Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,866 detections
Filters
Last updated
All Time
Detection languages
2,525
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,091
792
575
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
1,755
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Detects anomalous automated enumeration of Microsoft Graph API user objects followed by keyword-based searches for sensitive HR, finance, and payroll-related information. This pattern is characteristic of post-compromise reconnaissance activities where an attacker leverages an existing session token to identify targets for further data exfiltration.
Detects modifications to Azure AD domain federation settings or authentication methods that could indicate attempts to establish persistent access or bypass authentication controls (e.g., golden SAML attacks, domain-level backdoors). The rule monitors for successful operations related to domain federation, authentication changes, and domain management, excluding known administrative actions from internal Microsoft domains.
Detects a user or application issuing a high volume of Microsoft Graph user directory requests within ten minutes, consistent with tenant reconnaissance. This rule specifically looks for GET requests to the /v1.0/users endpoint of the Microsoft Graph API, indicating an attempt to enumerate user accounts.
Detects the execution of known ransomware-related executables ('servertool.exe', 'encrypt.exe') when their command line arguments indicate interaction with cloud storage services such as OneDrive, SharePoint, GoogleDrive, Dropbox, or iCloud. This behavior is indicative of ransomware attempting to encrypt or exfiltrate data from cloud environments.
Detects creation and deletion of an Azure SQL firewall rule by the same caller within a short window, which can provide temporary database access while reducing later evidence. This behavior is often indicative of an adversary attempting to gain temporary access to a database, perform actions, and then remove their tracks by deleting the firewall rule.
Detects attempts to generate SQL injection payloads by abusing Ollama servers, specifically targeting unauthenticated HTTP POST requests to /api/generate or /api/chat on port 11434. The rule looks for SQL injection indicators and VAPT framework specific strings within the request context, URI, or user agent.
Detects sign-ins by Global Administrators using a Temporary Access Pass (TAP) to the Azure Portal. This activity is indicative of potential credential abuse, especially in cross-tenant scenarios, as TAP can bypass MFA. The rule identifies instances where a Global Administrator role is assigned or where a user with 'globaladmin' in their UPN signs in with a TAP.
Detects responses from vLLM (or similar services) that leak a Python Imaging Library (PIL)/Pillow heap address through BytesIO exception text. This indicates Stage 1 of the CVE-2026-22778 ASLR bypass vulnerability, where memory addresses are exposed, which could be used by an attacker to bypass Address Space Layout Randomization (ASLR). The rule looks for specific error messages containing '_io.BytesIO object at 0x' followed by a hexadecimal address.
This rule detects suspicious activity related to GitHub Actions workflows, including the creation or modification of workflow configuration files, the placement of suspicious JavaScript files in the repository's .github directory, the execution of the 'Bun' runtime within an Actions runner environment, and cloud-based events indicating workflow modification containing 'Run Copilot' strings. These patterns are often associated with CI/CD pipeline compromise, malicious automation, or unauthorized code execution within build environments.
Detects an unusually high frequency of storage blob and container listing operations within a short time window. This behavior often indicates an attempt to enumerate the contents of Azure Blob Storage, which may be a precursor to data discovery or exfiltration.
Detects the modification of Azure Storage account management policies where the 'daysAfterModificationGreaterThan' condition is set to 7 days or less, specifically including a 'delete' action. This could indicate an attempt by an adversary to shorten the lifecycle of data for rapid, automated, and potentially malicious data destruction within Azure Blob Storage.
This rule detects potential Business Email Compromise (BEC) attempts by identifying emails containing financial keywords sent to sensitive finance/accounting roles from domains that have not been observed in the last 180 days. It then correlates this email event with subsequent device-level network activity involving banking or financial URLs initiated by the recipient user, which may indicate follow-up reconnaissance or unauthorized access.
This rule detects the use of common cloud command-line interfaces (Azure CLI, Azure PowerShell, and AWS CLI) to perform resource discovery, specifically identifying commands used to list virtual machines or describe EC2 instances. Such activity, if performed by an unexpected user or on an endpoint where cloud management tools are not typically installed, may indicate reconnaissance by an adversary.
Detects low-and-slow password spraying activity against Entra ID by identifying a single source IP generating authentication failures (AADSTS50126) across multiple distinct accounts within a short window. This technique is used to obtain valid credentials for subsequent Microsoft Graph token abuse via hidden Conditional Access policy exclusions (CVE-2025-0309).
Detects the execution of remote commands on cloud virtual machines (Azure RunCommand or AWS SSM SendCommand) during defined off-hours (18:00 to 06:00). This rule identifies potentially unauthorized administrative or management activity occurring outside of standard business hours across cloud environments.
Detects suspicious OAuth application or service principal registration, or permission consent, performed by users who are not part of designated IT administrator groups. This rule flags high-privilege permission grants (e.g., Mail.Read, Directory.ReadWrite.All) or application consent events, which are common methods for establishing long-term persistence in cloud environments.
Detects processes attempting to query the Cloud Instance Metadata Service (IMDS) endpoint (169.254.169.254) that are not recognized as legitimate cloud agent software (such as AWS, Azure, or Google cloud agents). This behavior is often indicative of SSRF or unauthorized discovery attempts by an adversary on a compromised cloud instance.
Detects processes attempting to query the Cloud Instance Metadata Service (IMDS) endpoint (169.254.169.254) that are not recognized as legitimate cloud agent software (such as AWS, Azure, or Google cloud agents). This behavior is often indicative of SSRF or unauthorized discovery attempts by an adversary on a compromised cloud instance.
This rule detects potential automated credential stuffing attempts followed by successful authentication and subsequent access to sensitive/privileged APIs within Azure/Entra ID environments. It correlates multiple failed login attempts for service-oriented account names (e.g., svc, api, bot) with a successful login from the same user shortly thereafter, followed by privileged API operations (e.g., KeyVault secret access, user management) within a short time window.
Detects a browser session that contacts an EvilTokens Device Code phishing endpoint (/api/device/status/) and then immediately navigates to onedrive.live.com, indicating the attacker backend returned status:completed and the kit executed window.location.replace to redirect the victim to OneDrive after token capture. This sequence suggests a successful device code phishing attack where the victim's credentials or tokens have been captured, and they are then redirected to a legitimate service to avoid suspicion.
This rule detects successful user sign-ins from anomalous IP addresses, indicative of an Adversary-in-the-Middle (AiTM) reverse proxy attack. It correlates successful logins with the receipt of a phishing email containing specific subject keywords ('Code of Conduct') within a two-hour window, suggesting that the login was a direct result of the phishing lure.
Page 110 of 185