Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,936
7,266
6,537
3,866
3,647
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
This rule detects administrative changes (create, update, delete) to Cloudflare DNS records, load balancer pools, or origin pools specifically associated with 'registry.coder.com', as well as anomalous login and API token activity on the Cloudflare account. Such activity may indicate unauthorized configuration tampering, potential account compromise, or malicious modifications to critical infrastructure endpoints.
Detects anomalous sign-in behavior where a device code authentication flow is initiated from one location, but the resulting session is replayed from a different IP address in a different country within a one-hour window. This behavior is indicative of an adversary capturing an authentication token via a device code phishing or relay attack and attempting to use it from their own infrastructure to bypass conditional access policies and MFA.
Detects high-value wire transfers (>= €600,000) directed to beneficiaries in Hong Kong that contain suspicious memo or description fields related to confidential acquisitions or professional service retainers, potentially indicating business email compromise (BEC) or fraudulent financial activity.
Detects protected-branch configuration changes on the gnutls_3_7_x release branch that weaken push/merge controls (developers_can_push/merge enabled), reducing supply-chain code-review protections.
Detects GitLab's personal_access_tokens/self endpoint being queried via GET, the reconnaissance step a leaked token uses to confirm its own scopes and privilege level.
Detects a single GitLab token/account holding Owner-level access across an unusually large number of projects (50+), the standing-privilege condition that turned one leaked token into a 55-project supply-chain exposure.
Detects anomalous volumes of incoming emails to support aliases that contain keywords related to customer service complaints and include URLs pointing to suspicious '.shop' domains, characteristic of 'DoppelCart' or similar fake-shop impersonation phishing campaigns.
Detects JFrog Artifactory access-token issuance events on/after the suspected compromise window (2026-08-28) where the token is tied to the anonymous identity, granted administrator scope, or has no attributable initiating user, per Fastly's remediation guidance.
Detects anomalous, large-scale cloning or mirroring of code repositories combined with targeted access to infrastructure-as-code configuration files (e.g., .tfvars, .tfstate) or automated exfiltration of CI/CD build artifacts. This behavior is indicative of an adversary attempting to exfiltrate proprietary source code or sensitive secrets stored within repositories.
Detects interaction with known infrastructure associated with the PREY-0058 campaign, which utilizes Adversary-in-the-Middle (AiTM) phishing lures mimicking passkey or MFA registration pages to target Microsoft 365 and other SaaS applications.
Detects a suspicious sequence of events within JFrog Artifactory where an account accesses sensitive code-signing material (rubygems/gemspec/signing keys) and subsequently performs administrative actions (user addition/role assignment/privilege escalation) within a one-hour window, indicating potential account takeover or exploitation.
Detects a suspicious sequence of events within JFrog Artifactory where an account accesses sensitive code-signing material (rubygems/gemspec/signing keys) and subsequently performs administrative actions (user addition/role assignment/privilege escalation) within a one-hour window, indicating potential account takeover or exploitation.
Detects the creation of git branches named as a 40-character hexadecimal string, which corresponds to a full commit SHA. This naming convention is a technique used to perform checkout-hijacking, potentially allowing an attacker to override files or deceive automated processes that rely on branch-specific logic.
This rule detects potentially malicious OAuth application consent grants in Microsoft Entra ID (formerly Azure AD). It monitors for consent events involving high-risk scopes by non-verified publishers, instances of admins attempting to bypass consent requirements, and follows up by checking for unusually high activity (sign-ins or resource access) from the newly consented application within a short timeframe.
Detects the creation or modification of Power Automate flows that involve potentially sensitive external services or personal email providers, which may indicate data exfiltration or unauthorized integration setup.
Detects anomalous, high-frequency mailbox search and access activity targeting financial-related keywords (e.g., invoices, wire transfers, bank details). This behavior pattern is frequently observed during business email compromise (BEC) attacks, where adversaries utilize OAuth tokens to triage mailboxes for sensitive payment information.
This rule identifies potential MFA fatigue attacks by detecting multiple MFA denial or failure events for a user within a 30-minute window, followed by a successful authentication for the same user in the same time frame.
This rule monitors for various types of events (user logons, network connections, API audits, cloud app events, and email traffic) originating from a specific CIDR block (160.79.104.0/21), which is flagged as suspicious or unauthorized.
Detects successful sign-ins where Multi-Factor Authentication (MFA) was approved using the 'PhoneAppOTP' method, specifically where the method was registered by the user prior to the observed sign-in timeframe. This pattern can indicate an adversary using an actor-controlled MFA device registered previously to maintain persistent access to a compromised account.
This rule monitors Microsoft Graph API audit logs for suspicious patterns indicative of automated discovery or enumeration of SharePoint and OneDrive environments. It detects high-frequency access to sensitive API endpoints (such as /sites, /drives, or /children) and the use of pagination parameters (skiptoken, top) within short time intervals, which are common techniques used to crawl and inventory organizational data at scale.
This rule monitors Microsoft Graph API audit logs for suspicious patterns indicative of automated discovery or enumeration of SharePoint and OneDrive environments. It detects high-frequency access to sensitive API endpoints (such as /sites, /drives, or /children) and the use of pagination parameters (skiptoken, top) within short time intervals, which are common techniques used to crawl and inventory organizational data at scale.
Page 68 of 142