Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,934
7,265
6,535
3,865
3,645
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects phishing emails purportedly from Docusign that contain malicious links which redirect users through legitimate identity provider domains (e.g., login.microsoftonline.com, accounts.google.com) before landing on non-trusted infrastructure. This redirect-chain pattern is indicative of NovaCookies Adversary-in-the-Middle (AiTM) delivery, used to facilitate credential or session cookie theft.
Detects phishing emails purportedly from Docusign that contain malicious links which redirect users through legitimate identity provider domains (e.g., login.microsoftonline.com, accounts.google.com) before landing on non-trusted infrastructure. This redirect-chain pattern is indicative of NovaCookies Adversary-in-the-Middle (AiTM) delivery, used to facilitate credential or session cookie theft.
Detects phishing attempts leveraging SendGrid infrastructure to send emails that impersonate well-known financial brands. The detection looks for emails with authentication checks passing (SPF/DKIM/DMARC) where the sender domain is suspicious (e.g., .asia or .com not matching the brand) and the volume of such messages suggests an automated campaign.
Detects a suspicious authentication pattern involving 3 or more MFA failures within 15 minutes, immediately followed by an MFA success for the same user. This pattern is characteristic of potential Adversary-in-the-Middle (AiTM) activity, where an attacker intercepts a session or MFA token and relays it through separate infrastructure, while the legitimate user's own MFA attempts fail or time out.
Detects instances where a Claude session token is reused from a new IP address without the completion of an MFA challenge, indicating a potential session hijacking or session theft attempt.
Detects Azure AD/Entra ID authentication events where a session token or cookie is used without performing a fresh interactive MFA challenge, which is characteristic of session hijacking or adversary-in-the-middle (AiTM) relay attacks (e.g., NovaCookies) used to bypass security controls after initial authentication.
Detects high-risk administrative actions in Microsoft 365, such as new MFA method registration, OAuth app consent grants, or email forwarding rule creation, occurring in sessions that lack fresh authentication (often indicative of a session-cookie replay attack).
Detects the enrollment of a new security key or passkey shortly after an unfamiliar or suspicious sign-in event within Google Workspace. This behavior is indicative of an adversary establishing persistent access following a successful session hijack or credential phishing campaign, specifically targeting authentication mechanisms to bypass existing security controls.
Detects OAuth 2.0 authorization requests sent to login.microsoftonline.com using the 'prompt=none' parameter, where the redirect_uri domain is not a trusted Microsoft property. This is a common indicator of consent phishing or malicious OAuth application abuse where an attacker attempts to redirect authorization tokens to an adversary-controlled endpoint.
Detects anomalous Entra ID sign-in patterns characterized by a single session ID replayed from multiple diverse source IP addresses and Autonomous System Numbers (ASNs) within a short timeframe. This behavior is indicative of Session Hijacking (AiTM/Adversary-in-the-Middle) where an attacker maintains persistence by proxying requests through a residential network to bypass conditional access policies and evade location-based threat detection.
Detects modifications to payroll direct deposit or payment election settings within Workday. This activity is a common indicator of payroll fraud or Business Email Compromise (BEC), where an attacker gains access to an employee's Workday account to redirect salary payments to an unauthorized bank account.
Detects session hijacking (AiTM) attempts where a failed or interrupted sign-in (ResultType 50199) is followed by a successful login using the same SessionId but with an Axios user-agent, indicating automated replay of a stolen session token rather than legitimate browser usage.
Detects a suspicious spike in MailItemsAccessed operations occurring across multiple distinct tenant organization IDs within a 60-second window, using the same ClientAppId. This behavior is indicative of automated, centralized credential abuse or mailbox collection tools (often associated with campaigns like Storm-2755) rather than legitimate, isolated user or service-level activity.
Detects outbound web requests to the Telegram API triggered by Google Apps Script components (sidebar macros). This pattern is indicative of malicious Google Docs or Slides files using embedded scripts to exfiltrate data or perform command-and-control communication via the Telegram API when the document is opened by a user.
Detects rapid mass-cloning or downloading of private GitHub repositories shortly after an OAuth token authorization, originating from IP addresses or countries not previously associated with the user account. This behavior is indicative of unauthorized bulk data extraction using compromised credentials, consistent with threat actor activity (e.g., TeamPCP/UNC6780).
Detects rapid mass-cloning or downloading of private GitHub repositories shortly after an OAuth token authorization, originating from IP addresses or countries not previously associated with the user account. This behavior is indicative of unauthorized bulk data extraction using compromised credentials, consistent with threat actor activity (e.g., TeamPCP/UNC6780).
Detects instances where a removed GitHub organization member performed bulk repository access (cloning or downloading) shortly before their removal, potentially indicating exploitation of retained access by a departed employee or an adversary using a valid account before deprovisioning. The rule identifies activity occurring more than 24 hours prior to removal involving multiple repositories or multiple access actions.
Detects rapid, bulk cloning or downloading of GitHub repositories containing sensitive data (e.g., consensus algorithms, PII, internal blocklists). This behavior is characteristic of unauthorized data exfiltration, specifically tracking activity involving suspicious OAuth token prefixes (gho_) and rapid high-volume access to sensitive organizational assets within a short timeframe.
Detects potentially malicious OAuth device code sign-ins by identifying sign-in events that exhibit anomalous characteristics, such as atypical geographic locations, rare client-application combinations, unmanaged/noncompliant device status, or elevated risk signals associated with the account. This detection helps identify account compromise or malicious OAuth consent activity often associated with 'EvilTokens' or device-code phishing attacks.
Detects potentially malicious OAuth device code sign-ins by identifying sign-in events that exhibit anomalous characteristics, such as atypical geographic locations, rare client-application combinations, unmanaged/noncompliant device status, or elevated risk signals associated with the account. This detection helps identify account compromise or malicious OAuth consent activity often associated with 'EvilTokens' or device-code phishing attacks.
Detects potential abuse of stolen OAuth session tokens, where refresh tokens are used to authenticate after a user has performed a password reset. This rule identifies accounts that continue to sign in from previously unseen devices or IP addresses within 24 hours post-password reset, a technique consistent with session persistence mechanisms used by adversary tools and platforms like EvilTokens.
Page 39 of 142