Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,932
7,263
6,535
3,865
3,643
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects phishing emails containing QR codes rendered using HTML tables. This technique is used to evade image-based scanning and OCR security controls by representing the QR code as a grid of small, colored table cells (<td>) instead of a traditional image file.
This detects events in Okta where there is the eventType of "user.session.impersonation.grant".
This grants access in the context of the user. This could be high privilege admin access.
This grants access in the context of the user. This could be high privilege admin access.
Detects events in Okta where there is the eventType of ~'policy.lifecycle' and the policy of 'OktaSignOn'.
This will capture when new signon policies are created or updated. This could allow users to authenticate to Okta where the current policy does not apply. (i.e: enforcing MFA)
This will capture when new signon policies are created or updated. This could allow users to authenticate to Okta where the current policy does not apply. (i.e: enforcing MFA)
Detects events in Okta where there is the eventType of "user.session.impersonation.grant".
This grants access in the context of the user. This could be high privilege admin access.
This grants access in the context of the user. This could be high privilege admin access.
Detects suspicious email inbox rule creation indicative of account compromise. Focuses on rules with randomly-generated names or rules that move emails to low-visibility folders combined with hiding actions (mark as read, delete, stop processing).
This Query is oriented to identify Malicious URL sent via Microsoft Teams and detect possible hits based on online Malware sites reported by the TI Feed URL Haus.
Detects anomalous Okta sign-on policy evaluations originating from Cloudflare, which could indicate an Adversary-in-the-Middle (AiTM) phishing attempt. The associated campaign uses Cloudflare to host its phishing infrastructure.
Detects when an internal user successfully authenticates as a guest to an external Microsoft Teams tenant. This could be legitimate B2B collaboration, but it can also be abused by attackers to lure users into a malicious tenant where security controls (like Safe Links/Safe Attachments) are not enforced.
Detects creation of branches and files matching indicators used by Shai-Hulud 2.0 for exfiltration
Detects GitHub Actions activity matching indicators used by Shai-Hulud 2.0 for exfiltration and persistence
Detects when an internal user successfully authenticates as a guest to an external Microsoft Teams tenant. This could be legitimate B2B collaboration, but it can also be abused by attackers to lure users into a malicious tenant where security controls (like Safe Links/Safe Attachments) are not enforced.
Detects emails containing URLs with patterns characteristic of the Tycoon 2FA phishing kit. These URLs often contain a base64-encoded email address in the path, preceded by a special character.
This rule detects the creation of a public GitHub repository with the specific description "Sha1-Hulud: The Second Coming". This is an indicator of compromise (IOC) associated with the Shai-Hulud 2.0 worm, which uses these repositories to exfiltrate stolen credentials.
This search detects the creation of a public GitHub repository with the description "Sha1-Hulud: The Second Coming". This is a specific indicator of compromise (IOC) associated with the Shai-Hulud 2.0 worm, which uses these repositories to exfiltrate stolen credentials.
Detects when an administrator or help desk agent resets a user's password or deactivates/resets their MFA factors. This activity, while often legitimate, is a key tactic used by social engineering groups like Muddled Libra (aka Scattered Spider) who are known to 'vishing' (voice-phishing) IT help desks to take over accounts.
Detects phishing emails with malicious HTML attachments designed to harvest credentials and exfiltrate them via the Telegram Bot API. The detection looks for specific attachment filenames (e.g., RFQ, INQUIRY) or content patterns indicative of this threat.
Detects when a new administrator role assignment is created within Okta. This activity can indicate privilege escalation, where an attacker gains higher-level permissions, or persistence, where an attacker establishes a way to maintain access to the system over time.
This rule detects when GitHub's push protection feature is disabled. This feature helps prevent sensitive information, such as secrets, from being accidentally committed to repositories. Disabling it could indicate an attempt to bypass security controls, potentially allowing secrets to be exposed in code.
Detects when an administrator role is assigned to a user or group within Okta. This could indicate privilege escalation or persistence by an attacker, or a legitimate administrative action.
Detects when a successful multi-factor authentication (MFA) occurs due to the use of a bypass code in Cisco Duo. Bypass codes are temporary passcodes created by administrators for specific users to access Duo-protected applications, typically used as backup codes when users cannot use their enrolled devices. This rule identifies instances where such a bypass code facilitates a successful authentication.
Detects when a new member is added or invited to a GitHub organization. This activity could indicate an attempt by an adversary to gain persistence within an organization's GitHub environment by adding a controlled account or inviting a malicious user.
Page 123 of 142