Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,934
7,265
6,535
3,865
3,645
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
This rule detects two suspicious activities within a user's mailbox: (1) An email flood, where a recipient receives more than 500 emails within a 5-minute window, potentially indicating an attempt to overwhelm or hide secondary emails; and (2) The creation or modification of inbox rules that include actions like deleting or moving messages, which is a common persistence and evasion technique used by attackers to hide C2 or phishing communications.
Detects HTTP GET requests to the /api/device/gate/ path, a specific behavior associated with EvilTokens phishing kits. Attackers use this gate check endpoint to identify and potentially burn active phishing sessions for security researchers or automated scanners.
Detects web traffic containing HTTP 301/302 redirects to known cloud hosting platforms (Azure, AWS, Cloudflare) that exhibit suspicious URL patterns or originate from identified malicious referrers associated with phishing or credential harvesting campaigns.
Detects incoming phishing emails that impersonate healthcare-related organizations. The detection identifies malicious activity by matching common healthcare-themed domain patterns in the From header, coupled with email authentication failures (DMARC or DKIM), and a mismatch between the envelope sender and the header From address. It also monitors for invoice-themed subject line lures commonly used in social engineering.
Detects unauthorized privilege escalation attempts within the MyBB Admin Control Panel (ACP). The rule identifies HTTP POST requests, likely generated by a limited-privilege account, that attempt to create a new user with Administrator permissions (gid=4) or modify an existing user's group assignment to the Administrator group, bypassing standard ACP permission controls.
This rule detects a burst of Okta Multi-Factor Authentication (MFA) push prompts to a single user within a short time window, indicating a potential MFA bombing or fatigue attack. It specifically looks for scenarios where at least 5 push notifications are sent, and at least one is approved, suggesting the user might have caved under pressure. The rule also enriches the data with client IP, geographical context, and proxy information to aid investigation.
Detects non-interactive Microsoft Graph OAuth2 token requests originating from unmanaged, deviceless sessions that falsely claim MFA satisfaction. The detection focuses on specific user agents known to be associated with automated token replay attacks and looks for multiple unique token identifiers per user session, which is indicative of credential or token theft rather than standard service account or application activity.
Detects the addition of users to specific high-value or sensitive groups in Microsoft Entra ID (Azure AD), which could indicate potential unauthorized privilege escalation or persistence attempts by an attacker.
Detects non-interactive OAuth2 token refresh attempts targeting Microsoft 365 services where the authentication is satisfied by a pre-existing session without MFA challenge. The rule flags instances where the sign-in originates from an IP address with a different ASN or country than the user's previous interactive session and uses specific browser user-agents identified in known Adversary-in-the-Middle (AiTM) campaigns like the Payroll Pirate.
This rule detects Adversary-in-the-Middle (AiTM) session hijacking against Microsoft 365, specifically targeting the Tycoon 2FA phishing kit (associated with campaigns like Payroll Pirate). It correlates two distinct malicious behaviors: the initial MFA capture phase (involving specific error codes and spoofed user agents) and subsequent illicit token replay against the Microsoft Graph API from unmanaged devices.
Detects unauthenticated HTTP POST requests targeting Oracle PeopleSoft PSEMHUB and PSIGW endpoints that are characteristic of the CVE-2026-35273 remote code execution exploit gadget chain.
Detects a specific sign-in sequence indicative of a Payroll Pirate adversary-in-the-middle (AiTM) attack. The pattern involves a Microsoft Outlook interactive sign-in resulting in a 50199 error (Login:reprocess) followed within 10 minutes by a Cmsi:cmsi authentication attempt, both originating from the same user and the specific user-agent Firefox 142.0. This behavior is associated with 2FA proxying techniques where the attacker captures and replays session information.
This rule detects failed Microsoft 365 sign-in attempts on the OfficeHome application associated with error code 90014, indicating a malformed or missing credential payload. The detection specifically triggers when these failures originate from an iPhone/iOS user-agent. This behavior is indicative of the reconnaissance phase of the Payroll Pirate campaign (associated with threat actor Storm-2755), where attackers use mobile-simulated browsers from carrier IP ranges to probe authentication endpoints before deploying Adversary-in-the-Middle (AiTM) kits.
Detects real-time Multi-Factor Authentication (MFA) OTP relay, commonly associated with Adversary-in-the-Middle (AitM) phishing frameworks like Bluekit. The rule flags successful sign-ins where MFA methods (SMS, TOTP, or Authenticator app) are completed with an abnormally low latency (under 10 seconds), suggesting automated relay, or where discrepancies exist in session context indicative of proxy-based interception.
Detects users who modify their MFA settings (registration/update/delete) and subsequently perform privileged actions (such as adding role members or service principal credentials) within a short timeframe, while simultaneously observed active in communication applications like Teams, Zoom, or Webex. This behavior is indicative of potential account takeover where an adversary modifies authentication methods to gain persistent access, followed by privilege escalation.
Detects a high volume of file uploads (greater than 50) to OneDrive or SharePoint by a single user within a 5-minute window, potentially indicating bulk exfiltration of data.
Detects any modification (add, update, or delete) to Entra ID cross-tenant access settings. Adversaries may manipulate these trust configurations to weaken inbound security restrictions, establish unauthorized access between tenants, or facilitate cross-tenant impersonation.
Detects bulk file access, download, or sync operations by a single user account within a 30-minute window in Microsoft SharePoint Online or OneDrive for Business. This behavior is indicative of potential data exfiltration or unauthorized mass collection of sensitive information.
This rule identifies potential session hijacking or session replay attacks by detecting successful logins from the same user account using the same User-Agent string but originating from different source IP addresses within a one-hour window. This behavior is indicative of an attacker replaying stolen session cookies, effectively bypassing Multi-Factor Authentication (MFA) requirements associated with initial authentication.
Inbox Rule Notification Suppression
Cortex XDR
Detects the creation or modification of inbox rules designed to hide security and MFA notifications by deleting, marking as read, or moving them to hidden folders. This technique is commonly used post-compromise to suppress alerts about rogue device enrollment, sign-ins, or password changes, preventing the victim from discovering an account takeover. It is a frequent persistence technique in Business Email Compromise (BEC) and Account Takeover (ATO) attacks.
Detects a successful multifactor authentication followed within minutes by another successful sign-in for the same account from a different IP address and user agent. This pattern can indicate an adversary has bypassed MFA, potentially through techniques like AiTM phishing, and is attempting to use the compromised session.
Page 108 of 142