Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,932
7,263
6,535
3,865
3,643
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
This rule detects potential credential stuffing or password spraying attacks against Okta by monitoring for a high volume of failed primary authentication attempts from a single source IP address or ASN within a one-hour window. It also incorporates corroborating evidence such as account lockouts, Okta ThreatInsight detections, and blocked requests. The rule surfaces both failed attempts and successful logins that might indicate a compromised account.
This rule detects potential session hijacking or token replay attacks against Okta by identifying a single Okta session (externalSessionId) being used from multiple distinct origins. It specifically looks for divergence in client country, device hash (dtHash), or operating system within the same session, rather than just multiple IP addresses, to reduce false positives. This behavior is indicative of a stolen post-MFA cookie being replayed by an attacker.
Detects the creation or modification of Power Automate flows that connect to external services commonly used for data exfiltration or command and control, such as webhooks, Gmail, Dropbox, Google Drive, Slack, RSS feeds, custom connectors, or generic HTTP requests/webhooks. This could indicate an adversary attempting to establish persistence or exfiltrate data from the Power Platform environment.
This rule detects when a user performs a security investigation query within Google Workspace using the Security Investigation Tool. It extracts the user's UPN, the data source being investigated, and the query itself. This can help identify potential insider threat activity, unauthorized investigations, or unusual administrative behavior.
This rule detects a suspicious sequence of events in Okta that could indicate a help-desk social engineering attack or account takeover. Specifically, it looks for a user's password being reset, followed by the enrollment of a new MFA factor or device for that same user, all occurring within a short time frame (1 hour) and potentially from distinct session IDs or device hashes. This pattern suggests an attacker has gained initial access (e.g., via social engineering the help desk) and is immediately attempting to establish persistence by enrolling their own MFA device.
Detects when OAuth applications are added to trusted lists or granted Context-Aware Access (CAA) exemptions within Google Workspace. This activity bypasses user consent screens and CAA policies, potentially allowing malicious applications to gain unauthorized access. The rule also tracks permission escalation for existing applications via 'CHANGE_APP_ACCESS' events.
This rule detects suspicious GitHub workflow modifications or pushes originating from multiple distinct IP addresses within a short time frame (1 hour). It specifically looks for 'WorkflowCreated', 'WorkflowUpdated', or 'Push' actions on GitHub, and triggers if more than one such event and more than one distinct IP address are observed for a given account within an hour. This could indicate compromised credentials or unauthorized access to a GitHub account being used to manipulate CI/CD pipelines.
This rule detects attempts to grant consent to OAuth applications, which could indicate an illicit consent grant attack. It specifically looks for successful operations related to consenting to applications, adding app role assignments to service principals, adding delegated permission grants, or adding OAuth2PermissionGrants within audit logs. The rule extracts details such as the target application, the user who consented, their initiating IP address, and the permissions granted.
This rule detects potential GitHub token theft or abuse activity by identifying GitHub tokens that are used from an unusually high number of distinct IP addresses or for an unusually high number of uses within a one-hour window. Specifically, it looks for tokens with more than 5 uses and more than 2 distinct IP addresses in an hour. This behavior could indicate that a compromised token is being used by an attacker from multiple locations or in an automated fashion.
Detects the creation of email forwarding rules in Google Workspace that direct emails to external domains. This activity can indicate potential Business Email Compromise (BEC) for persistence or insider data exfiltration.
Identifies suspicious token authorizations for the Google Chrome OAuth client. Tycoon 2FA operators frequently use this specific client and scope to proxy authentications and capture session cookies. In a complete attack sequence, this event occurs within a 1-second window alongside a login_success and a device registration event.
Microsoft Teams External Link Phishing
Cortex XDR
Detects malicious URLs sent via Microsoft Teams direct messages that contain known phishing Top-Level Domains (TLDs). The rule specifically looks for messages in one-on-one chats containing external links with TLDs commonly associated with phishing, such as '.ru', '.dev', '.xyz', and others, which could indicate Phishing-as-a-Service (PhaaS) infrastructure or device code lure paths.
Detects suspicious app installations, custom app creation, and bot additions in Microsoft Teams. This includes sideloaded apps, which can bypass Teams store vetting and be used for persistence, custom app creation outside of development teams, which may indicate C2 bots or data exfiltration, and the addition of bots with suspicious names. The rule also flags operations like AppShared and TabAdded as medium risk.
Detects the export of Microsoft Teams messages, transcripts, recordings, and chat retrieval activities, particularly when performed via the Graph API. This rule identifies suspicious activity by looking for specific operation names in SaaS audit logs from Microsoft Teams and flags user agents commonly associated with automation tools (e.g., python-requests, axios, go-http, curl, wget, powershell, httpx, aiohttp, node) which could indicate post-compromise attackers using stolen tokens to silently export chat history.
Detects the creation or modification of GitHub Actions workflow files designed to dump and exfiltrate repository secrets, a technique observed in the Mini Shai-Hulud supply chain attack. This rule specifically looks for file events in GitHub Actions workflow directories combined with command-line patterns indicative of secret exfiltration or the creation of a specific malicious workflow file ('codeql_analysis.yml') by scripting interpreters.
Box SaaS Suspicious File Upload
Cortex XDR
Detects suspicious file uploads to Box indicating potential data staging, tool upload, or exfiltration via shared folders. This rule specifically looks for the 'UPLOAD' operation within Box SaaS audit logs and extracts various file and user-related details.
Detects when an application is published or updated in the Microsoft Teams app catalog. This activity could indicate malicious app deployment, supply chain tampering via catalog abuse, or unauthorized application changes.
Box SaaS Suspicious File Download
Cortex XDR
Detects file downloads from Box which could indicate potential data exfiltration by insiders or compromised accounts. This rule specifically looks for 'DOWNLOAD' operations within Box SaaS audit logs.
Detects suspicious sharing activity in Box, including the creation of open links, external collaboration invites, role escalation, and weakening of sharing policies. This rule identifies high-risk activities such as making files publicly visible without password protection, inviting external users with co-owner or editor roles, and changes that reduce security like removing expiration dates on shared links.
Detects the creation or modification of GitHub Actions workflow files designed to dump and exfiltrate repository secrets, a technique observed in the Mini Shai-Hulud supply chain attack. This rule specifically looks for file events in GitHub Actions workflow directories combined with command-line patterns indicative of secret exfiltration or the creation of a specific malicious workflow file ('codeql_analysis.yml') by scripting interpreters.
Detects AiTM compromise where user click phishing URL, completed MFA, and signed in from a different IP within 10 minutes
Page 117 of 142