Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,936
7,266
6,537
3,866
3,647
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects potential N0va-style phishing or token-exchange abuse where a user completes a device-code authentication flow, followed immediately by an access token usage from a different IP address or device. This sequence indicates an adversary has captured the resulting token/session and is attempting to bypass multi-factor authentication (MFA) to gain unauthorized access to cloud resources.
This rule detects SQL injection attempts targeting the BuddyBoss members REST endpoint, specifically identifying exploitation patterns associated with the 'sqlmap' tool. The rule monitors for specific URL parameters including 'member_type', 'search_terms', and 'scope' in combination with an 'sqlmap' user-agent, indicating an automated exploitation attempt against the application.
Detects high-frequency, multi-action data access events through the Microsoft Graph API, indicative of automated exfiltration of Exchange, SharePoint/OneDrive, and Teams data. This behavior is consistent with an adversary using stolen OAuth access tokens to perform bulk enumeration and extraction of sensitive cloud-hosted data.
Detects high-frequency, multi-action data access events through the Microsoft Graph API, indicative of automated exfiltration of Exchange, SharePoint/OneDrive, and Teams data. This behavior is consistent with an adversary using stolen OAuth access tokens to perform bulk enumeration and extraction of sensitive cloud-hosted data.
Detects high-frequency, multi-action data access events through the Microsoft Graph API, indicative of automated exfiltration of Exchange, SharePoint/OneDrive, and Teams data. This behavior is consistent with an adversary using stolen OAuth access tokens to perform bulk enumeration and extraction of sensitive cloud-hosted data.
This rule monitors Office 365 SharePoint file operations and search queries for patterns indicative of automated discovery and exfiltration of sensitive content. It specifically identifies high-frequency search queries involving wildcard parameters used in SharePoint content indexing, which may suggest an adversary is systematically crawling or enumerating organizational documents.
This rule monitors for suspicious OAuth Device Code flow authentication attempts in Azure AD sign-in logs. It detects activity involving the device code protocol combined with specific error flags or indicators of potentially compromised or non-compliant devices (such as missing device IDs, non-compliant status, or empty trust types), which are indicative of Adversary-in-the-Middle (AiTM) phishing or token interception attacks.
Detects high-volume or multi-mailbox activity in Exchange Online, indicative of automated mailbox collection or unauthorized bulk data access via Graph or REST APIs. The rule monitors for a threshold of operations across multiple mailboxes or high event counts originating from specific API clients.
Detects signs of Adversary-in-the-Middle (AiTM) phishing attacks targeting cloud authentication. The rule monitors for access to suspicious domain patterns often used in AiTM phishing kits, specific MFA interruption errors (50074/50140) characteristic of proxy-based flows, and rapid successful logins from different IP addresses within a 15-minute window, suggesting session token theft and replay.
Detects potential lateral phishing attempts within Microsoft Teams by identifying a single user account sending messages containing common credential-harvesting lures (e.g., 'passkey', 'SSO', 'MFA', 'security update') to multiple internal recipients in a short timeframe.
This rule detects cloud file access (Download, Accessed, or Sync) originating from a Python-based user-agent (python-httpx) associated with specific Microsoft 365 applications, flagged by either an uncommon ISP or an uncommon user-agent for that specific user. This behavior is indicative of potential automated data collection or exfiltration attempts using programmatic access against cloud storage services.
This rule detects a correlation between an incoming email, SMS, or message containing phishing lure keywords related to 'passkey' or 'SSO' and 'update' requests, followed by a successful or attempted user sign-in from that recipient within a 2-hour window. This behavior is indicative of a social engineering campaign aimed at credential or token theft.
Detects cloud data access or file download operations in Microsoft 365 (SharePoint, OneDrive, Exchange) performed by a user agent string associated with the python-httpx library. This pattern is often indicative of automated data exfiltration using custom scripts.
Detects login events to the 'My Sign-Ins' portal (mysignins.microsoft.com) by users. This portal is a high-value target for adversaries who have gained access to a session via token theft or session hijacking, as it allows them to modify or add authentication methods (such as MFA devices) to establish long-term persistence in the victim's account.
Detects high-volume or large-size file access, download, or preview activity originating from known anonymous proxy IP addresses. This behavior is indicative of potential data exfiltration or unauthorized scraping of sensitive documents from cloud storage.
This rule detects potential adversary-in-the-middle (AiTM) or device-code authentication attacks where a user reports suspicious vishing (voice phishing) or SMS lures involving passkeys or SSO updates. The rule correlates user-reported social engineering pretexts with evidence of risky authentication flows, such as device code usage or specific authentication error codes associated with interception.
Detects successful API requests to sensitive administrative endpoints on WSO2 systems that lack a corresponding legitimate authentication event (session) from the same SourceIP and user pair, which may indicate the use of forged JWTs or authentication bypass exploitation (e.g., CVE-2026-5430).
Detects anomalous access to WSO2 API Manager Store and Publisher endpoints involving the retrieval of sensitive information like consumer keys and secrets. The rule specifically targets requests authenticated with JWTs that exhibit headers indicative of 'alg=none' or other unsupported/forged algorithm patterns, often associated with CVE-2026-5430 exploitation attempts. The rule uses statistical baseline monitoring to identify volume spikes in requests to these sensitive paths.
Detects high-volume deletion or recycling of files within OneDrive or SharePoint for a specific user, which may indicate malicious activity such as data destruction, ransomware, or unauthorized data exfiltration staging.
Detects bulk file deletion activities (three or more files deleted or moved to the recycle bin) within SharePoint or OneDrive by a specific user within a 30-minute window, which may indicate malicious activity or data destruction.
Detects network traffic directed towards Microsoft Graph API that utilizes the 'python-httpx' User-Agent. This combination is often associated with automated scripts, potentially used by adversaries (e.g., Storm-3121/Storm-3032) for automated data collection and exfiltration from Microsoft 365 environments.
Page 61 of 142