Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,934
7,265
6,535
3,865
3,645
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
This rule detects anomalous behavior in AI agent tool invocations, specifically monitoring for high volumes of tool calls, high costs associated with token consumption, or suspicious tool interactions following a flagged indirect prompt injection. This behavior is indicative of potential resource exhaustion (denial of service) or abusive agent behavior as defined by the MITRE ATLAS framework for AI security.
Detects potential sensitive data leakage from an AI model response (AIGatewayLogs_CL). The rule monitors AI responses for patterns indicative of PII (SSN, credit card numbers), secrets (API keys, tokens), or sensitive document markers. It correlates these signals with RAG (Retrieval-Augmented Generation) ingestion logs to identify data cross-tenant violations or improper access to confidential/restricted datasets.
Detects autonomous AI agents triggered by routine, non-interactive workflows (such as scheduled tasks, tickets, or calendar invites) that subsequently invoke sensitive tools. The rule correlates these invocations with content hashes previously flagged as containing malicious indirect prompt injections, indicating an attack where a payload remains dormant until processed by an automated agent.
Detects potential sensitive data leakage from an AI model response (AIGatewayLogs_CL). The rule monitors AI responses for patterns indicative of PII (SSN, credit card numbers), secrets (API keys, tokens), or sensitive document markers. It correlates these signals with RAG (Retrieval-Augmented Generation) ingestion logs to identify data cross-tenant violations or improper access to confidential/restricted datasets.
Detects autonomous AI agents triggered by routine, non-interactive workflows (such as scheduled tasks, tickets, or calendar invites) that subsequently invoke sensitive tools. The rule correlates these invocations with content hashes previously flagged as containing malicious indirect prompt injections, indicating an attack where a payload remains dormant until processed by an automated agent.
Detects the creation of new administrator or technician accounts within the SimpleHelp Remote Monitoring and Management (RMM) platform via API calls. This activity is often associated with unauthorized persistence creation by an adversary who has gained access to the platform.
The EntraIdSignInEvents table exposes the JA4 fingerprint in the GatewayJA4 field. But looking at the complete fingerprint alone does not tell us much. The interesting part starts when we break it down. With a simple KQL query, we can separate the TLS version, SNI, number of cipher suites, extensions and ALPN, together with the cipher and extension hashes. Then we can see how many sign-ins, users, IPs and countries are behind each JA4. The idea is simple: understand what is normal first, then look for what is different.
Detects malicious HTTP POST requests targeting SharePoint servers that attempt to inject 'Register' directives into pages or manipulate WebPartPage ToolPane markup, indicative of attempts to bypass SafeControls or exploit vulnerable SharePoint features for code execution.
Detects anomalous large-scale data transfers to external endpoints that exhibit patterns characteristic of the ShinyHunters group's SaaS bulk export and data exfiltration methods. The rule identifies suspicious HTTP requests to Salesforce API endpoints (e.g., batch jobs, bulk queries) accompanied by unusually large content payloads, followed by subsequent encrypted communication to non-whitelisted external destinations.
Detects a specific SharePoint markup injection technique targeting the EditingPageParser type-check mechanism. An attacker smuggles a 'Register' directive into a crafted WebPartMarkup POST request using the 'publishingribbon' Tagprefix to bypass SafeControl validation.
Detects potential insider threats or departing employees by correlating abnormal bulk data downloads from cloud repositories (SharePoint/OneDrive/Box/etc.) with subsequent sensitive data access and exfiltration signals. It uses baseline behavioral profiling, requires a threshold of sensitive file interactions, and mandates high-confidence exfiltration indicators (removable media usage, suspicious external domains, or multiple combined destination events) to reduce noise. Archive/staging activity is used as an optional confidence booster.
This rule detects when a user or service account accesses or downloads a high volume of files from SharePoint or OneDrive that match sensitive keywords such as 'password', 'secret', 'credential', or specific file extensions like '.pem', '.pfx', and '.env'. This behavior is indicative of an attempt to harvest credentials, API keys, or configuration secrets from cloud storage repositories.
Detects high-volume file download, access, or preview activity originating from known anonymous proxy services. This behavior is indicative of potential data exfiltration or unauthorized mass data collection from cloud storage applications.
This rule detects anomalous, high-volume activity from a single user account interacting with known public generative AI platforms (e.g., ChatGPT, Copilot, Claude). It uses a threshold-based approach on CloudAppEvents logs to identify potential reconnaissance or bulk information gathering activities which could signify unauthorized use or automated data scraping via AI interfaces.
Detects instances where a single user account exhibits an anomalously high frequency of requests to public generative-AI platforms within a one-hour window, potentially indicating automated reconnaissance or data staging activities using AI tools.
Detects GitHub repository actions (git.clone, oauth_authorization.create, repo.download_zip) from actor IPs not seen for that user in the prior 30 days, requiring either 3+ actions or activity across 2+ distinct repositories from the new IP within the same day. Aggregating to burst/multi-repo behavior (rather than alerting on a single new-IP event) filters out one-off false positives from travel, VPNs, or dynamic IP reassignment while still surfacing sustained anomalous access patterns consistent with account compromise or bulk exfiltration.
Detects high-volume file download, access, or preview activity originating from known anonymous proxy services. This behavior is indicative of potential data exfiltration or unauthorized mass data collection from cloud storage applications.
This rule detects high-frequency HTTP 401 Unauthorized responses directed at API endpoints (specifically matching '/v1/') within a short window, which is indicative of an adversary attempting to brute-force or credential-stuff API keys.
Detects instances where an administrative user performs a password or MFA method reset on a target account, followed within 24 hours by a sign-in event from that same target account flagged with a high or medium risk level. This sequence is characteristic of Adversary-in-the-Middle (AiTM) attacks, where an attacker utilizes stolen session tokens and subsequently coerces helpdesk or administrative intervention to reset MFA requirements to maintain unauthorized access.
Detects MFA request abuse (T1621) by identifying a user receiving 5 or more MFA push, SMS, or call denials/timeouts within a 10-minute window across Entra ID, Okta, or Duo authentication logs. This behavior is indicative of an MFA fatigue attack, where an adversary continuously triggers MFA prompts until the user eventually approves the request out of frustration or confusion.
Detects web-proxy or webserver log activity associated with domains registered within the last 30 days that mimic branding or structure of major identity providers (Microsoft, Okta, Google, Duo). This behavior is characteristic of adversary-in-the-middle (AiTM) phishing infrastructure staging.
Page 32 of 142