Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
472 detections
Filters
Last updated
All Time
Detection languages
342
74
19
16
7
Contributors
91
90
77
52
35
Categories
182
148
81
66
60
Platforms
406
68
63
58
26
Products / Services
10,680
9,761
6,694
4,418
3,744
472
MITRE Techniques
180
121
96
78
71
CVEs
6
5
5
5
2
IDS Classtypes
2
1
1
1
1
IDS Protocols
6
This rule detects potential exploitation attempts (CVE-2026-59822) against LiteLLM MCP tool endpoints. It identifies HTTP requests where the authorization bearer token is unusually short (<= 12 chars), lacks the 'sk-' prefix, and does not appear to be a valid JWT, yet successfully results in a 200 OK status, indicating a potential bypass of authentication logic.
This rule detects potential exploitation attempts (CVE-2026-59822) against LiteLLM MCP tool endpoints. It identifies HTTP requests where the authorization bearer token is unusually short (<= 12 chars), lacks the 'sk-' prefix, and does not appear to be a valid JWT, yet successfully results in a 200 OK status, indicating a potential bypass of authentication logic.
This rule correlates email sender activity with network, cloud, and identity logs by matching traffic against a specific IP range (160.79.104.0/21) identified as malicious or suspicious. The rule flags instances where this range appears as an email sender IP or as a remote/source IP address across various infrastructure indices, potentially indicating adversary communication or exfiltration.
Detects attempts by non-privileged (non-PROXY_ADMIN) API keys to modify pass-through routes in LiteLLM via configuration update endpoints. This activity is indicative of exploitation of CVE-2026-35029, which allows unauthenticated or low-privilege users to bypass configuration restrictions.
Detects the creation or update of LiteLLM custom code guardrails that include suspicious Python snippets, specifically 'import os' and 'os.popen', which are indicative of attempts to execute arbitrary OS commands via guardrail logic (CVE-2026-59821).
Detects 'GetBlob' operations on Azure Storage blobs that have extensions commonly associated with executable files, scripts, or archives, which may indicate the retrieval of malicious payloads.
This rule correlates email sender activity with network, cloud, and identity logs by matching traffic against a specific IP range (160.79.104.0/21) identified as malicious or suspicious. The rule flags instances where this range appears as an email sender IP or as a remote/source IP address across various infrastructure indices, potentially indicating adversary communication or exfiltration.
This rule correlates email sender activity with network, cloud, and identity logs by matching traffic against a specific IP range (160.79.104.0/21) identified as malicious or suspicious. The rule flags instances where this range appears as an email sender IP or as a remote/source IP address across various infrastructure indices, potentially indicating adversary communication or exfiltration.
Detects anomalous, high-frequency access to multiple distinct Microsoft Graph API endpoints (e.g., users, groups, applications) by a single user within a short timeframe, which is indicative of tenant-wide reconnaissance following identity compromise.
Detects anomalous, high-frequency access to multiple distinct Microsoft Graph API endpoints (e.g., users, groups, applications) by a single user within a short timeframe, which is indicative of tenant-wide reconnaissance following identity compromise.
This rule detects potential OAuth 2.0 device code phishing attempts by monitoring network activity for requests to common Microsoft OAuth device authorization endpoints. It flags requests that utilize a specific hardcoded client_id associated with known suspicious application registrations, combined with requested scopes for graph.microsoft.com and a Python-based user agent. This behavior is indicative of an adversary attempting to gain unauthorized access by tricking a user into authorizing a malicious application.
This rule detects potential OAuth 2.0 device code phishing attempts by monitoring network activity for requests to common Microsoft OAuth device authorization endpoints. It flags requests that utilize a specific hardcoded client_id associated with known suspicious application registrations, combined with requested scopes for graph.microsoft.com and a Python-based user agent. This behavior is indicative of an adversary attempting to gain unauthorized access by tricking a user into authorizing a malicious application.
This rule monitors for security-related account activities in Azure AD, specifically tracking self-service password resets, admin-led password resets, and changes to user security information. It aggregates these events by user to identify potential account manipulation, unauthorized password changes, or MFA registration abuse.
This rule detects potential exploitation attempts (CVE-2026-59822) against LiteLLM MCP tool endpoints. It identifies HTTP requests where the authorization bearer token is unusually short (<= 12 chars), lacks the 'sk-' prefix, and does not appear to be a valid JWT, yet successfully results in a 200 OK status, indicating a potential bypass of authentication logic.
This detection identifies enabled user accounts that have not had a successful sign-in for the last 90 days, highlighting potential security risks from dormant accounts.
This rule detects potential exploitation attempts (CVE-2026-59822) against LiteLLM MCP tool endpoints. It identifies HTTP requests where the authorization bearer token is unusually short (<= 12 chars), lacks the 'sk-' prefix, and does not appear to be a valid JWT, yet successfully results in a 200 OK status, indicating a potential bypass of authentication logic.
Detects the use of the default, hardcoded 'sk-1234' secret key for HS256 JWT signing in LiteLLM proxy logs. This configuration is insecure and allows for the forgery of arbitrary user session tokens.
Detects the creation or update of LiteLLM custom code guardrails that include suspicious Python snippets, specifically 'import os' and 'os.popen', which are indicative of attempts to execute arbitrary OS commands via guardrail logic (CVE-2026-59821).
Detects a single identity, application, or IP address performing Graph API requests across multiple disparate categories (e.g., tenant, directory, privilege, application, repository, mailbox) within a short window. This pattern is indicative of automated reconnaissance or tenant enumeration, commonly performed during the post-compromise phase to map the environment prior to exfiltration.
Detects high-frequency, automated requests to product and catalog pages within a short time window, characteristic of web scraping or catalog harvesting often used to feed fake-shop networks or build clone sites.
Detects high-frequency, automated requests to product and catalog pages within a short time window, characteristic of web scraping or catalog harvesting often used to feed fake-shop networks or build clone sites.
Page 8 of 23