Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,931
7,261
6,535
3,864
3,642
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects the reuse of session identifiers (SessionId, DeviceId, or RefreshTokenJti) across different device fingerprints (e.g., changes in User-Agent, OS, or Browser) within a short timeframe. This behavior is indicative of session hijacking or adversary-in-the-middle (AiTM) attacks, where stolen session tokens or cookies are replayed by an attacker from a different endpoint than the original user.
Detects instances where a user account registers a new Multi-Factor Authentication (MFA) method (such as TOTP or Authenticator app) shortly (within 30 minutes) after a high-risk or potentially anomalous sign-in event. This pattern is commonly associated with adversary-in-the-middle (AiTM) phishing attacks where an attacker captures an authenticated session and uses it to enroll a secondary, attacker-controlled MFA device for persistent account access.
The following analytic identifies when an O365 email account sends an excessive number of email attachments to external recipients within a short period (within 1 hour).
This behavior may indicate a compromised account where the threat actor is attempting to exfiltrate data from the mailbox.
Threat actors may attempt to transfer data through email as a simple means of exfiltration from the compromised mailbox.
Some account owner legitimate behaviors can trigger this alert, however these actions may not be aligned with organizational expectations / best practice behaviors.
This behavior may indicate a compromised account where the threat actor is attempting to exfiltrate data from the mailbox.
Threat actors may attempt to transfer data through email as a simple means of exfiltration from the compromised mailbox.
Some account owner legitimate behaviors can trigger this alert, however these actions may not be aligned with organizational expectations / best practice behaviors.
This rule monitors cloud application events for high-frequency, automated API calls directed at AI/ML inference endpoints. A high volume of queries (over 1000) accessing a diverse range of objects (over 50) within a short window (60 minutes) by a single identity or IP address is flagged. Such behavior is characteristic of model extraction or distillation attacks, where an adversary probes an AI model to replicate its capabilities or internal parameters.
Detects the deletion of GitHub workflow logs that occur in close temporal proximity to sensitive operations such as secret access or package publication. The rule also flags deletions associated with workflow names containing AI-themed keywords, which may indicate an attempt to conceal malicious automation or activity.
Detects high-volume account existence checks targeting the Microsoft Teams API. The rule identifies anomalous authentication attempts characterized by the use of outdated Electron/Chrome user-agent strings associated with the TeamFiltration tool, specifically targeting the Microsoft Teams API AppId (1fec8e78-bce4-4aaf-ab1b-5451cc387264).
Detects user authentication events to recruitment, career, or applicant-tracking applications where the connection originates from an anonymizing proxy, VPN, or datacenter IP address. This behavior has been observed as a precursor to North Korean IT worker recruitment fraud, where attackers mask their true geographic location to gain unauthorized employment.
Detects unauthorized modifications to the Entra ID authentication methods policy or suspicious application activity often associated with the staging of rogue External Authentication Methods (EAM). Adversaries may exploit these configuration changes to intercept or bypass multi-factor authentication (MFA) during user login processes.
Detects the modification or creation of Azure AD applications that include specific malicious redirect URIs associated with 'TrustSink' style attacks, which abuse external authentication callback mechanisms to intercept tokens and bypass MFA.
Detects modifications or additions to Conditional Access policies or External Authentication Methods in Azure AD/Entra ID. These changes could be indicative of an adversary attempting to bypass multi-factor authentication or establish persistence by weakening authentication controls.
Detects an attempt to bypass SharePoint authentication using a 'Register' directive in a POST request body directed at an .aspx page that is not a recognized ToolPane page. This pattern is indicative of an exploit attempt against a public-facing SharePoint server, specifically targeting vulnerability CVE-2026-65660.
This rule detects potentially malicious interactions with Azure OpenAI deployments, specifically looking for prompts indicative of malware-authoring, safety filter bypass attempts, and abnormal volumes of requests from a single identity.
Detects the creation or invitation of new users in Azure AD where integrated identity-verification platforms have flagged document authenticity, liveness, or face matching as anomalies. These flags are cross-referenced with suspicious account attributes such as geolocation mismatches, the use of VOIP phone numbers, or the usage of newly registered email domains, suggesting a potential fraudulent account creation attempt.
Detects the insertion of malicious prompt injection payloads—containing imperative commands to AI agents or hidden unicode/non-printable characters—into wiki pages, ticketing systems, or other shared knowledge bases. These payloads are designed to be ingested by AI agents or Retrieval-Augmented Generation (RAG) pipelines, leading to unauthorized instructions or behavioral overrides upon retrieval.
Detects potential theft and reuse of session or refresh tokens for Microsoft 365 services (Exchange/SharePoint) by identifying multiple authentication events for the same user account from different geographic locations and IP addresses within a short timeframe, specifically when no new MFA challenge was performed.
Detects potential abuse of the Microsoft Graph API by correlating device-code authentication events with subsequent high-volume activity, such as mail or file enumeration, from the same account within a short window. This pattern is indicative of ARToken-style token proxying, where an attacker intercepts an OAuth device-code token to gain unauthorized access to an user's resources.
Detects anomalous OAuth 2.0 device authorization grant requests where the Microsoft Authentication Broker application ID is utilized by non-standard clients, specifically the python-requests library. This pattern is indicative of the GhostCode phishing backend infrastructure, which attempts to programmatically perform device code phishing rather than relying on interactive browser-based flows.
Detects credential-spraying activity against WordPress sites where an actor performs a sequence of POST requests targeting both xmlrpc.php (typically the 'wp.getUsersBlogs' method) and wp-login.php. The rule specifically identifies attackers that attempt to evade detection or increase success rates by falling back to wp-login.php after initially using XML-RPC within a short duration.
Detects high-volume, broad enumeration of sensitive Microsoft Graph API endpoints (users, groups, directory objects, applications, and mail folders) from a single host or user. This behavior is indicative of automated reconnaissance or post-compromise discovery of cloud identity environments.
Detects instances where a user experiences an interrupted sign-in event (Azure AD error code 50199) followed closely by a successful sign-in from the same user account. This pattern is often indicative of Adversary-in-the-Middle (AiTM) phishing, where an attacker intercepts an authentication request, prompts the user, and replays the captured session material.
Detects a suspicious spike in MailItemsAccessed operations occurring across multiple distinct tenant organization IDs within a 60-second window, using the same ClientAppId. This behavior is indicative of automated, centralized credential abuse or mailbox collection tools (often associated with campaigns like Storm-2755) rather than legitimate, isolated user or service-level activity.
Page 33 of 142