Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,916 detections
Filters
Last updated
All Time
Detection languages
2,236
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
805
765
576
Platforms
1,843
1,022
856
814
656
Products / Services
988
596
477
456
383
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
4,916
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
Detects users authenticating to SAP via Dialog Logons from IP addresses that are outside of approved network ranges and RFC1918 internal networks, potentially indicating unauthorized or external access.
Detects failed internal SAP logon attempts (AU2) targeting an invalid or non-existent client, indicating potential misconfiguration or an unauthorized access probe.
Detects successful or failed logon activity by a privileged SAP account on a production system using SAP Security Audit logs.
Detects multiple distinct SAP users authenticating successfully from a single source IP address within a short time window (30 minutes), potentially indicating compromised credentials or shared access anomalies.
Detects a successful device-code sign-in whose session is replayed successfully within 60 minutes from a different IP and ASN. Only successful replays count (interrupt codes removed) and Microsoft first-party ASN egress is excluded.
Detects inbound emails featuring Spanish government and COVID-19 themes in the subject or sender display name, which contain URLs pointing to domains resembling Amnesty International or various media organizations, indicating potential phishing or social engineering campaigns.
Detects inbound emails featuring Spanish government and COVID-19 themes in the subject or sender display name, which contain URLs pointing to domains resembling Amnesty International or various media organizations, indicating potential phishing or social engineering campaigns.
Detects inbound emails featuring Spanish government and COVID-19 themes in the subject or sender display name, which contain URLs pointing to domains resembling Amnesty International or various media organizations, indicating potential phishing or social engineering campaigns.
Detects inbound emails featuring Spanish government and COVID-19 themes in the subject or sender display name, which contain URLs pointing to domains resembling Amnesty International or various media organizations, indicating potential phishing or social engineering campaigns.
This analytic detects the usage of the Azure CLI to interact with user accounts such as creating or deleting a user.
Adversaries create new users so that their malicious activity does not interrupt the normal functions of the compromised users and can remain undetected.
While legitimate administrative use is expected, anomalous execution patterns, unexpected users, or unusual parent processes should be treated as potential indicators of compromise and investigated promptly.
Adversaries create new users so that their malicious activity does not interrupt the normal functions of the compromised users and can remain undetected.
While legitimate administrative use is expected, anomalous execution patterns, unexpected users, or unusual parent processes should be treated as potential indicators of compromise and investigated promptly.
Detects an unauthenticated remote code execution attempt against AhsayCBS via the UpdateReceivers.do endpoint using the checkSysPwd parameter, associated with CVE-2026-105133 and CVE-2026-105134.
Detects an unauthenticated remote code execution attempt against AhsayCBS via the UpdateReceivers.do endpoint using the checkSysPwd parameter, associated with CVE-2026-105133 and CVE-2026-105134.
Builds a per-account baseline of the devices that each enabled service account has made a successful network logon to over the previous 30 days, then alerts when one makes a successful network logon to a device outside that baseline within the latest window.
Service accounts are identified from IdentityInfo using each account’s most recent recorded type and enabled status, and are matched to logon events by their on-premises SID, so local accounts or accounts in other domains that share the same name are not mistaken for them. Accounts with no logon history in the baseline period are still evaluated, so a dormant service account that suddenly begins making network logons will alert on every device it reaches.
Service accounts tend to touch a small, fixed set of hosts, so a per-entity first-seen check is a strong lateral movement signal with less noise than the same logic applied to users.
Each result is enriched with the number of times the destination device’s sensor reporting restarted during the alert window, along with the times of those restarts in UTC, as restarts close to the new logons often indicate maintenance activity such as patching, although they should prompt a check to confirm rather than closure of the alert.
The rule runs every 24 hours, as this is the only Defender custom detection frequency with a 30-day lookback, and the alert window covers the last 25 hours so that a slightly delayed run does not leave a gap.
The baseline and alert windows are separated by ingestion time rather than event time, so events that arrive late are still evaluated.
Service accounts are identified from IdentityInfo using each account’s most recent recorded type and enabled status, and are matched to logon events by their on-premises SID, so local accounts or accounts in other domains that share the same name are not mistaken for them. Accounts with no logon history in the baseline period are still evaluated, so a dormant service account that suddenly begins making network logons will alert on every device it reaches.
Service accounts tend to touch a small, fixed set of hosts, so a per-entity first-seen check is a strong lateral movement signal with less noise than the same logic applied to users.
Each result is enriched with the number of times the destination device’s sensor reporting restarted during the alert window, along with the times of those restarts in UTC, as restarts close to the new logons often indicate maintenance activity such as patching, although they should prompt a check to confirm rather than closure of the alert.
The rule runs every 24 hours, as this is the only Defender custom detection frequency with a 30-day lookback, and the alert window covers the last 25 hours so that a slightly delayed run does not leave a gap.
The baseline and alert windows are separated by ingestion time rather than event time, so events that arrive late are still evaluated.
Sweeps Defender XDR telemetry for known NEBULA / KNTRAT indicators (SHA256 hashes, C2 IP, decoy domain and URLs, burner publisher emails). Hash matching is scoped per table (execution hash only in process events), noisy tooling is excluded from command-line matches, network hits are limited to connection events, and results are aggregated per device and IOC.
Sweeps Defender XDR telemetry for known NEBULA / KNTRAT indicators (SHA256 hashes, C2 IP, decoy domain and URLs, burner publisher emails). Hash matching is scoped per table (execution hash only in process events), noisy tooling is excluded from command-line matches, network hits are limited to connection events, and results are aggregated per device and IOC.
Correlates a delivered PDF attachment with the same user's browser visiting Mir0Auth C2-style paths within 4 hours. Restricted to browser processes and successful connections, excludes dev/code-hosting domains, and matches users by mailbox alias (DeviceInfo LoggedOnUsers holds UserName, not full email).
Detects the Mir0Auth phishing kit sequence within a single HTTP flow: POST /task_queue.cs beacon followed by POST /context.go device-code request, both with application/octet-stream bodies. Requires both requests (flowbits) and exact path endings to limit false positives. SIDs made unique.
Detects the Mir0Auth phishing kit sequence within a single HTTP flow: POST /task_queue.cs beacon followed by POST /context.go device-code request, both with application/octet-stream bodies. Requires both requests (flowbits) and exact path endings to limit false positives. SIDs made unique.
Detects a successful device-code sign-in whose session is replayed successfully within 60 minutes from a different IP and ASN. Only successful replays count (interrupt codes removed) and Microsoft first-party ASN egress is excluded.
Detects a successful device-code sign-in whose session is replayed successfully within 60 minutes from a different IP and ASN. Only successful replays count (interrupt codes removed) and Microsoft first-party ASN egress is excluded.
Detects an unauthenticated remote code execution attempt against AhsayCBS via the UpdateReceivers.do endpoint using the checkSysPwd parameter, associated with CVE-2026-105133 and CVE-2026-105134.
Page 11 of 235