Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,936
7,266
6,537
3,866
3,647
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects unauthenticated path traversal attempts targeting the GitLab repository commits API, specifically checking for URL-encoded and plain path traversal patterns (e.g., '../') in requests to the commits endpoint. This behavior is indicative of attempts to exploit vulnerabilities like CVE-2026-85706 to read arbitrary files outside the repository scope.
This rule detects SQL injection attempts targeting the BuddyBoss members REST endpoint, specifically identifying exploitation patterns associated with the 'sqlmap' tool. The rule monitors for specific URL parameters including 'member_type', 'search_terms', and 'scope' in combination with an 'sqlmap' user-agent, indicating an automated exploitation attempt against the application.
Detects anomalous access to sensitive Microsoft Graph API endpoints (messages, mailFolders, contacts) following a device-code authentication. The rule specifically flags activity from non-standard or generic client applications, which is a pattern often associated with post-compromise proxying or token abuse, such as the 'ARToken' technique.
Detects potential post-authentication persistent actions (e.g., OAuth app grants, MFA changes, mailbox rule updates) performed shortly after a successful Google Workspace login, specifically flagging actions originating from IP addresses different from the login session to identify session hijacking or token replay (AiTM) activity. Includes suppression for known corporate IP ranges, trusted OAuth application consents, and recurring user behavior.
Detects anomalous cloud authentication events occurring within a 3-hour window after suspected unauthorized access to sensitive configuration or credential files on a Vite development server. The rule flags sign-ins with high risk, anomalous location, or missing device compliance information, excluding trusted corporate locations and devices, serving as an indicator of potential post-exfiltration account takeover.
Detects anomalous cloud authentication events occurring within a 3-hour window after suspected unauthorized access to sensitive configuration or credential files on a Vite development server. The rule flags sign-ins with high risk, anomalous location, or missing device compliance information, excluding trusted corporate locations and devices, serving as an indicator of potential post-exfiltration account takeover.
Detects anomalous cloud authentication events occurring within a 3-hour window after suspected unauthorized access to sensitive configuration or credential files on a Vite development server. The rule flags sign-ins with high risk, anomalous location, or missing device compliance information, excluding trusted corporate locations and devices, serving as an indicator of potential post-exfiltration account takeover.
This rule detects potentially malicious interaction with specific GCP service account identifiers and client IDs. It monitors multiple log sources—including cloud audit logs, sign-in activity, security logs, and device network events—to identify unauthorized access, command and control communication, or data exfiltration attempts targeting Google API services (specifically oauth2.googleapis.com and sheets.googleapis.com).
Detects high-frequency access requests to SharePoint or OneDrive services using the 'python-httpx' library. This behavior is indicative of automated scraping or mass data retrieval often associated with malicious actors or unauthorized automated tools.
Detects users accessing files across SharePoint, OneDrive, or Exchange over a sustained period of at least 6 hours, while maintaining a low-to-moderate frequency (1-999 events per hour). This behavioral pattern may indicate slow, automated data exfiltration or unauthorized reconnaissance of sensitive files while attempting to stay under traditional volume-based alerting thresholds.
Detects user creation, capability granting, or role modification events occurring on WordPress sites where the Admin Menu Editor plugin (versions 2.35 or 2.36) is active and the associated user account has administrator privileges. This pattern is often indicative of exploitation of known vulnerabilities in this specific plugin to perform unauthorized administrative actions.
Detects internal phishing messages sent via Microsoft Teams that contain common credential-harvesting lures (e.g., passkey, MFA, SSO updates) where the sender account has also exhibited indicators of compromise within the preceding 24 hours, such as risky sign-ins or impossible travel.
Detects anomalous, high-frequency file access (100+ files within a 2-hour window) in Microsoft 365 (SharePoint or OneDrive) by users employing a Python-based HTTP client (python-httpx). This behavior is often indicative of automated data scraping, exfiltration, or bulk download activities performed by unauthorized scripts or compromised service accounts.
Detects specific authentication failure codes (50074, 50140) associated with MFA bypass and session persistence interruptions, which are characteristic of Adversary-in-the-Middle (AiTM) phishing attacks targeting modern authentication flows.
Detects file access or download operations performed by the python-httpx library within a specific cloud application context, which may indicate automated data retrieval or exfiltration attempts by scripts or custom tools.
This rule detects the addition of new multi-factor authentication (MFA) methods to an Azure AD or Entra ID user account. Adversaries often register new MFA methods (such as phone numbers or authenticator apps) to accounts they have compromised, enabling them to bypass existing MFA requirements and maintain persistent access to the target environment.
Detects usage of the 'One Outlook Web' application (ApplicationId 20893) to access Microsoft 365 Exchange REST APIs. This activity is a potential precursor to high-volume mailbox data exfiltration and should be monitored for volumetric anomalies.
Detects instances where a large volume of data (greater than 5GB) is transferred through an anonymous proxy using specific cloud application IDs. This pattern is indicative of potential data exfiltration via third-party or obscured network channels.
Detects a multi-stage sequence of network connections to Microsoft cloud services (login.microsoftonline.com, graph.microsoft.com, and data exfiltration endpoints like sharepoint.com) consistent with Storm-3121/Storm-3032 adversary activity. This rule is designed for IDS/IPS monitoring of traffic patterns indicating authentication, reconnaissance, and potential data exfiltration from Microsoft 365 environments.
Detects anomalous access to WSO2 API Manager Store and Publisher endpoints involving the retrieval of sensitive information like consumer keys and secrets. The rule specifically targets requests authenticated with JWTs that exhibit headers indicative of 'alg=none' or other unsupported/forged algorithm patterns, often associated with CVE-2026-5430 exploitation attempts. The rule uses statistical baseline monitoring to identify volume spikes in requests to these sensitive paths.
Detects Microsoft Teams messages containing urgent language and themes related to passkey or SSO updates, which are indicative of a phishing attempt aimed at harvesting credentials or performing account takeover.
Page 66 of 142