Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
27 detections
Filters
Last updated
All Time
Detection languages
17
7
2
1
Contributors
11
10
4
1
1
Categories
9
7
6
6
5
Platforms
14
8
7
6
5
Products / Services
7
7
7
5
5
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
4
1
1
1
IDS Protocols
4
2
1
This rule performs a retrospective sweep across Microsoft Defender XDR data sources (DeviceFileEvents, DeviceProcessEvents, DeviceNetworkEvents, and EmailEvents) to identify activity associated with the Star Blizzard (COLDRIVER) campaign. It monitors for specific file hashes, file names, known C2 IP addresses and domains, malicious URL patterns, and known phishing email sender addresses identified in threat intelligence reporting.
This rule performs a retrospective sweep across Microsoft Defender XDR data sources (DeviceFileEvents, DeviceProcessEvents, DeviceNetworkEvents, and EmailEvents) to identify activity associated with the Star Blizzard (COLDRIVER) campaign. It monitors for specific file hashes, file names, known C2 IP addresses and domains, malicious URL patterns, and known phishing email sender addresses identified in threat intelligence reporting.
This rule performs a retrospective sweep across Microsoft Defender XDR data sources (DeviceFileEvents, DeviceProcessEvents, DeviceNetworkEvents, and EmailEvents) to identify activity associated with the Star Blizzard (COLDRIVER) campaign. It monitors for specific file hashes, file names, known C2 IP addresses and domains, malicious URL patterns, and known phishing email sender addresses identified in threat intelligence reporting.
This rule performs a retrospective sweep across Microsoft Defender XDR data sources (DeviceFileEvents, DeviceProcessEvents, DeviceNetworkEvents, and EmailEvents) to identify activity associated with the Star Blizzard (COLDRIVER) campaign. It monitors for specific file hashes, file names, known C2 IP addresses and domains, malicious URL patterns, and known phishing email sender addresses identified in threat intelligence reporting.
This rule performs a retrospective sweep across Microsoft Defender XDR data sources (DeviceFileEvents, DeviceProcessEvents, DeviceNetworkEvents, and EmailEvents) to identify activity associated with the Star Blizzard (COLDRIVER) campaign. It monitors for specific file hashes, file names, known C2 IP addresses and domains, malicious URL patterns, and known phishing email sender addresses identified in threat intelligence reporting.
Detects HTTP POST requests directed at common Machine Learning inference endpoints (e.g., /predict, /classify, /infer) where the request body claims to be a multipart form-data image upload (Content-Type: image/jpeg) but the actual binary data does not contain the standard JPEG file signature (FF D8 FF). This pattern is indicative of adversarial attempts to bypass security controls or provide malformed payloads to ML models.
Detects unauthorized modifications or non-pipeline uploads to an ML model registry. The rule flags events where model artifacts lack valid signatures, fail checksum verification, or are uploaded/promoted by non-authorized identities or without required CI/CD provenance, indicating potential ML model backdooring or poisoning.
This rule detects high volumes of near-identical, incrementally-varied queries directed at an AI model API. This behavior is indicative of a black-box adversarial optimization loop, where an attacker attempts to infer model vulnerabilities, bypass safety filters, or perform model evasion by observing how slight input variations change model responses.
This rule detects high volumes of near-identical, incrementally-varied queries directed at an AI model API. This behavior is indicative of a black-box adversarial optimization loop, where an attacker attempts to infer model vulnerabilities, bypass safety filters, or perform model evasion by observing how slight input variations change model responses.
This rule detects high volumes of near-identical, incrementally-varied queries directed at an AI model API. This behavior is indicative of a black-box adversarial optimization loop, where an attacker attempts to infer model vulnerabilities, bypass safety filters, or perform model evasion by observing how slight input variations change model responses.
This rule detects high volumes of near-identical, incrementally-varied queries directed at an AI model API. This behavior is indicative of a black-box adversarial optimization loop, where an attacker attempts to infer model vulnerabilities, bypass safety filters, or perform model evasion by observing how slight input variations change model responses.
This rule detects high volumes of near-identical, incrementally-varied queries directed at an AI model API. This behavior is indicative of a black-box adversarial optimization loop, where an attacker attempts to infer model vulnerabilities, bypass safety filters, or perform model evasion by observing how slight input variations change model responses.
This rule detects high volumes of near-identical, incrementally-varied queries directed at an AI model API. This behavior is indicative of a black-box adversarial optimization loop, where an attacker attempts to infer model vulnerabilities, bypass safety filters, or perform model evasion by observing how slight input variations change model responses.
This rule identifies network connections or event logs originating from known residential and anonymous proxy providers, including Nodemaven, DataImpulse, Luminati (Bright Data), ProxyRack, Shifter, SOAX, and Yilu. Adversaries frequently use these proxy services to mask their true origin, evade IP-based geolocation blocks, and conduct malicious activity while blending in with legitimate traffic.
Detects a multi-stage sequence of network connections to Microsoft cloud services (login.microsoftonline.com, graph.microsoft.com, and data exfiltration endpoints like sharepoint.com) consistent with Storm-3121/Storm-3032 adversary activity. This rule is designed for IDS/IPS monitoring of traffic patterns indicating authentication, reconnaissance, and potential data exfiltration from Microsoft 365 environments.
Detects a single Azure AD identity successfully authenticating from three or more unique IP addresses within a 24-hour window. This behavior is indicative of infrastructure rotation by threat actors, such as those observed in Storm-3121/Storm-3032 campaigns, intended to evade network-based detection and conditional access controls during reconnaissance or exfiltration phases.
Detects anomalous network traffic patterns where internal assets interact with Microsoft Graph API and Entra ID (login.microsoftonline.com) authentication endpoints from distinct external destination IPs within a short time window. This behavior is indicative of potential attacker infrastructure rotation during C2 or post-authentication phases.
Detects anomalous authentication patterns indicative of session token replay attacks. The rule identifies instances where a user successfully performs an MFA-authenticated, interactive sign-in, followed shortly (within 5-60 minutes) by a single-factor sign-in for the same user. The suspicious activity is characterized by a shift to a different IP/ASN, an unmanaged device (non-trusted), and a change in browser or OS identifiers, all while the user's geolocation (city/country) remains consistent. This behavioral pattern is highly consistent with the use of residential proxy infrastructure to replay stolen session tokens, effectively bypassing MFA.
Detects anomalous authentication patterns indicative of session token replay attacks. The rule identifies instances where a user successfully performs an MFA-authenticated, interactive sign-in, followed shortly (within 5-60 minutes) by a single-factor sign-in for the same user. The suspicious activity is characterized by a shift to a different IP/ASN, an unmanaged device (non-trusted), and a change in browser or OS identifiers, all while the user's geolocation (city/country) remains consistent. This behavioral pattern is highly consistent with the use of residential proxy infrastructure to replay stolen session tokens, effectively bypassing MFA.
Detects anomalous authentication patterns indicative of session token replay attacks. The rule identifies instances where a user successfully performs an MFA-authenticated, interactive sign-in, followed shortly (within 5-60 minutes) by a single-factor sign-in for the same user. The suspicious activity is characterized by a shift to a different IP/ASN, an unmanaged device (non-trusted), and a change in browser or OS identifiers, all while the user's geolocation (city/country) remains consistent. This behavioral pattern is highly consistent with the use of residential proxy infrastructure to replay stolen session tokens, effectively bypassing MFA.
Detects anomalous authentication patterns indicative of session token replay attacks. The rule identifies instances where a user successfully performs an MFA-authenticated, interactive sign-in, followed shortly (within 5-60 minutes) by a single-factor sign-in for the same user. The suspicious activity is characterized by a shift to a different IP/ASN, an unmanaged device (non-trusted), and a change in browser or OS identifiers, all while the user's geolocation (city/country) remains consistent. This behavioral pattern is highly consistent with the use of residential proxy infrastructure to replay stolen session tokens, effectively bypassing MFA.
Page 1 of 2