sensitive Grafana MCP tools (tools/call, grafana_api_request) by identifying session IDs that lack a corresponding authenticated handshake event. This behavior is indicative of potential session spoofing or abuse of the MCP protocol where an attacker attempts to interact with privileged tools without performing a valid authentication handshake.
Detects sessions using shared Grafana service account tokens that perform both read-only and action-capable tool operations without confirmed prior authentication. This behavior is indicative of an unauthenticated or spoofed session leveraging a service account's excessive permissions, bypassing standard authentication flows.
Detects anomalous authentication behavior where a user account utilizes the same authentication session (LogonId) or material to authenticate across multiple distinct destination hosts in a short timeframe. This rule monitors for both NTLM (Type 3) and Kerberos (TGS/TGT) events, which are indicative of lateral movement techniques such as Pass-the-Hash or Pass-the-Ticket.
Detects JFrog Artifactory access-token issuance events on/after the suspected compromise window (2026-08-28) where the token is tied to the anonymous identity, granted administrator scope, or has no attributable initiating user, per Fastly's remediation guidance.
This rule detects potentially malicious activity where a user performs a device code authentication followed by multiple rapid token exchanges (often of different types) within an extremely short time window. This pattern is indicative of an attacker attempting to leverage a compromised device code grant to programmatically retrieve access or refresh tokens before the user has completed a legitimate flow or to automate malicious access.
This rule detects potential OAuth 2.0 device code phishing attempts by monitoring network activity for requests to common Microsoft OAuth device authorization endpoints. It flags requests that utilize a specific hardcoded client_id associated with known suspicious application registrations, combined with requested scopes for graph.microsoft.com and a Python-based user agent. This behavior is indicative of an adversary attempting to gain unauthorized access by tricking a user into authorizing a malicious application.
This rule detects potential OAuth 2.0 device code phishing attempts by monitoring network activity for requests to common Microsoft OAuth device authorization endpoints. It flags requests that utilize a specific hardcoded client_id associated with known suspicious application registrations, combined with requested scopes for graph.microsoft.com and a Python-based user agent. This behavior is indicative of an adversary attempting to gain unauthorized access by tricking a user into authorizing a malicious application.
Detects Microsoft 365 sign-in events where a session token is reused without a fresh MFA challenge, originating from known residential proxy service providers. This behavior is indicative of threat actors using stolen session tokens (Session Replay) to bypass MFA protections.
This rule detects potential exploitation attempts (CVE-2026-59822) against LiteLLM MCP tool endpoints. It identifies HTTP requests where the authorization bearer token is unusually short (<= 12 chars), lacks the 'sk-' prefix, and does not appear to be a valid JWT, yet successfully results in a 200 OK status, indicating a potential bypass of authentication logic.
This rule detects potential exploitation attempts (CVE-2026-59822) against LiteLLM MCP tool endpoints. It identifies HTTP requests where the authorization bearer token is unusually short (<= 12 chars), lacks the 'sk-' prefix, and does not appear to be a valid JWT, yet successfully results in a 200 OK status, indicating a potential bypass of authentication logic.
Detects Microsoft 365 sign-in events where a session token is reused without a fresh MFA challenge, originating from known residential proxy service providers. This behavior is indicative of threat actors using stolen session tokens (Session Replay) to bypass MFA protections.
Detects anomalous authentication behavior where a user account utilizes the same authentication session (LogonId) or material to authenticate across multiple distinct destination hosts in a short timeframe. This rule monitors for both NTLM (Type 3) and Kerberos (TGS/TGT) events, which are indicative of lateral movement techniques such as Pass-the-Hash or Pass-the-Ticket.
Detects Microsoft 365 sign-in events where a session token is reused without a fresh MFA challenge, originating from known residential proxy service providers. This behavior is indicative of threat actors using stolen session tokens (Session Replay) to bypass MFA protections.
Detects anomalous authentication behavior where a user account utilizes the same authentication session (LogonId) or material to authenticate across multiple distinct destination hosts in a short timeframe. This rule monitors for both NTLM (Type 3) and Kerberos (TGS/TGT) events, which are indicative of lateral movement techniques such as Pass-the-Hash or Pass-the-Ticket.
Detects invocations of the 'grafana_api_request' tool that lack a preceding valid bearer-token authentication event for the same session. This indicates a potential scenario where a server or service account token is being used on behalf of an unauthenticated caller, bypassing normal authentication requirements for the Grafana API.
This rule detects potentially unauthorized access to cloud resources or OAuth applications by identifying sign-ins or API calls originating from IP addresses or locations not previously observed for the user in the 30 days prior to a documented Coder registry compromise exposure window.
This rule detects potential exploitation attempts (CVE-2026-59822) against LiteLLM MCP tool endpoints. It identifies HTTP requests where the authorization bearer token is unusually short (<= 12 chars), lacks the 'sk-' prefix, and does not appear to be a valid JWT, yet successfully results in a 200 OK status, indicating a potential bypass of authentication logic.
Detects instances where a LiteLLM proxy is utilized to invoke sensitive Model Context Protocol (MCP) tools (e.g., database, github, slack, jira, ci/cd) while authentication is bypassed ('allow_all_keys=true') and no explicit API key is provided. This indicates a potential unauthorized access attempt to sensitive integrations via a misconfigured proxy.
Detects instances where a LiteLLM proxy is utilized to invoke sensitive Model Context Protocol (MCP) tools (e.g., database, github, slack, jira, ci/cd) while authentication is bypassed ('allow_all_keys=true') and no explicit API key is provided. This indicates a potential unauthorized access attempt to sensitive integrations via a misconfigured proxy.
Page 3 of 9