Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
170 detections
Filters
Last updated
All Time
Detection languages
64
46
20
18
12
Contributors
36
23
19
13
12
Categories
59
42
39
38
36
Platforms
74
43
24
22
18
Products / Services
42
36
33
13
10
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
7
2
2
2
1
IDS Classtypes
4
4
3
3
1
IDS Protocols
7
5
This rule detects the creation of Okta API tokens with broad administrative scopes (okta.users.manage, okta.factors.manage, or okta.apps.manage) by the same user multiple times within a one-hour window. This behavior can indicate an attempt to establish persistent access or bypass multi-factor authentication.
This rule detects the creation of Okta API tokens with broad administrative scopes (okta.users.manage, okta.factors.manage, or okta.apps.manage) by the same user multiple times within a one-hour window. This behavior can indicate an attempt to establish persistent access or bypass multi-factor authentication.
Detects potential session replay attacks indicative of Kali365 and other AitM (Adversary-in-the-Middle) proxying phishing kits. This rule isolates successful user logins containing a SessionId. To fully operationalize this for AitM detection, defenders must utilize SIEM-based correlation (e.g., statistical or window-based queries) to track a single SessionId originating from multiple geographically disparate IP addresses within a short timeframe.
This rule detects attempts to modify the SSH daemon configuration file (sshd_config) remotely over an established TCP connection to port 22. The detection is based on the presence of the string "sshd_config" within the network flow, indicating potential remote manipulation of SSH authentication settings.
This rule detects attempts to modify Identity Provider authentication settings within Microsoft Graph. Specifically, it looks for HTTP PATCH requests to the 'authentication' endpoint on 'graph.microsoft.com'. This activity could indicate an attacker attempting to alter authentication mechanisms, potentially for persistence or to facilitate further access.
This rule detects network traffic on TCP port 445 (SMB) containing the strings "system32" and "msv1_0.dll" in a case-insensitive manner. This pattern is indicative of an attempt to replace the authentication DLL (msv1_0.dll) on a remote Windows host, which is a known technique for persistence and credential manipulation.
This rule detects attempts to modify authentication configuration via LDAP by looking for the string "msDS-SupportedEncryptionTypes" in TCP traffic destined for port 389 (LDAP). This string is associated with changes to supported encryption types in Active Directory, which could be an indicator of persistence or privilege escalation.
This rule detects a highly suspicious sequence of events in Microsoft Entra ID (formerly Azure AD) audit logs: a self-service password reset, followed by the registration of new security information, and then the deletion of existing security information, all performed by the same user within a short time window. This pattern is indicative of an attacker taking over an account, resetting the password, establishing their own MFA/security info, and then removing the legitimate user's security info to lock them out. This behavior has been observed in campaigns like Storm-2949.
Detects if a new connector is registered on Azure AD; Azure AD Application Proxy is a feature of Microsoft Entra that allows you to securely publish on-premises applications to remote users. This is particularly useful for organizations that need to provide access to internal applications without exposing them directly to the internet.
Detects network connections or DNS queries to known lookalike domains utilized by UNC6671 (BlackFile) for adversary-in-the-middle (AiTM) credential harvesting and real-time MFA bypass during vishing operations.
Detects modifications to the msDS-KeyCredentialLink attribute on Delegated Managed Service Account (dMSA) objects, indicating a potential Shadow Credential (X.509 certificate) planting. This allows an attacker to bypass managed password rotation and maintain permanent PKINIT access, as seen in the dMSA Ouroboros attack chain. The rule also monitors Event 4768 (PKINIT TGT requests with pre-authentication type 17) and Event 4662 (S4U2Self Object Access) for dMSA objects, which are key indicators of this attack.
Detects when a user disables a critical security feature for an organization.
Detects when certificate based authentication has been enabled in an Azure Active Directory tenant.
Detects newly added root certificate authority to an AzureAD tenant to support certificate based authentication.
Monitor and alert on group membership additions of groups that have CA policy modification access
Detects a change in the AWS Identity Center (FKA AWS SSO) identity provider.
A change in identity provider allows an attacker to establish persistent access or escalate privileges via user impersonation.
A change in identity provider allows an attacker to establish persistent access or escalate privileges via user impersonation.
Monitor and alert on group membership removal of groups that have CA policy modification access
Monitor and alert on conditional access changes where non approved actor removed CA Policy.
Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare "old" vs "new" value.
Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.
Detects possible addition of shadow credentials to an active directory object.
Page 5 of 9