Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,866 detections
Filters
Last updated
All Time
Detection languages
2,525
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,091
792
575
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
1,755
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Detects the use of the default, hardcoded 'sk-1234' secret key for HS256 JWT signing in LiteLLM proxy logs. This configuration is insecure and allows for the forgery of arbitrary user session tokens.
Detects the use of the default, hardcoded 'sk-1234' secret key for HS256 JWT signing in LiteLLM proxy logs. This configuration is insecure and allows for the forgery of arbitrary user session tokens.
Detects the use of the default, hardcoded 'sk-1234' secret key for HS256 JWT signing in LiteLLM proxy logs. This configuration is insecure and allows for the forgery of arbitrary user session tokens.
This rule detects rapid enumeration of Azure AD identity and configuration components by identifying a burst of specific, high-level administrative API calls (Get user flows, Get API connectors, Get identity providers, Get user attributes) within a short window. This pattern is indicative of reconnaissance activities aimed at mapping out the identity provider configuration.
This rule monitors for various types of events (user logons, network connections, API audits, cloud app events, and email traffic) originating from a specific CIDR block (160.79.104.0/21), which is flagged as suspicious or unauthorized.
Detects inbound traffic, sign-ins, and email activity originating from the Anthropic IP range 160.79.104.0/21.
Detects inbound traffic, sign-ins, and email activity originating from the Anthropic IP range 160.79.104.0/21.
Detects inbound traffic, sign-ins, and email activity originating from the Anthropic IP range 160.79.104.0/21.
This rule detects various event types (email, identity authentication, network connections, and cloud audit logs) originating from or interacting with the specific IP address range 160.79.104.0/22 to 160.79.111.0/22, which is associated with known malicious activity.
Detects high-frequency creation and revocation of service principal credentials, indicating potential malicious credential cycling, or unusual bursts of service account JWT/refresh token rotation across multiple IP addresses, which may indicate an attempt to evade detection or maintain persistence.
Detects high-frequency creation and revocation of service principal credentials, indicating potential malicious credential cycling, or unusual bursts of service account JWT/refresh token rotation across multiple IP addresses, which may indicate an attempt to evade detection or maintain persistence.
Detects high-volume image pull activity against an Azure Container Registry from a single identity, which may indicate reconnaissance or mass harvesting of container images to extract embedded credentials, secrets, or source code.
Detects anomalous authentication attempts where a single source IP validates a high volume of distinct Service Principal or App Client IDs within a short timeframe with a high failure rate. This pattern is indicative of attackers performing bulk validation of stolen API keys or OAuth credentials, likely harvested through mobile application decompilation (APK/IPA analysis).
This rule detects potential Server-Side Request Forgery (SSRF) activity where web application or runtime processes attempt to access the Cloud Instance Metadata Service (IMDS) or container task metadata endpoints. By monitoring network connections and application logs, the rule filters out known legitimate metadata clients and identifies suspicious processes frequently associated with web-based vulnerabilities that are repeatedly querying sensitive metadata paths.
Detects automated directory fuzzing attempts against Azure Storage blobs targeting sensitive files like .env, .pem, or configuration files. The rule identifies suspicious activity by aggregating requests from Anonymous or SAS-authenticated sources that exhibit high request volumes and access to multiple distinct sensitive paths, while excluding known legitimate bulk-transfer and synchronization tools.
This rule monitors for high-volume, suspicious activity involving the enumeration of sensitive cloud resources across multiple Azure services (e.g., Kubernetes cluster secrets, KeyVault secrets, Backup vault items, and DataFactory/Web connections). An alert is triggered when a single identity performs a high number of operations across multiple distinct resource types within a one-hour window, which is indicative of credential harvesting or cloud reconnaissance.
This rule monitors for high-volume, suspicious activity involving the enumeration of sensitive cloud resources across multiple Azure services (e.g., Kubernetes cluster secrets, KeyVault secrets, Backup vault items, and DataFactory/Web connections). An alert is triggered when a single identity performs a high number of operations across multiple distinct resource types within a one-hour window, which is indicative of credential harvesting or cloud reconnaissance.
This rule monitors for high-volume, suspicious activity involving the enumeration of sensitive cloud resources across multiple Azure services (e.g., Kubernetes cluster secrets, KeyVault secrets, Backup vault items, and DataFactory/Web connections). An alert is triggered when a single identity performs a high number of operations across multiple distinct resource types within a one-hour window, which is indicative of credential harvesting or cloud reconnaissance.
This rule monitors for high-volume, suspicious activity involving the enumeration of sensitive cloud resources across multiple Azure services (e.g., Kubernetes cluster secrets, KeyVault secrets, Backup vault items, and DataFactory/Web connections). An alert is triggered when a single identity performs a high number of operations across multiple distinct resource types within a one-hour window, which is indicative of credential harvesting or cloud reconnaissance.
Detects anomalous, large-scale cloning or mirroring of code repositories combined with targeted access to infrastructure-as-code configuration files (e.g., .tfvars, .tfstate) or automated exfiltration of CI/CD build artifacts. This behavior is indicative of an adversary attempting to exfiltrate proprietary source code or sensitive secrets stored within repositories.
Detects anomalous, large-scale cloning or mirroring of code repositories combined with targeted access to infrastructure-as-code configuration files (e.g., .tfvars, .tfstate) or automated exfiltration of CI/CD build artifacts. This behavior is indicative of an adversary attempting to exfiltrate proprietary source code or sensitive secrets stored within repositories.
Page 76 of 185