Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,934
7,265
6,535
3,865
3,645
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects administrative mail, forwarding, or content compliance rule changes performed from an IP address classified as an anonymous proxy. This behavior is often associated with threat actors like UNC6508, who use obfuscation networks and proxies to access administrator accounts and exfiltrate data.
Detects GitHub Actions workflow files that include 'id-token: write' permissions in conjunction with 'npm publish' or 'yarn publish' commands. This pattern is indicative of the Miasma worm (also known as the wshu.net campaign) which abuses OIDC trusted publishing to facilitate unauthorized npm package propagation. The rule also identifies workflows that attempt to fallback on legacy NPM_TOKEN secrets.
This rule detects anomalous access to cloud services, specifically Salesforce, Drift, Salesloft, HubSpot, and Marketo, that may indicate OAuth token abuse. It identifies scenarios where a high volume of actions (8 or more) occur within a short timeframe (3 hours or less) from a single IP address but with multiple unique user agents (2 or more). The detection is further refined by looking for actions related to 'Add delegated permission grant' or 'Create service principal', which are indicative of an attacker attempting to establish persistence or escalate privileges after gaining access through a compromised OAuth token.
This rule detects the creation of Okta API tokens with broad administrative scopes (okta.users.manage, okta.factors.manage, or okta.apps.manage) by the same user multiple times within a one-hour window. This behavior can indicate an attempt to establish persistent access or bypass multi-factor authentication.
This rule detects an unusually high volume of operations related to GitHub Enterprise repositories, such as adding users, creating teams, pushing to repositories, or changing permissions, within a short timeframe. This could indicate a compromised account or automated malicious activity targeting source code repositories.
This rule monitors GitHub audit logs for potentially malicious activities in repository management and CI/CD workflows. It detects suspicious commits by specific maintainers, impersonation of the Dependabot bot, usage of non-standard snapshot branch naming conventions, execution of unauthorized workflows, and specific commit message patterns indicative of unauthorized system modifications or testing.
Detects an anomalous volume of NPM package publications by specific users associated with internal naming conventions (leo-*, @leoplatform/*, verana-blockchain*). The rule identifies potential supply chain compromise attempts by monitoring for burst activity (3+ publishes or 3+ unique packages within a 10-second window).
Detects a successful multifactor authentication followed within minutes by another successful sign-in for the same account from a different IP address and user agent. This pattern can indicate an adversary has bypassed MFA, potentially through techniques like AiTM phishing, and is attempting to use the compromised session.
This rule detects network communication with infrastructure associated with the 'EvilTokens' phishing kit, specifically targeting Microsoft OAuth device code API endpoints (/api/device/*) hosted on workers.dev. This behavior is indicative of an adversary conducting device code phishing (a form of AitM attack) to obtain unauthorized access tokens.
Detects unauthenticated ServiceNow Scripted REST Resource access attributed to Guest user or known attacker IP 51.159.98.241
This rule detects potential OAuth token abuse by correlating credential consent grants with subsequent unusual cloud access patterns from different geographic locations. It looks for activities like adding a service principal, adding OAuth2 permission grants, or consenting to an application, followed by access to specific cloud applications (Salesforce, Drift, Slack, Microsoft 365, Workday) from an IP address that does not match the IP address from which the consent was granted. The rule aggregates these events and triggers if there are at least 4 related events within a 6-hour window.
This rule looks for sensitive-looking values appearing in a publicly visible Claude workflow summary on GitHub. Public summaries can be indexed and copied quickly. Revoke any exposed credentials and restrict summary visibility. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Identifies login_verification events completing in less than 1 second, strongly indicative of automated AiTM proxying.
Detects Google Workspace OAuth authorizations requesting the Chrome native client ID, which has been observed to be used by threat actors like Tycoon 2FA to mint tokens for illicit access.
Detects the uploading of a plugin matching known disguised slugs ('content-delivery-helper' or 'database-optimizer') used by attackers to install backdoors after establishing a rogue admin account in WordPress environments. This rule specifically targets POST requests to the WordPress plugin update endpoint with these malicious plugin names in the query string.
Detects modifications or deletions of Conditional Access policies in an environment. This includes disabling policies or altering key configurations like users, groups, applications, platforms, or locations, which could be indicative of an attacker attempting to bypass security controls or maintain persistent access.
This rule detects an unusually high volume of operations related to GitHub Enterprise repositories, such as adding users, creating teams, pushing to repositories, or changing permissions, within a short timeframe. This could indicate a compromised account or automated malicious activity targeting source code repositories.
Detects bulk export of CRM customer data for collection and theft
Detects suspicious commits pretending to be the Claude AI bot but pushing dependency updates, a tactic Miasma uses to blend in with legitimate automated pull requests.
Detects authentication events originating from Microsoft Authentication Broker or OfficeHome using Node.js associated user agents, which are indicative of the Tycoon 2FA kit relay infrastructure. This activity suggests an Adversary-in-the-Middle (AiTM) attack attempting to bypass multi-factor authentication.
Detects OAuth application registration or permission grant via Graph API
Page 115 of 142