Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
181 detections
Filters
Last updated
All Time
Detection languages
114
27
13
10
5
Contributors
63
37
19
10
5
Categories
67
53
53
44
40
Platforms
81
80
40
28
15
Products / Services
63
40
32
27
14
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
5
4
1
IDS Classtypes
3
2
2
1
IDS Protocols
3
1
Detects instances where a LiteLLM proxy is utilized to invoke sensitive Model Context Protocol (MCP) tools (e.g., database, github, slack, jira, ci/cd) while authentication is bypassed ('allow_all_keys=true') and no explicit API key is provided. This indicates a potential unauthorized access attempt to sensitive integrations via a misconfigured proxy.
Detects instances where a LiteLLM proxy is utilized to invoke sensitive Model Context Protocol (MCP) tools (e.g., database, github, slack, jira, ci/cd) while authentication is bypassed ('allow_all_keys=true') and no explicit API key is provided. This indicates a potential unauthorized access attempt to sensitive integrations via a misconfigured proxy.
This rule identifies successful user sign-ins (ResultType 0) originating from specific Autonomous System Numbers (197540, 216154) where Multi-Factor Authentication (MFA) was not required or not recorded, and where Conditional Access policies either did not apply or succeeded without enforcing MFA.
This rule identifies successful user sign-ins (ResultType 0) originating from specific Autonomous System Numbers (197540, 216154) where Multi-Factor Authentication (MFA) was not required or not recorded, and where Conditional Access policies either did not apply or succeeded without enforcing MFA.
Detects JFrog Artifactory access-token issuance events on/after the suspected compromise window (2026-08-28) where the token is tied to the anonymous identity, granted administrator scope, or has no attributable initiating user, per Fastly's remediation guidance.
Detects JFrog Artifactory access-token issuance events on/after the suspected compromise window (2026-08-28) where the token is tied to the anonymous identity, granted administrator scope, or has no attributable initiating user, per Fastly's remediation guidance.
Detects JFrog Artifactory access-token issuance events on/after the suspected compromise window (2026-08-28) where the token is tied to the anonymous identity, granted administrator scope, or has no attributable initiating user, per Fastly's remediation guidance.
Detects instances where the Grafana MCP (Model Context Protocol) server's service account identity executes administrative tools (such as 'grafana_api_request') within a session that lacks a verified, prior authentication event (bearer token). This pattern suggests an adversary may be spoofing or hijacking a privileged service account session to perform unauthorized administrative actions.
Detects sessions using shared Grafana service account tokens that perform both read-only and action-capable tool operations without confirmed prior authentication. This behavior is indicative of an unauthenticated or spoofed session leveraging a service account's excessive permissions, bypassing standard authentication flows.
This rule detects potentially unauthorized access to cloud resources or OAuth applications by identifying sign-ins or API calls originating from IP addresses or locations not previously observed for the user in the 30 days prior to a documented Coder registry compromise exposure window.
Detects sessions using shared Grafana service account tokens that perform both read-only and action-capable tool operations without confirmed prior authentication. This behavior is indicative of an unauthenticated or spoofed session leveraging a service account's excessive permissions, bypassing standard authentication flows.
Detects Microsoft 365 sign-in events where a session token is reused without a fresh MFA challenge, originating from known residential proxy service providers. This behavior is indicative of threat actors using stolen session tokens (Session Replay) to bypass MFA protections.
Detects instances where the Grafana MCP (Model Context Protocol) server's service account identity executes administrative tools (such as 'grafana_api_request') within a session that lacks a verified, prior authentication event (bearer token). This pattern suggests an adversary may be spoofing or hijacking a privileged service account session to perform unauthorized administrative actions.
Detects instances where the Grafana MCP (Model Context Protocol) server's service account identity executes administrative tools (such as 'grafana_api_request') within a session that lacks a verified, prior authentication event (bearer token). This pattern suggests an adversary may be spoofing or hijacking a privileged service account session to perform unauthorized administrative actions.
Detects sessions using shared Grafana service account tokens that perform both read-only and action-capable tool operations without confirmed prior authentication. This behavior is indicative of an unauthenticated or spoofed session leveraging a service account's excessive permissions, bypassing standard authentication flows.
Detects unauthenticated execution of sensitive Grafana MCP tools (tools/call, grafana_api_request) by identifying session IDs that lack a corresponding authenticated handshake event. This behavior is indicative of potential session spoofing or abuse of the MCP protocol where an attacker attempts to interact with privileged tools without performing a valid authentication handshake.
Detects instances where the Grafana MCP (Model Context Protocol) server's service account identity executes administrative tools (such as 'grafana_api_request') within a session that lacks a verified, prior authentication event (bearer token). This pattern suggests an adversary may be spoofing or hijacking a privileged service account session to perform unauthorized administrative actions.
This rule detects potentially unauthorized access to cloud resources or OAuth applications by identifying sign-ins or API calls originating from IP addresses or locations not previously observed for the user in the 30 days prior to a documented Coder registry compromise exposure window.
Detects anomalous authentication behavior where a user account utilizes the same authentication session (LogonId) or material to authenticate across multiple distinct destination hosts in a short timeframe. This rule monitors for both NTLM (Type 3) and Kerberos (TGS/TGT) events, which are indicative of lateral movement techniques such as Pass-the-Hash or Pass-the-Ticket.
Detects anomalous authentication behavior where a user account utilizes the same authentication session (LogonId) or material to authenticate across multiple distinct destination hosts in a short timeframe. This rule monitors for both NTLM (Type 3) and Kerberos (TGS/TGT) events, which are indicative of lateral movement techniques such as Pass-the-Hash or Pass-the-Ticket.
Detects Microsoft 365 sign-in events where a session token is reused without a fresh MFA challenge, originating from known residential proxy service providers. This behavior is indicative of threat actors using stolen session tokens (Session Replay) to bypass MFA protections.
Page 4 of 9