Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,934
7,265
6,535
3,865
3,645
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects a suspicious sequence of events suggesting potential technical support scam or social engineering activity: a rapid influx of emails (email bombing) followed by an external Microsoft Teams call, and subsequently the execution of a common remote access tool on the same host within a short timeframe.
Detects high-velocity, multi-application sign-in activity within a short timeframe (<= 15 minutes) originating from suspicious Python-based user agents (requests library). This pattern is often indicative of automated script-based reconnaissance or unauthorized access attempts against Microsoft 365 services.
Detects a high volume of 'MailItemsAccessed' operations within a short 15-minute window performed by a specific application ID. This behavior is often indicative of automated, bulk exfiltration of emails from a Microsoft 365 environment, potentially by a compromised application or an attacker using a malicious OAuth application.
This rule detects illicit OAuth consent grant events where an application is granted high-risk delegated permissions. This behavior is indicative of consent phishing or 'ConsentFix' tradecraft, where attackers trick users into granting permissions to a malicious application, thereby enabling unauthorized access to mail and file data.
This rule detects illicit OAuth consent grant events where an application is granted high-risk delegated permissions. This behavior is indicative of consent phishing or 'ConsentFix' tradecraft, where attackers trick users into granting permissions to a malicious application, thereby enabling unauthorized access to mail and file data.
Detects the use of specific malicious versions (v2.2.1) of GitHub Actions (actions-cool/issues-helper or actions-cool/maintain-one-comment) in workflow runs that also involve the exposure or referencing of the GITHUB_TOKEN, indicating potential credential theft and CI/CD pipeline compromise.
Detects the suspicious reactivation of 'actions-cool/issues-helper' or 'actions-cool/maintain-one-comment' repositories within a known malicious window (September 14-19, 2026). These repositories were involved in the 'Mini Shai-Hulud' supply-chain attack. This rule identifies when previously disabled repositories are re-enabled or modified to become active, potentially re-exposing malicious release tags to downstream users.
Detects the suspicious reactivation of 'actions-cool/issues-helper' or 'actions-cool/maintain-one-comment' repositories within a known malicious window (September 14-19, 2026). These repositories were involved in the 'Mini Shai-Hulud' supply-chain attack. This rule identifies when previously disabled repositories are re-enabled or modified to become active, potentially re-exposing malicious release tags to downstream users.
Detects sign-in events in Entra ID where the OAuth 2.0 device authorization grant (device code) flow is utilized. This flow is a common vector for phishing attacks designed to steal tokens by tricking users into authenticating on a secondary device, potentially bypassing MFA.
Detects potential embedding inversion or extraction attempts by identifying callers exhibiting abnormally high volumes of similarity or vector search queries against RAG-enabled vector stores or cognitive search APIs within a short timeframe.
Detects potential embedding inversion or extraction attempts by identifying callers exhibiting abnormally high volumes of similarity or vector search queries against RAG-enabled vector stores or cognitive search APIs within a short timeframe.
Detects the presence of specific .NET deserialization gadget chain components (ExpandedWrapper, XamlServices, ObjectDataProvider, LosFormatter) within application traffic or logs, which are indicative of exploitation attempts targeting SharePoint pre-authentication remote code execution vulnerabilities like CVE-2026-65660.
Detects HTTP POST requests to SharePoint ToolPane or WebPartPage endpoints containing serialized gadget chains (e.g., ysoserial ExpandedWrapper/ObjectDataProvider or XamlServices) indicative of deserialization exploitation attempts, specifically targeting CVE-2026-65660.
Detects unauthenticated HTTP POST requests targeting SharePoint WebPartPage-derived endpoints using the 'webPartMarkup' parameter. This activity attempts to exploit a vulnerability (CVE-2026-65660) where anonymous access to specific pages bypasses authentication, allowing an attacker to invoke internal methods for malicious register-directive injection.
Detects malicious exploitation attempts against the SharePoint WebPartPages.asmx SOAP endpoint. Attackers use this endpoint to bypass security patches by invoking template-parsing functions like GetWebPartPageConnectionInfo, which facilitates Register-directive injection and XamlServices deserialization chains for remote code execution.
Detects spoofed emails carrying a .patch attachment sent to a GitLab incoming-email merge-request address. Requires Microsoft's composite authentication verdict (CompAuth: fail) -- a lower-noise spoofing signal than raw SPF/DKIM/DMARC -- and excludes sender/recipient pairs already seen corresponding with that token address in the prior 30 days to suppress recurring legitimate contributors.
Detects spoofed emails carrying a .patch attachment sent to a GitLab incoming-email merge-request address. Requires Microsoft's composite authentication verdict (CompAuth: fail) -- a lower-noise spoofing signal than raw SPF/DKIM/DMARC -- and excludes sender/recipient pairs already seen corresponding with that token address in the prior 30 days to suppress recurring legitimate contributors.
Detects anomalous, high-volume, low-severity events flagged for human review originating from a single AI agent or source within a 10-minute window. This behavior is indicative of an adversary flooding the human-in-the-loop (HITL) review queue with chaff data (noise) to exhaust analyst capacity or conceal malicious activity.
Detects unauthorized or anomalous write operations (upsert/insert) to a vector database, which could indicate a Retrieval-Augmented Generation (RAG) injection attack. The rule monitors for writes from non-sanctioned identities, operations outside of established maintenance or ingestion windows, or entries that lack necessary provenance metadata such as source document IDs or content hashes.
Detects instances where an LLM agent initiates sensitive or out-of-sandbox tool calls (such as file system access or arbitrary command execution) following input that contains suspicious directive-override or prompt injection patterns. This behavior indicates that the agent has been compromised by a prompt injection attack, allowing an unauthorized actor to control the agent's tool-calling capabilities.
Detects modifications to Microsoft Entra ID (formerly Azure AD) authentication policies, specifically the registration, enablement, or modification of External Authentication Methods (EAMs). This activity can indicate an attempt to add a rogue authentication provider for persistent unauthorized access, bypassing standard MFA or conditional access policies.
Page 35 of 142