Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,931
7,261
6,535
3,864
3,642
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects impossible travel authentication patterns where a user logs in from two geographically distant locations within a short time frame, while specifically filtering for sessions that reuse existing refresh or session tokens instead of performing fresh interactive authentication.
Detects potential account compromise by aggregating multiple high-fidelity indicators of adversary activity for a single user within a 72-hour window. The rule triggers when at least three distinct stages of an attack chain are identified, specifically: credential theft/infostealer activity, anomalous sign-in (token reuse/impossible travel), mailbox or OAuth configuration changes, and mass data exfiltration.
Detects anomalous, high-volume account enumeration against the Microsoft Self-Service Password Reset (SSPR) endpoint from a single source IP. The rule identifies a pattern of mixed response codes, specifically interleaving '50034' (Account does not exist) with successful or other outcomes, which indicates the use of automated tools to validate the existence of corporate accounts via response differentiation.
Detects incoming HTTP POST requests to internal AI/LLM API endpoints containing common prompt injection strings, such as instructions to ignore previous system prompts or attempts to trigger jailbreak modes like 'DAN'.
Detects potential password spraying activity in Azure Active Directory by identifying a single source IP address that authenticates against multiple distinct user accounts within a short time frame. The rule flags instances where there are numerous authentication attempts across many users, characterized by a low per-user failure count followed by at least one successful authentication, which is indicative of a successful password spray attempt.
Detects anomalous access to the SharePoint WebPartPages.asmx SOAP endpoint, specifically using the GetWebPartPageConnectionInfo method. This query identifies patterns consistent with the exploitation of CVE-2026-65660, where adversaries attempt to smuggle WebPart template markup (e.g., <%@ Register, XamlServices) after legitimate preview methods have been disabled.
This rule monitors for the addition of new credentials (secrets) to service principals or applications in an Azure/Entra ID environment. It then correlates this event with subsequent mailbox activity (such as accessing mail items, sending mail, or message binding) performed by the application within 7 days of the credential creation. This detection pattern is indicative of potential OAuth application-based persistence and mailbox data exfiltration.
Detects a sequence of potentially malicious local command execution (via PowerShell, cmd, or mshta) that mirrors the 'ClickFix' social engineering pattern, followed by an OAuth application consent grant or device-code authorization by the same user within a short timeframe. This behavior is indicative of an adversary attempting to bypass MFA by tricking a user into authorizing a malicious application after establishing local execution on their endpoint.
Detects instances where a user grants OAuth application permissions to an unverified third-party application. The rule specifically monitors for high-privilege scopes such as Mail.Read, Files.ReadWrite.All, or full_access_as_app, which are commonly abused in illicit consent grant attacks to achieve persistent access to sensitive mailbox and cloud data.
This rule detects potential data exfiltration by correlating access to files labeled as sensitive (confidential, restricted, etc.) with a subsequent upload to a personal cloud storage provider or transmission via email to a personal domain within a two-hour window.
Detects high-risk GitHub events indicating data or asset exposure, such as creating public repositories with specific naming conventions, changing private repositories to public, or creating new gists, which could indicate exfiltration of sensitive assets or information.
Detects a suspicious pattern where an AI coding agent or user creates a public GitHub repository with specific naming conventions (e.g., 'sweeper-demo', 'gitshot-images') and subsequently pushes content containing sensitive terms like 'screenshot' within a short timeframe. This behavior is indicative of potential data exfiltration of internal development screenshots to a public repository.
Detects a suspicious pattern where an AI coding agent or user creates a public GitHub repository with specific naming conventions (e.g., 'sweeper-demo', 'gitshot-images') and subsequently pushes content containing sensitive terms like 'screenshot' within a short timeframe. This behavior is indicative of potential data exfiltration of internal development screenshots to a public repository.
Detects the creation or exposure of public repositories, releases, or gists under a personal GitHub account that utilize naming conventions associated with the 'PixelLeak' workaround. This technique allows adversaries to make previously private screenshots, recordings, or internal assets publicly accessible by hosting them in public personal repositories or releases.
Detects potential account takeover by monitoring identity providers (Azure AD or Okta) for MFA method resets or deletions immediately followed by new MFA method registrations for the same user. This behavior is highly characteristic of Scattered Spider's (Octo Tempest) tactic of social-engineering help-desk staff to perform MFA resets, allowing the adversary to enroll their own device to bypass MFA and maintain persistence.
Detects potential help-desk impersonation or social engineering activity involving account credential or MFA method resets, followed shortly by a sign-in from an unknown device or geography. The rule excludes activity tied to established ticketing systems or standard automated password expiration processes.
Detects potential lateral movement or compromised account use where a single user identity authenticates to multiple distinct cloud or administrative resources within a short time window (15 minutes). The rule uses a threshold of six or more unique applications or resources to identify anomalous patterns typical of reconnaissance or mass resource access often associated with stolen credentials. Administrative, service, and automation-related accounts are excluded to minimize noise.
Detects anomalous use of an LLM provider API key by identifying successful API requests originating from multiple distinct countries within a one-hour time window. This activity often indicates the potential theft and concurrent unauthorized use of an API token.
Detects the registration of new tools, plugins, or connectors into an AI agent's registry, particularly from unverified publishers or outside of sanctioned deployment windows. The rule also flags cases where these newly registered tools are immediately invoked with sensitive-scope permissions (e.g., admin, secrets, write), which is consistent with indicators of AI agent supply chain compromise or unauthorized tool injection.
Detects anomalous, high-volume file deletion, modification, or resource deletion operations performed by an identified AI agent service account within a short timeframe. This behavior is indicative of a compromised AI agent being leveraged for mass data destruction, ransomware activity, or disruptive configuration changes.
Detects high-frequency access requests directed at authentication or API endpoints originating from known Tor exit-node IP addresses. This activity is indicative of credential stuffing or automated scanning patterns that attempt to evade IP-based reputation or rate-limiting filters.
Page 12 of 142