Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,932
7,263
6,535
3,865
3,643
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects potential SaaS supply-chain attacks where a third-party application or connector triggers an OAuth permission scope escalation or publishes a new version, followed by the associated service account initiating outbound network connections to rare or newly-registered domains within a 24-hour window.
Detects unauthorized attempts to access SharePoint's WebPartPage ToolPane and Gallery endpoints via anonymous web requests. This pattern, characterized by the 'DisplayMode=Design' query parameter and suspicious markup in the request body, is indicative of exploitation attempts targeting vulnerable SharePoint installations to execute arbitrary code or bypass authentication mechanisms.
Detects automated API exploitation attempts, specifically Broken Object Level Authorization (BOLA) scanning. The rule triggers when a single source IP or API token exhibits high-frequency request patterns (5+ requests per second) against resource endpoints with sequentially incrementing IDs. It specifically correlates a spike in 401/403 authorization failures followed by a small count of 200 successes, indicating a potential successful bypass of authorization controls.
Detects a suspicious correlation where an employee's phone number undergoes a SIM change or number reassignment event, immediately followed by a successful login using SMS-based MFA for the same identity. This pattern is indicative of SIM swapping/hijacking attacks, often used by threat actors like Scattered Spider to bypass SMS-based multi-factor authentication.
Detects potential OAuth device code phishing attempts by identifying sign-ins via the device code flow using applications not previously used by the specific user, especially when occurring in a burst pattern across multiple users.
This rule detects potential social engineering attacks where an external or federated user impersonates an IT or helpdesk entity within Microsoft Teams (via chats, messages, or calls) followed shortly by an MFA registration or password reset event for the targeted user. This sequence is indicative of a vishing or phishing attack aimed at account takeover.
Detects the granting of high-privilege permissions (e.g., mail.read, files.readwrite) to a newly registered OAuth application (less than 24 hours old), followed by high-volume API activity from that same application within one hour. This behavior is indicative of an illicit OAuth consent grant attack, where an adversary lures a user into granting permissions to a malicious application to maintain persistent access to cloud resources or perform data exfiltration.
Detects anomalous AI agent behavior characterized by a significant spike in resource or tool invocations within a 15-minute window, potentially indicating indirect prompt injection or unauthorized agent hijacking where an agent is coerced into excessive or unauthorized actions.
Detects malicious prompt injection attempts within an LLM conversation session. The rule monitors for ingested content containing common instruction-override keywords (e.g., 'ignore previous instructions', 'system prompt override'), followed immediately by the agent process executing unauthorized actions such as process launch, network connections, or file creation within the same session/user context.
Detects suspicious HTTP requests directed at SharePoint applications containing a malformed Register directive. The rule identifies attempts to leverage the 'publishingribbon' Tagprefix combined with unauthorized namespaces (e.g., System.Xaml, System.Windows.Data) to bypass the EditingPageParser.InitializeRegisterTable safelist check, a common technique for SharePoint remote code execution.
Detects anomalous authentication behavior where the same session token or identifier is utilized by multiple distinct IP addresses or User-Agent strings within a short timeframe. This behavior is indicative of Adversary-in-the-Middle (AiTM) attacks, such as those employing Evilginx, where an attacker intercepts and replays stolen session cookies to bypass standard authentication and MFA controls.
Detects potential vishing or account takeover precursor activity where an external or guest Microsoft Teams user, impersonating IT or Help Desk support, communicates with a user who subsequently modifies their credentials or MFA configuration within the same 24-hour period.
Detects successful Entra ID sign-in events that utilize the OAuth 2.0 device authorization grant (device code) flow. This authentication mechanism is frequently abused by attackers to perform device code phishing (e.g., ARToken attacks), where victims are tricked into entering a malicious user code on a legitimate Microsoft login portal to facilitate token theft.
Detects high-risk administrative actions in Entra ID, such as role assignments, user creation, or password resets, occurring shortly after a user authenticates using the device code flow. This pattern is indicative of a post-compromise takeover where an adversary utilizes a stolen or coerced device code session to escalate privileges.
Detects a specific phishing pattern where a legitimate, authenticated DocuSign notification is followed by a user clicking a link within that document that redirects to known malicious infrastructure or OAuth-abuse sites (e.g., .vu domains, credential harvesting proxies). This heuristic identifies the link as being embedded in the shared document rather than the email body.
Detects anomalous, high-volume activity in cloud-based services such as SharePoint, OneDrive, and Exchange, specifically tracking file access, downloads, and mailbox exports. This behavior may indicate bulk data collection, unauthorized exfiltration, or malicious data staging by a compromised account.
This rule detects network activity and cloud API events indicative of an adversary utilizing the VAPI.ai platform to orchestrate automated voice-phishing (vishing) campaigns. It correlates outbound network connections to VAPI.ai endpoints with specific webhook callback patterns used to track call status for victim records.
Detects specific, targeted search operations within M365 environments for keywords related to payroll, HR, and banking information. This behavior is indicative of post-compromise reconnaissance activity, often following AiTM (Adversary-in-the-Middle) session hijacking where an attacker attempts to locate financial documents and payroll correspondence.
Detects potentially malicious OAuth device code sign-ins by identifying sign-in events that exhibit anomalous characteristics, such as atypical geographic locations, rare client-application combinations, unmanaged/noncompliant device status, or elevated risk signals associated with the account. This detection helps identify account compromise or malicious OAuth consent activity often associated with 'EvilTokens' or device-code phishing attacks.
Detects potential abuse of stolen OAuth session tokens, where refresh tokens are used to authenticate after a user has performed a password reset. This rule identifies accounts that continue to sign in from previously unseen devices or IP addresses within 24 hours post-password reset, a technique consistent with session persistence mechanisms used by adversary tools and platforms like EvilTokens.
Detects the addition of new members to a GitHub organization or team outside of standard business hours. This behavior is correlated with potential subsequent grants of repository administrative access or read access to secrets, characteristic of attacker patterns attempting to gain unauthorized access to cloud environments and OAuth tokens via CI/CD pipelines or VCS platforms.
Page 28 of 142