Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,936
7,266
6,537
3,866
3,647
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
This rule monitors various logs (email, entra, device, graph, cloud) for IP addresses (source or remote) that match a specific CIDR range (160.79.104.0/21). This is typically used to identify traffic originating from or communicating with infrastructure identified as malicious or suspicious by threat intelligence.
Detects anomalous authentication attempts where a single source IP validates a high volume of distinct Service Principal or App Client IDs within a short timeframe with a high failure rate. This pattern is indicative of attackers performing bulk validation of stolen API keys or OAuth credentials, likely harvested through mobile application decompilation (APK/IPA analysis).
Detects anomalous authentication attempts where a single source IP validates a high volume of distinct Service Principal or App Client IDs within a short timeframe with a high failure rate. This pattern is indicative of attackers performing bulk validation of stolen API keys or OAuth credentials, likely harvested through mobile application decompilation (APK/IPA analysis).
Detects anomalous, large-scale cloning or mirroring of code repositories combined with targeted access to infrastructure-as-code configuration files (e.g., .tfvars, .tfstate) or automated exfiltration of CI/CD build artifacts. This behavior is indicative of an adversary attempting to exfiltrate proprietary source code or sensitive secrets stored within repositories.
Detects anomalous, large-scale cloning or mirroring of code repositories combined with targeted access to infrastructure-as-code configuration files (e.g., .tfvars, .tfstate) or automated exfiltration of CI/CD build artifacts. This behavior is indicative of an adversary attempting to exfiltrate proprietary source code or sensitive secrets stored within repositories.
Detects Microsoft 365 sign-in events where a session token is reused without a fresh MFA challenge, originating from known residential proxy service providers. This behavior is indicative of threat actors using stolen session tokens (Session Replay) to bypass MFA protections.
This rule detects potential OAuth token theft resulting from device code phishing (e.g., N0va phishkit). It monitors for a successful OAuth device-code authentication followed within 5 minutes by a secondary successful sign-in for the same user from a different IP address, different browser client, or different user agent, which is a common indicator of an adversary-in-the-middle (AiTM) session hijacking attempt.
Detects anomalous non-interactive sign-ins that bypass multi-factor authentication (MFA) requirements from a geographical location not previously seen in the user's historical sign-in baseline. This pattern is indicative of attackers using stolen OAuth access or refresh tokens to maintain persistence and bypass standard authentication controls.
Detects anomalous non-interactive sign-ins that bypass multi-factor authentication (MFA) requirements from a geographical location not previously seen in the user's historical sign-in baseline. This pattern is indicative of attackers using stolen OAuth access or refresh tokens to maintain persistence and bypass standard authentication controls.
Detects potential N0va-style phishing or token-exchange abuse where a user completes a device-code authentication flow, followed immediately by an access token usage from a different IP address or device. This sequence indicates an adversary has captured the resulting token/session and is attempting to bypass multi-factor authentication (MFA) to gain unauthorized access to cloud resources.
This rule detects SQL injection attempts targeting the BuddyBoss members REST endpoint, specifically identifying exploitation patterns associated with the 'sqlmap' tool. The rule monitors for specific URL parameters including 'member_type', 'search_terms', and 'scope' in combination with an 'sqlmap' user-agent, indicating an automated exploitation attempt against the application.
Detects anomalous, high-frequency access to sensitive Microsoft Graph API endpoints by a single service principal or user identity. The rule flags identities that interact with five or more distinct categories of sensitive resources (e.g., users, groups, applications, sites) within a 30-minute window, suggesting automated reconnaissance or environment discovery.
Detects anomalous, high-volume file access or download operations in SharePoint from a user agent identified as 'python-httpx'. This behavior is characteristic of automated scripts or potential data exfiltration attempts targeting cloud-based file storage.
Detects anomalous, non-interactive sign-in activity in Microsoft 365 that suggests session cookie replay (Pass-the-Cookie). The rule correlates successful, MFA-validated interactive sign-ins against subsequent, non-interactive sign-ins that lack MFA, occur from a different device and IP address within a short time window, and bypass standard interactive re-authentication.
Detects the publication or upload of RubyGems packages containing embedded Server-Side Template Injection (SSTI) payloads within their author metadata, specifically targeting common testing strings like '<%= 7*7 %>'. This behavior is indicative of supply chain testing or potential exploitation attempts against package registry infrastructure or downstream consumers.
Detects modifications to a user's multi-factor authentication (MFA) settings, including changes to registered phone numbers, authenticator app configurations, or the registration of new authentication methods. This activity can indicate an attempt to weaken security defenses or gain persistent, unauthorized access to an account via MFA bypass.
This rule detects when a user account updates their MFA information in Azure AD or Microsoft 365, resulting in an increase in the number of associated MFA devices. This is a common indicator of an attacker registering a new MFA device (such as a hardware token or phone app) to a compromised account to establish persistence or bypass existing MFA requirements.
Detects Microsoft Teams messages containing keywords related to authentication updates, passkey enrollment, or SSO changes combined with urgent language or calls to action (e.g., clicking links). The rule attempts to identify potential credential harvesting or account takeover attempts within the chat platform.
Detects incoming emails containing subject lines, body text, or URLs related to passkey, SSO, or MFA configuration updates. These indicators are often used in social engineering campaigns to lure users into providing credentials on fraudulent login pages.
Detects high-volume file access and download operations in SharePoint Online and OneDrive where the user agent is identified as 'python-httpx'. This behavior is indicative of automated exfiltration scripts potentially used in malicious cloud intrusion campaigns.
Detects a single identity, application, or IP address performing Graph API requests across multiple disparate categories (e.g., tenant, directory, privilege, application, repository, mailbox) within a short window. This pattern is indicative of automated reconnaissance or tenant enumeration, commonly performed during the post-compromise phase to map the environment prior to exfiltration.
Page 73 of 142