Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,936
7,266
6,537
3,866
3,647
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects anomalous authentication patterns indicative of session token replay attacks. The rule identifies instances where a user successfully performs an MFA-authenticated, interactive sign-in, followed shortly (within 5-60 minutes) by a single-factor sign-in for the same user. The suspicious activity is characterized by a shift to a different IP/ASN, an unmanaged device (non-trusted), and a change in browser or OS identifiers, all while the user's geolocation (city/country) remains consistent. This behavioral pattern is highly consistent with the use of residential proxy infrastructure to replay stolen session tokens, effectively bypassing MFA.
Detects a suspicious sequence of interactive sign-ins to Microsoft management and profile-related applications from unmanaged devices occurring within a tight 15-minute window. This behavior is indicative of post-compromise activity, potentially associated with activity clusters such as UNC6671, where an attacker interacts with account settings shortly after compromising a session.
Detects anomalous access to Microsoft 365 services (OneDrive, SharePoint, Mail) where the user activity is characterized by a high volume of operations (more than 30) across a diverse set of objects (more than 15) within a one-hour window. The detection focuses on activity originating from specific common automation/scripting User-Agents (Microsoft Graph, Python httpx/requests) that deviate from typical, focused service account behavior.
This rule detects suspicious, high-volume file access or download operations in SharePoint and OneDrive. It filters for activities performed by specific user agents commonly associated with automated scripting tools (e.g., python-requests, Microsoft.Graph.Client), which indicates potential automated exfiltration or unauthorized bulk data collection.
Detects CI/CD job activity referencing shell commands that redirect the entire environment to a file (e.g. 'env > out.tmp'), the exact pattern that caused a GitLab CI job in the openconnect/ocserv project to dump secrets into a public build artifact, leaking a high-privilege personal access token with Owner access to GnuTLS and 55 other critical projects.
Detects anomalous, high-value wire transfers involving keywords related to advance-payment or M&A-related fraud (e.g., 'advance retainer'), directed towards beneficiaries in Hong Kong using previously unseen bank accounts. The rule effectively filters out known, approved beneficiary accounts to focus on potentially malicious transactions.
Detects a GitLab personal access token/response indicating Owner-level (access_level 50) group access combined with the broad 'api' scope on the sensitive gnutls/gnutls project -- the excessive standing-privilege pattern that turned one leaked token into a 55-project exposure.
Detects the sensitive project-wide CI/CD variable API_TOKEN being exposed to job scopes other than the gitlab-triage automation job that is its only intended consumer, expanding the blast radius of the credential.
Detects unauthenticated GET requests to GitLab CI/CD job artifact download endpoints on a public repository, which can expose leaked secrets bundled into build artifacts.
Detects anomalous authentication attempts where a single source IP validates a high volume of distinct Service Principal or App Client IDs within a short timeframe with a high failure rate. This pattern is indicative of attackers performing bulk validation of stolen API keys or OAuth credentials, likely harvested through mobile application decompilation (APK/IPA analysis).
Detects high-velocity publication of Ruby packages by an account that uses naming conventions related to 'OAI' or a known-malicious contact email. This behavior is indicative of a supply chain attack involving the automated deployment of numerous malicious packages to the RubyGems ecosystem.
Detects high-velocity publication of Ruby packages by an account that uses naming conventions related to 'OAI' or a known-malicious contact email. This behavior is indicative of a supply chain attack involving the automated deployment of numerous malicious packages to the RubyGems ecosystem.
Detects anomalous, non-interactive sign-in activity in Microsoft 365 that suggests session cookie replay (Pass-the-Cookie). The rule correlates successful, MFA-validated interactive sign-ins against subsequent, non-interactive sign-ins that lack MFA, occur from a different device and IP address within a short time window, and bypass standard interactive re-authentication.
This rule monitors various logs (email, entra, device, graph, cloud) for IP addresses (source or remote) that match a specific CIDR range (160.79.104.0/21). This is typically used to identify traffic originating from or communicating with infrastructure identified as malicious or suspicious by threat intelligence.
This rule monitors various logs (email, entra, device, graph, cloud) for IP addresses (source or remote) that match a specific CIDR range (160.79.104.0/21). This is typically used to identify traffic originating from or communicating with infrastructure identified as malicious or suspicious by threat intelligence.
This rule monitors various logs (email, entra, device, graph, cloud) for IP addresses (source or remote) that match a specific CIDR range (160.79.104.0/21). This is typically used to identify traffic originating from or communicating with infrastructure identified as malicious or suspicious by threat intelligence.
Detects instances where a high-value security or transaction-related notification email is received concurrently with a burst of non-essential bulk or subscription-based emails. This pattern is indicative of an email-bombing (inbox flooding) attack, often used to bury critical alerts and mask malicious activity such as unauthorized account access or fraudulent financial transactions.
Detects sessions using shared Grafana service account tokens that perform both read-only and action-capable tool operations without confirmed prior authentication. This behavior is indicative of an unauthenticated or spoofed session leveraging a service account's excessive permissions, bypassing standard authentication flows.
Detects anomalous reuse of an authenticated Microsoft 365 session cookie shortly after a successful MFA-satisfied sign-in. The detection identifies scenarios where the subsequent access originates from a different IP address, device, or user agent without an intervening MFA challenge, which is a pattern indicative of session hijacking techniques like Adversary-in-the-Middle (AiTM) or session token replay.
This rule detects potential unauthenticated access or unauthorized configuration modifications to an AI agent management backend. It monitors HTTP logs for requests targeting configuration endpoints that lack proper authentication, specifically identifying attempts to retrieve sensitive information like Dify or Coze keys, or attempts to inject new agent configurations via unauthenticated POST requests.
Detects unauthenticated execution of sensitive Grafana MCP tools (tools/call, grafana_api_request) by identifying session IDs that lack a corresponding authenticated handshake event. This behavior is indicative of potential session spoofing or abuse of the MCP protocol where an attacker attempts to interact with privileged tools without performing a valid authentication handshake.
Page 81 of 142