Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,934
7,266
6,535
3,866
3,646
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
This rule monitors Salesforce lead creation events for potential prompt-injection payloads. It identifies submissions containing common AI manipulation instructions, HTML tags, or suspicious outbound URLs, which could be used to hijack internal user sessions or execute malicious content within the Salesforce environment.
This rule monitors Salesforce lead creation events for potential prompt-injection payloads. It identifies submissions containing common AI manipulation instructions, HTML tags, or suspicious outbound URLs, which could be used to hijack internal user sessions or execute malicious content within the Salesforce environment.
This rule monitors Salesforce lead creation events for potential prompt-injection payloads. It identifies submissions containing common AI manipulation instructions, HTML tags, or suspicious outbound URLs, which could be used to hijack internal user sessions or execute malicious content within the Salesforce environment.
This rule detects Salesforce Agentforce or similar AI-driven chat responses that contain external URLs with non-standard Top-Level Domains (TLDs). It identifies cases where the organization's redactor failed to strip a URL due to unexpected TLDs or unusual trailing termination characters (e.g., brackets) that are still rendered as clickable links in the interface. Such links may facilitate phishing, credential harvesting, or redirection to malicious sites.
This rule detects Salesforce Agentforce or similar AI-driven chat responses that contain external URLs with non-standard Top-Level Domains (TLDs). It identifies cases where the organization's redactor failed to strip a URL due to unexpected TLDs or unusual trailing termination characters (e.g., brackets) that are still rendered as clickable links in the interface. Such links may facilitate phishing, credential harvesting, or redirection to malicious sites.
This rule detects Salesforce Agentforce or similar AI-driven chat responses that contain external URLs with non-standard Top-Level Domains (TLDs). It identifies cases where the organization's redactor failed to strip a URL due to unexpected TLDs or unusual trailing termination characters (e.g., brackets) that are still rendered as clickable links in the interface. Such links may facilitate phishing, credential harvesting, or redirection to malicious sites.
Detects anomalous Agentforce session activity where a user, via the General CRM subagent, queries Lead records followed shortly by an access request to Account records. This pattern is indicative of a potentially hijacked agent session attempting to pivot from lead review into unauthorized data access of broader customer information.
Detects successful authentication events using the OAuth 2.0 device code flow. While a legitimate authentication method for devices without web browsers, this protocol is frequently abused by attackers in 'device code phishing' attacks to harvest access tokens and gain unauthorized access to cloud and SaaS applications.
This rule detects potentially suspicious reconnaissance activity against the Microsoft Graph API. It monitors for high volumes of diverse requests originating from a single account within a 30-minute window, specifically targeting multiple distinct object types such as users, groups, sites, and applications. Such behavior is indicative of an adversary attempting to enumerate or map the target cloud environment.
Detects instances where a removed GitHub organization member performed bulk repository access (cloning or downloading) shortly before their removal, potentially indicating exploitation of retained access by a departed employee or an adversary using a valid account before deprovisioning. The rule identifies activity occurring more than 24 hours prior to removal involving multiple repositories or multiple access actions.
Detects the creation or modification of email inbox rules that perform suspicious actions such as deleting, moving to folders, or forwarding emails, specifically when those rules target keywords associated with sensitive financial or business communications like invoices, payments, or wire transfers. This behavior is indicative of an attacker attempting to hide evidence of a compromise or intercept sensitive business communications.
This rule detects successful user logins that utilize the 'deviceCode' authentication protocol in conjunction with suspicious network indicators, specifically traffic originating from residential proxies. This combination is highly indicative of potential phishing or unauthorized access attempts using stolen session tokens or bypassed MFA mechanisms.
This rule detects successful user logins utilizing the OAuth 2.0 device authorization grant flow where Multi-Factor Authentication (MFA) was bypassed, not applied, or not performed. The device code flow is a common vector for phishing attacks where users are tricked into entering a device code on a malicious site, potentially leading to unauthorized token acquisition.
Detects attempts to exploit the GitLab commits API via path traversal or direct file path manipulation to access sensitive configuration files or system secrets, such as gitlab-secrets.json, database.yml, or system files like /etc/passwd.
Detects high-volume or sequential Microsoft Graph API requests targeting sensitive directory, mailbox, application, and site endpoints. This behavior is consistent with reconnaissance activity where an adversary enumerates users, groups, service principals, and accessible resources within a compromised cloud tenant.
This rule detects non-interactive authentication attempts to key development and collaboration platforms (e.g., GitHub, GitLab, Slack, Azure DevOps) from IP addresses or locations that have not been observed in the user's interactive sign-in history over the past 14 days. This behavior is indicative of potential session or refresh token theft, where an adversary replays stolen browser cookies from a different infrastructure to bypass traditional authentication.
Detects when a user registers a new MFA or authentication method, such as a software token or authenticator app, within one hour of a suspicious sign-in event. This pattern is commonly indicative of an adversary establishing persistence or bypassing authentication controls following account compromise via phishing or credential harvesting.
This rule detects successful or attempted sign-ins to Microsoft Entra ID using the OAuth 2.0 device authorization grant flow. This specific authentication flow is increasingly leveraged by adversaries in passkey-themed phishing campaigns to obtain valid access and refresh tokens without requiring direct credential or cookie theft. By monitoring for this protocol usage, security teams can identify potential attempts to bypass traditional authentication mechanisms.
Detects attempts to exploit a path traversal vulnerability in the GitLab commits API, specifically targeting the /api/v4/projects/ repository/commits path. The rule monitors for directory traversal patterns such as .. or url-encoded variations in conjunction with file paths, which could allow unauthorized access to files outside the intended directory.
Detects modifications to a user account's authentication methods, specifically when an increase in the number of configured multi-factor authentication (MFA) devices or methods occurs. This is often associated with an adversary enrolling their own device to bypass MFA or maintain persistent access.
Detects successful API requests to sensitive administrative endpoints on WSO2 systems that lack a corresponding legitimate authentication event (session) from the same SourceIP and user pair, which may indicate the use of forged JWTs or authentication bypass exploitation (e.g., CVE-2026-5430).
Page 50 of 142