Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,750 detections
Filters
Last updated
All Time
Detection languages
2,544
328
307
253
149
Contributors
953
720
641
297
173
Categories
1,245
994
880
773
476
Platforms
2,850
1,449
1,229
356
73
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
1,096
989
950
912
820
CVEs
17
6
2
1
1
IDS Classtypes
9
4
3
2
2
IDS Protocols
21
1
This rule detects various malicious indicators of compromise (IOCs) across multiple telemetry sources, including DNS queries, web network traffic, file executions, process creation, and email activity. It monitors for interactions with known malicious domains, URLs, file hashes, and specific sender email addresses to identify potential malware distribution or C2 activity.
This rule detects known malicious activity including network connections to a specific C2 IP address (69.48.229.140), downloading files from specific C2 URLs, the presence of known malicious file hashes (SHA256), and communications involving specific actor-associated email addresses.
This rule performs an indicator of compromise (IOC) sweep for activities associated with the TOPHIT / VHX Harvester / @prime0 NPM typosquatting campaign. It detects known malicious C2 network connections (IPs and URLs), file artifacts (hashes) on endpoints, and suspicious email activity involving specific operator email addresses.
Detects instances where a user account registers a new MFA security method shortly after an initial successful sign-in from an unfamiliar device or network (Autonomous System Number). This behavioral pattern is characteristic of attackers, such as ShinyHunters vishing operators, who gain initial access via compromised credentials and subsequently enroll their own MFA devices to establish persistent access.
Detects unauthorized configuration or content changes (e.g., login or portal pages) performed outside of standard business hours by user accounts that have recently exhibited high-risk or compromised authentication behavior. This pattern aligns with tactics observed in the ShinyHunters playbook where compromised accounts are used to deface public-facing applications.
Detects a burst of file access or download operations from SharePoint or OneDrive by a single user account within a short timeframe. This behavior is indicative of bulk data collection or exfiltration, often associated with post-credential-theft activity where an attacker stage and extract organizational data.
Detects emails from free-mail domains (@mail.com or @outlook.com) that contain a specific malicious infrastructure indicator in the InternetMessageId or originate from a known suspicious IP address associated with TA419-style spoofing campaigns. This indicates the email was relayed through unauthorized infrastructure rather than the expected legitimate mail providers.
Detects a multi-stage social engineering chain attributed to TA419. The activity begins with a benign trust-building email from specific domains or addresses, followed by a subsequent email to the same recipient containing a link to a known URL shortener or redirector, indicating a potential AitM phishing sequence.
This rule monitors for the addition of new credentials (secrets) to service principals or applications in an Azure/Entra ID environment. It then correlates this event with subsequent mailbox activity (such as accessing mail items, sending mail, or message binding) performed by the application within 7 days of the credential creation. This detection pattern is indicative of potential OAuth application-based persistence and mailbox data exfiltration.
This rule detects activity involving known malicious indicators of compromise (IOCs), including specific IP addresses, domains, and file hashes. It monitors network connections, file system activity, process execution, and email attachments, filtering out common security tools to reduce noise.
Detects high-risk operations performed by the Entra ID/AAD Connect synchronization service account (e.g., Sync_* or ADToAADSyncServiceAccount). This account, which often holds broad directory permissions, is a prime target for attackers to gain persistence or escalate privileges within the cloud directory. The rule monitors for unauthorized sign-ins, sensitive configuration changes (such as modifications to federation trust, authentication policies, or directory synchronization settings), and password resets targeting the sync account itself.
Detects modifications to Entra ID (formerly Azure AD) that disable security defaults, per-user MFA enforcement, or conditional access policies requiring MFA. Such actions remove tenant-wide MFA protection and are often precursors to account takeover, password spraying, or ransomware attacks.
Detects the assignment of high-privilege Azure directory roles to a service principal identity. Threat actors may leverage this behavior to establish persistent, non-interactive backdoor access in a cloud tenant, bypassing MFA and sign-in scrutiny.
This rule detects when a new password credential (client secret) is added to an existing Azure AD Service Principal or application. This activity is a common method for adversaries to establish persistence in a cloud environment that survives password resets or MFA enforcement on the original administrative account.
Detects unauthorized modifications to Microsoft Entra Conditional Access (CA) policies, including deleting policies, disabling them, removing MFA requirements, or excluding specific users. These actions are common techniques used by adversaries to establish persistence or facilitate unauthorized access by weakening security controls.
Detects instances where a user grants an OAuth application consent to high-risk scopes (such as mail reading, file access, or directory reading) without administrator oversight. This behavior is a common indicator of OAuth abuse where an attacker lures a user into granting excessive permissions to a malicious application, providing the attacker persistent access to the user's data.
Detects when a user registers a new multi-factor authentication (MFA) method, such as an authenticator app, phone number, or FIDO key, within 30 minutes of a sign-in event flagged as anomalous (e.g., impossible travel, new ASN, or risky sign-in score). This pattern is indicative of an adversary establishing persistence by registering their own MFA device to maintain access to a compromised account after a session hijack.
Detects the creation or modification of inbox rules in Microsoft 365 Exchange environments that perform suspicious actions such as forwarding, redirecting, moving, or deleting emails. This rule specifically monitors for rule configurations that target potentially sensitive keywords, indicating a likely attempt to exfiltrate data, hide security alerts, or intercept communications.
Detects MFA or security information registration, updates, or deletions within Entra ID AuditLogs that occur within two hours of a sign-in event flagged as risky, impossible travel, or involving a new device. This sequence is a common indicator of post-compromise identity persistence.
This rule correlates endpoint security alerts for popular information-stealer malware (Lumma, StealC, Vidar, RedLine, Acreed, Atomic Stealer) with subsequent successful cloud identity authentication events from the same user account. The correlation window is set to 72 hours following an endpoint infostealer detection, which suggests potential account takeover or unauthorized access facilitated by credentials stolen from a compromised endpoint.
Detects mass device management actions (e.g., remote wipe, retire, or delete) performed via the Microsoft Intune console by a user who has simultaneously exhibited risky sign-in behavior, potentially indicating a compromised administrative account.
Page 8 of 179