Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,921
7,246
6,535
3,864
3,627
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects potential Adversary-in-the-Middle (AiTM) session token theft by monitoring for an initial interactive sign-in followed shortly by a non-interactive token refresh from a different IP address and browser fingerprint without a multi-factor authentication (MFA) challenge. This behavior is indicative of an adversary replaying captured session cookies via reverse-proxy infrastructure.
This rule detects a multi-stage Business Email Compromise (BEC) attack involving executive impersonation via look-alike domains, followed by the creation of suspicious inbox rules (forwarding/deletion) by the victim, and concurrent external communication (Teams/Zoom meeting invites) from a newly created account. It correlates these activities to identify sophisticated payment fraud campaigns.
Detects instances where a user successfully authenticates to a cloud service (Azure AD) from an unrecognized ASN, device, or country without performing MFA, followed shortly by high-risk actions such as mailbox rule creation, mass file downloads, or OAuth application registration. This pattern is indicative of session cookie theft or OAuth token replay used to bypass MFA.
Detects suspicious help-desk activity where a user password is reset by an administrator followed shortly by a new MFA factor being enrolled for that same user. This pattern is characteristic of Scattered Spider-style social engineering and vishing attacks to bypass MFA without deploying malware.
Detects suspicious help-desk activity where a user password is reset by an administrator followed shortly by a new MFA factor being enrolled for that same user. This pattern is characteristic of Scattered Spider-style social engineering and vishing attacks to bypass MFA without deploying malware.
Detects a suspicious correlation where an employee's phone number undergoes a SIM change or number reassignment event, immediately followed by a successful login using SMS-based MFA for the same identity. This pattern is indicative of SIM swapping/hijacking attacks, often used by threat actors like Scattered Spider to bypass SMS-based multi-factor authentication.
Detects anomalous authentication behavior consistent with Adversary-in-the-Middle (AiTM) phishing attacks, specifically where an MFA-authenticated session is accessed from multiple, disjoint geographic locations or IP addresses within a short timeframe, indicating the replay of stolen session tokens.
Detects package publishing or version creation events on npm or PyPI that originate from non-CI/CD service accounts, suggesting the use of stolen registry authentication tokens by unauthorized entities to push malicious package versions.
Detects high-volume authentication failures originating from a single source IP targeting multiple unique user accounts, indicative of password spraying or credential stuffing attacks against cloud identity providers.
Detects high-volume account existence checks targeting the Microsoft Teams API. The rule identifies anomalous authentication attempts characterized by the use of outdated Electron/Chrome user-agent strings associated with the TeamFiltration tool, specifically targeting the Microsoft Teams API AppId (1fec8e78-bce4-4aaf-ab1b-5451cc387264).
This rule detects email activity involving DocuSign-themed messages that contain attachments and also coincide with URL click events that redirect users to Microsoft-related login portals (e.g., login.microsoftonline.com or teams.microsoft.com) containing 'redirect' or 'redirect_uri' parameters. This behavior is indicative of a phishing attempt designed to capture credentials or perform OAuth consent phishing by mimicking legitimate document-signing workflows.
This rule identifies potential prompt injection attempts against Microsoft Copilot and Azure OpenAI services by monitoring CloudAppEvents for specific adversarial markers, encoded instruction blocks, or hidden text patterns. It flags recurring attempts from a single user as suspicious probing activity.
This rule detects potential prompt injection and jailbreak attempts targeting internal Generative AI applications by monitoring prompt content for known adversarial patterns (e.g., DAN roleplay, hypothetical bypasses, and explicit disregard for safety instructions). The rule tracks repeat offenders or successful bypass attempts (where the application did not block the request).
Detects the transmission of sensitive credential-like patterns (such as API keys, private keys, and connection strings) to known external AI coding assistant and IDE plugin endpoints. This rule monitors cloud application events originating from developer workstations or CI/CD runners where such sensitive information may be inadvertently or maliciously sent to third-party AI services.
Detects evidence of indirect prompt injection (IPI) attempts within email and document content processed by enterprise AI assistants. The rule flags instruction-hijack phrases, hidden obfuscation characters (e.g., zero-width, white-on-white text), and encoded blocks specifically targeting AI model behavior.
This rule detects potential CI/CD security compromises in GitHub by monitoring for modifications to workflow permissions that grant 'write-all' access, access to sensitive workflow secrets via 'pull_request_target' from forked repositories, and the registration of new self-hosted runners. These actions are common indicators of supply chain attacks aimed at poisoning pipeline execution or exfiltrating build secrets.
Detects high-velocity administrative activity performed by a single user account in Azure Active Directory, specifically focusing on account provisioning and role membership changes. The rule flags patterns such as password resets, enabling/disabling accounts, adding new users, and privilege escalation (e.g., granting Global Administrator roles), which are indicative of malicious post-compromise activity.
Detects high-volume, rapid enumeration of core Microsoft Graph directory endpoints (users, groups, applications, and servicePrincipals) by a single identity or session. This behavior is indicative of reconnaissance tools such as AADInternals, ROADtools, or TokenTactic being used to map out a cloud environment's directory structure.
Detects the addition or modification of federated domain trusts or identity provider settings within Entra ID. Such actions can be indicative of attackers establishing persistent access or implementing Golden SAML-style attacks by forging authentication assertions via a compromised or malicious identity trust.
Detects an anomalous burst of git clone, fetch, or download events performed by a single GitHub user account against a large number of private repositories within a short timeframe (15-minute window). This pattern often indicates unauthorized bulk collection or exfiltration of sensitive source code by an actor using a valid account.
Detects GitHub OAuth authorization, repository cloning, or ZIP downloads from source IP addresses that have not been observed for the specific actor within the past 30 days. This rule helps identify potential account compromise or token theft where an attacker attempts to access repository data from a new location, while specifically excluding bot/service accounts known for rotating CI infrastructure IPs.
Page 41 of 142