Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,931
7,261
6,535
3,864
3,642
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects potential consent phishing attempts by identifying when a user grants high-risk, persistent-access OAuth scopes (such as Mail or Files) to a new third-party application. The rule specifically excludes known first-party Microsoft apps and utilizes a lookback period to avoid alerting on applications that have already been consented to within the tenant, reducing noise from routine enterprise app usage.
Detects potential consent phishing attempts by identifying when a user grants high-risk, persistent-access OAuth scopes (such as Mail or Files) to a new third-party application. The rule specifically excludes known first-party Microsoft apps and utilizes a lookback period to avoid alerting on applications that have already been consented to within the tenant, reducing noise from routine enterprise app usage.
Detects potential consent phishing attempts by identifying when a user grants high-risk, persistent-access OAuth scopes (such as Mail or Files) to a new third-party application. The rule specifically excludes known first-party Microsoft apps and utilizes a lookback period to avoid alerting on applications that have already been consented to within the tenant, reducing noise from routine enterprise app usage.
Detects a suspicious sequence of events where a user exhibits signs of account compromise—either through impossible travel patterns or the use of OAuth tokens on a new device—followed within one hour by the modification of mailbox settings, such as creating new inbox rules or modifying mailbox permissions, which is a common indicator of persistence and email exfiltration.
Detects high-risk GitHub events indicating data or asset exposure, such as creating public repositories with specific naming conventions, changing private repositories to public, or creating new gists, which could indicate exfiltration of sensitive assets or information.
Detects high-risk GitHub events indicating data or asset exposure, such as creating public repositories with specific naming conventions, changing private repositories to public, or creating new gists, which could indicate exfiltration of sensitive assets or information.
Detects a suspicious pattern where an AI coding agent or user creates a public GitHub repository with specific naming conventions (e.g., 'sweeper-demo', 'gitshot-images') and subsequently pushes content containing sensitive terms like 'screenshot' within a short timeframe. This behavior is indicative of potential data exfiltration of internal development screenshots to a public repository.
Detects sign-in patterns indicative of Adversary-in-the-Middle (AiTM) phishing attacks such as EvilProxy or Tycoon2FA. The rule identifies a sequence where a user fails an MFA challenge (using codes 50074 or 50140) followed by a successful authentication within a short period (1 hour) where the MFA claim appears as 'Previously satisfied' or 'already succeeded' from a different IP address or user-agent string, suggesting the session was stolen or replayed.
Detects potential help-desk impersonation or social engineering activity involving account credential or MFA method resets, followed shortly by a sign-in from an unknown device or geography. The rule excludes activity tied to established ticketing systems or standard automated password expiration processes.
Detects potential help-desk impersonation or social engineering activity involving account credential or MFA method resets, followed shortly by a sign-in from an unknown device or geography. The rule excludes activity tied to established ticketing systems or standard automated password expiration processes.
Detects a multi-stage attack pattern involving a non-MFA login to a Citrix portal, followed by lateral movement, and concluding with ransomware deployment behaviors such as shadow copy deletion, recovery disablement, or the dropping of ransom notes associated with ALPHV/BlackCat ransomware.
Detects an AI agent or automated process that accesses sensitive data sources (such as vaults, databases, or documentation platforms) followed by an outbound HTTP POST request to known high-risk SaaS or web services (e.g., paste sites, file sharing, or webhook services) with a suspicious or large payload.
Detects instances where an AI agent's output contains sensitive credential patterns such as AWS access keys, JWTs, private keys, or Bearer tokens. This rule monitors user communication, generic events, and file creation events to identify potential security compromises or unintended data leakage from the AI model.
Detects modifications to Microsoft Entra ID applications or service principals involving the addition or configuration of 'externalauthprovider' redirect URIs or properties. This behavior is indicative of an attacker attempting to establish a malicious federated identity or persistence mechanism by manipulating application configuration to use an adversary-controlled authentication provider.
This rule detects potentially malicious activity where an identity performs enumeration of Kubernetes secrets or configmaps and subsequently performs a search action within Slack from the same IP address within a one-hour window. This behavioral pattern is indicative of post-breakout reconnaissance, where a compromised identity or token is used to exfiltrate sensitive cloud configuration data and then perform internal reconnaissance in SaaS collaboration tools to identify further targets or credentials.
This rule detects security alerts (IDS, WAF, or infrastructure logs) indicating exploitation attempts against JFrog Artifactory instances related to CVE-2026-66384, specifically involving cache poisoning techniques observed in recent threat campaigns.
This rule detects potential data exfiltration by monitoring corporate user activities involving consumer generative AI services (e.g., ChatGPT, Gemini, Claude). It identifies suspicious patterns such as large volume submissions, repeated chunked prompts, and the presence of sensitive content (e.g., PII markers, classification labels) or obfuscated payloads (base64/rot13) that suggest an attempt to bypass DLP or detection controls.
This rule detects anomalous, high-volume activity from a single user account interacting with known public generative AI platforms (e.g., ChatGPT, Copilot, Claude). It uses a threshold-based approach on CloudAppEvents logs to identify potential reconnaissance or bulk information gathering activities which could signify unauthorized use or automated data scraping via AI interfaces.
Detects Salesforce Experience Cloud guest user sessions performing queries or reads on objects not within the authorized allowlist. This behavior, characterized by an abnormal volume of records retrieved or anomalous query patterns, is consistent with attempts to exploit misconfigured guest profile permissions to access internal sensitive data.
Detects unauthorized configuration or content changes (e.g., login or portal pages) performed outside of standard business hours by user accounts that have recently exhibited high-risk or compromised authentication behavior. This pattern aligns with tactics observed in the ShinyHunters playbook where compromised accounts are used to deface public-facing applications.
This rule detects potential password spraying attacks against PeopleSoft or PeopleTools applications. It monitors for a pattern where a single source IP address generates multiple failed authentication attempts against a variety of distinct user accounts, followed by at least one successful login from the same source IP. This behavior is indicative of an adversary attempting to gain unauthorized access by iterating through a list of usernames with common or guessed passwords.
Page 16 of 142