Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,934
7,265
6,535
3,865
3,645
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects the suspicious reactivation of 'actions-cool/issues-helper' or 'actions-cool/maintain-one-comment' repositories within a known malicious window (September 14-19, 2026). These repositories were involved in the 'Mini Shai-Hulud' supply-chain attack. This rule identifies when previously disabled repositories are re-enabled or modified to become active, potentially re-exposing malicious release tags to downstream users.
Detects high-volume file access or download activity by a single user in SharePoint or OneDrive over a 15-minute window. This behavior is indicative of bulk cloud data exfiltration often associated with extortion campaigns.
Detects high-volume, automated enumeration of cloud resources (SharePoint, OneDrive, or Exchange) via Graph API or search queries immediately following a user sign-in event. This behavior is indicative of session hijacking (token replay) followed by unauthorized scripted discovery, as opposed to legitimate user browsing activity.
This rule detects potentially malicious messages within Microsoft Teams that use common social engineering keywords related to security configuration changes (e.g., passkey, MFA, SSO). The detection specifically filters for users who have successfully logged in within the last 30 days to identify potential compromised accounts acting as internal senders.
This rule captures all successful login events to serve as the foundational data source for downstream correlation engines. It is designed to identify suspicious patterns such as credential reuse across disparate IP addresses, anomalous device fingerprints following MFA, or account logins shortly after phishing visits. This filter acts as a raw event provider for more complex logic that cannot be evaluated within a single-event context.
This rule detects potentially unauthorized access or downloading of files from SharePoint and OneDrive, as well as specific MailItemsAccessed events associated with known exfiltration toolkit patterns within Microsoft 365. It flags individual events matching these criteria as a baseline for identifying suspicious data access behaviors.
Detects successful user logins to accounts with names containing support-related terminology such as 'IT Support', 'Help Desk', or 'IT Department'. These accounts are often highly privileged or sensitive targets for credential abuse.
Detects anomalous, high-volume access to email items by specific applications known to be associated with suspicious activity or unusual access patterns within the Exchange environment, potentially indicating email harvesting or data exfiltration.
Detects sign-ins to Office Home or Office365 applications from unmanaged or unknown devices, followed by an unusual amount or variety of activity within SharePoint Online or OneDrive for Business within a two-hour window. This behavior is indicative of potential unauthorized access or account compromise where an actor is using a non-corporate device to interact with sensitive cloud documents.
Detects high-frequency search queries in SharePoint that utilize internal document identifiers (indexdocid), which may indicate an adversary attempting to enumerate or scrape content across a site collection.
Detects anomalous authentication patterns in Microsoft 365 logs where a valid session is utilized across multiple distinct devices within a short timeframe (under 5 minutes) without a corresponding multi-factor authentication (MFA) challenge. This behavior is indicative of a session token replay attack, where an adversary uses a stolen session cookie to bypass MFA and access cloud services.
This rule detects the creation of Git branches or tags using names that match the 40-character or 64-character hexadecimal format of Git commit hashes. This technique, identified in the context of Plugin4Shell, is used to spoof pinned-commit references, potentially misleading automated systems or developers into using malicious code versions.
Detects potential indirect prompt injection attacks against LLM agents. The rule monitors for ingested or retrieved content containing known injection patterns (e.g., hidden comments, 'system:' role spoofing) that is followed within 5 minutes by a privileged tool invocation by the agent, such as data exfiltration or system command execution.
Detects bulk uploads or downloads of AI/ML artifacts, such as model weights, datasets, and configuration files, to suspected personal or external cloud storage providers. This rule is designed to identify potential unauthorized exfiltration of proprietary AI/ML assets.
Detects anomalous AI orchestration or API gateway activity that suggests potential command and control (C2) communication. The rule monitors for unauthorized external endpoints, high-frequency low-payload beaconing patterns, and unauthorized cross-tenant agent-to-agent calls.
Detects anomalous spikes in AI/ML API usage for specific callers, including request volume, token count, and estimated costs, relative to a 7-day historical baseline. This activity is indicative of Cost Harvesting or Resource Exhaustion against pay-per-use AI services, mapped to the MITRE ATLAS framework.
Detects anomalous AI agent behavior characterized by excessive recursive tool-call chain depth or task durations exceeding the 95th percentile baseline. This activity is indicative of adversarial prompting designed to increase operational compute costs or induce resource exhaustion.
Detects anomalous query patterns against an AI inference API, characteristic of a membership inference attack. The rule identifies callers submitting a high volume of near-duplicate or minimally-perturbed inputs while requesting raw confidence scores, suggesting an attempt to probe the model to determine if specific data points were used in its training set.
Detects anomalous spikes in inference API request volume per caller, correlated with increased p95 latency and elevated error rates (5xx or 408). This behavior is characteristic of a denial-of-service attack targeting AI inference endpoints, potentially exhausting backend resources and disrupting service availability.
Detects sustained, statistically significant degradation in AI model performance (confidence and accuracy) and anomalous drift scores associated with specific callers or input sources. This behavior suggests a targeted attempt to erode model integrity through adversarial inputs rather than organic data drift.
Detects attempts to perform prompt injection or meta-prompt probing against an LLM gateway to extract confidential system instructions, as well as instances where the LLM response echoes sensitive system-level boilerplate consistent with a successful prompt extraction attack.
Page 46 of 142