Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,934
7,265
6,535
3,865
3,645
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
This rule detects email-based phishing attempts that utilize a two-hop open-redirect mechanism by abusing legitimate SaaS platforms (holabrief.com and loopedin.io). It flags emails containing specific redirect links, often used to bypass traditional security filters by redirecting users through trusted domains before reaching a malicious destination.
Detects HTTP requests to the SaaS platforms 'holabrief.com' or 'loopedin.io' that contain common URL redirection parameters, characteristic of an open-redirect abuse tactic used in phishing campaigns. These platforms are leveraged as intermediate hops to obfuscate the final destination of phishing links. The rule identifies the initial request and suggests correlation with subsequent traffic to unknown destinations to confirm a two-hop redirection chain.
Detects phishing emails that spoof specific healthcare domains (nhs.uk, mayoclinic.org, clevelandclinic.org) using invoice or payment-related subjects, characterized by DMARC/DKIM/SPF authentication failures. The detection correlates these emails with a subsequent user network request to known open-redirect or intermediary SaaS platforms (holabrief.com, loopedin.io) within a 10-minute window, indicating a likely credential harvesting or malware delivery sequence.
Detects when an actor searches Slack audit logs, which could indicate an attacker attempting to understand logging capabilities or evade detection. Also detects bulk session resets initiated by an administrator, which may be a response to an account takeover or an attacker attempting to evict legitimate users from their sessions.
Detects new app installations, expansions of OAuth scopes, or the addition of collaborators to Slack applications. These activities can indicate an adversary attempting to gain persistent access, escalate privileges, or exfiltrate data from Slack by leveraging malicious or compromised applications.
Detects MFA factor activation, device enrollment, and password resets originating from residential/commercial proxy infrastructure, often associated with threat groups like BlackFile/UNC6671/Cordial Spider.
Detects MFA factor activation, device enrollment, and password resets originating from residential/commercial proxy infrastructure, often associated with threat groups like BlackFile/UNC6671/Cordial Spider.
Detects anomalous, high-volume npm package publication patterns from a single user account within a 5-minute window. This behavior is indicative of automated worm propagation or supply chain attacks using compromised developer tokens, specifically identified by high-frequency 'publish' events.
Detects unauthorized npm package publication events triggered by specific compromised maintainer accounts (czirker, llxlr) associated with the Miasma/Mini Shai-Hulud supply chain attack campaign, specifically targeting LeoPlatform or Verana Blockchain related packages.
This rule correlates a user logging in from a new ISP and immediately navigating to HR/Payroll URIs (specifically Workday or ADP) to modify direct deposit data. The detection logic joins Azure AD sign-in events with Cloud App Security events, filtering for interactive logins and page accesses to specific HR/Payroll URLs containing 'direct-deposit'. It also excludes known corporate IP addresses and requires the HR/Payroll access to occur within 30 minutes of the login.
Detects a user who interacted with a code-of-conduct lure subsequently authenticating through an anonymous proxy or anonymisation service. This rule correlates URL click events or sign-in events with subjects related to 'code of conduct' or 'policy acknowledgement' and then checks if the subsequent authentication occurred via an anonymous proxy.
Detects MFA fatigue attacks where a user receives more than 10 MFA push denials within a 10-minute window, followed immediately by a successful authentication from a different IP address. This behavior is indicative of an adversary bombarding a user with push notifications until they are approved, followed by account takeover.
This rule detects a potential data collection or exfiltration attempt in Microsoft Teams by identifying accounts that have accessed an abnormally high number of messages (more than 100 within a 5-minute window). This behavior may indicate an automated process or a compromised user account attempting to scrape internal communications.
This rule detects a potential data collection or exfiltration attempt in Microsoft Teams by identifying accounts that have accessed an abnormally high number of messages (more than 100 within a 5-minute window). This behavior may indicate an automated process or a compromised user account attempting to scrape internal communications.
Detects stolen session token reuse to bypass MFA by correlating a successful SSO/VPN login from one IP with a subsequent successful login from a different IP using the same user agent context, or a user-agent change between sessions for the same user within a short window. Targets access broker technique where infostealer-harvested session cookies are replayed from different source IPs.
Detects stolen session token reuse to bypass MFA by correlating a successful SSO/VPN login from one IP with a subsequent successful login from a different IP using the same user agent context, or a user-agent change between sessions for the same user within a short window. Targets access broker technique where infostealer-harvested session cookies are replayed from different source IPs.
Detects a Google account completing an OAuth or MFA challenge and then generating a new session from a different client fingerprint (different source IP or user agent) within a 10-minute window. This behavior can indicate a session hijack or an adversary bypassing MFA.
This rule monitors GitHub repository activity (git.push, git.clone, repo.contents) to identify specific activity patterns associated with known GitHub usernames, email addresses, or specific repository paths (e.g., tools/setup, .github/scripts/precheck) and commit messages. It flags potentially significant actions such as forced pushes to default branches for review.
Detects instances where a user successfully authenticates from a mobile device (Android or iPhone) that exhibits a geographic mismatch (geo_country vs registered_country), and subsequently performs a sensitive credential or MFA-related action (enrollment or reset) from a different device within one hour. This pattern is indicative of a potential session hijacking or credential compromise where an attacker attempts to establish persistence by enrolling their own MFA device.
Detects anomalous activity consistent with the IronWorm threat actor using compromised CI credentials to perform npm package publishing. The rule identifies a sequence of two events from the same source IP within a 10-minute window: first, an OIDC identity token exchange request at the npm registry, followed by a package publish operation (PUT request). This behavior is characteristic of malicious actors hijacking CI/CD pipelines to inject malicious code into trusted npm packages.
Detects successful (HTTP 200) requests to ServiceNow API endpoints (/api/now/) that lack proper authentication, such as requests by the 'guest' user or requests missing authorization headers or session tokens.
Page 112 of 142