Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,936
7,266
6,537
3,866
3,647
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects potential session replay or cookie theft attacks against Google Workspace accounts. The rule identifies anomalous session activity where a single session ID is associated with multiple country codes within a short timeframe (less than 60 minutes), suggesting that a stolen session token is being used by an adversary in a different location than the legitimate user.
Detects potential session replay or cookie theft attacks against Google Workspace accounts. The rule identifies anomalous session activity where a single session ID is associated with multiple country codes within a short timeframe (less than 60 minutes), suggesting that a stolen session token is being used by an adversary in a different location than the legitimate user.
This rule identifies potentially compromised Entra ID accounts by correlating multiple suspicious behaviors within a 14-day window. It aggregates four specific indicators: successful authentication following repeated MFA failures, impossible travel (sign-ins from multiple countries within a short timeframe), unusual hour logons (00:00-05:00), and sign-ins flagged with medium/high risk or reported as compromised. The rule triggers when an account exhibits two or more of these distinct anomalous behaviors.
Detects successful authentication to Microsoft Teams or Slack where MFA was successfully completed, but the device is reported as unmanaged or non-compliant and is accompanied by sign-in risk signals. This behavior is consistent with Adversary-in-the-Middle (AitM) proxy attacks where an attacker captures credentials and session tokens, bypassing MFA, and using the hijacked session from an unrecognized device or location.
Detects instances where Microsoft Copilot memory content (identified by hash) remains identical before and after a significant account security event, such as a password reset or session revocation. This behavior suggests that an adversary may have injected malicious or persistent data into the user's Copilot memory, which survives standard account remediation actions.
Detects instances where the Grafana MCP (Model Context Protocol) server's service account identity executes administrative tools (such as 'grafana_api_request') within a session that lacks a verified, prior authentication event (bearer token). This pattern suggests an adversary may be spoofing or hijacking a privileged service account session to perform unauthorized administrative actions.
Detects unauthenticated attempts to invoke Grafana API tools via the Model Context Protocol (MCP) by utilizing spoofed Mcp-Session-Id headers while bypassing bearer token authentication requirements. This primarily targets unauthorized access to API functionality on Grafana instances configured with bearer-token authentication (v1.1.0+).
Detects potential Server-Side Request Forgery (SSRF) attacks targeting Grafana instances. The rule identifies suspicious 'grafana_api_request' calls that occur shortly after an unauthenticated discovery call ('tools/call') within the same session, where the target URL in the request header is not included in a defined allowlist of known internal Grafana hosts.
Detects potential Server-Side Request Forgery (SSRF) attacks targeting Grafana instances. The rule identifies suspicious 'grafana_api_request' calls that occur shortly after an unauthenticated discovery call ('tools/call') within the same session, where the target URL in the request header is not included in a defined allowlist of known internal Grafana hosts.
Detects potential Server-Side Request Forgery (SSRF) attacks targeting Grafana instances. The rule identifies suspicious 'grafana_api_request' calls that occur shortly after an unauthenticated discovery call ('tools/call') within the same session, where the target URL in the request header is not included in a defined allowlist of known internal Grafana hosts.
Detects instances where unauthenticated users or sessions execute privileged 'tools/call' operations within the Grafana MCP dispatcher. This behavior is indicative of potential session spoofing attacks, specifically targeting vulnerabilities similar to CVE-2026-19516, where lack of an Authorization header allows unauthorized access to privileged tool functions.
Detects invocations of the 'grafana_api_request' tool that lack a preceding valid bearer-token authentication event for the same session. This indicates a potential scenario where a server or service account token is being used on behalf of an unauthenticated caller, bypassing normal authentication requirements for the Grafana API.
Detects role assignments made directly by a user, bypassing PIM workflow direct assignments are permanent, don't require approval, and don't expire
This rule detects OAuth authorization requests (targeting Microsoft or Google identity providers) that use 'prompt=none' (silent authentication) and redirect the user to an unexpected or untrusted domain. This pattern is commonly used in OAuth consent phishing or token theft attacks, where an attacker attempts to silently acquire an authorization code by redirecting it to a malicious application server instead of the legitimate service provider's domain.
Surfaces Silverfort-detected incidents excluding ImpossibleTravel (high FP rate from VPN and mobile users, better covered by XSIAM Analytics UEBA)
This rule detects potential unauthenticated access or unauthorized configuration modifications to an AI agent management backend. It monitors HTTP logs for requests targeting configuration endpoints that lack proper authentication, specifically identifying attempts to retrieve sensitive information like Dify or Coze keys, or attempts to inject new agent configurations via unauthenticated POST requests.
This rule monitors for high or medium-risk user events and sign-in activities within Azure Active Directory. It correlates data from both the AADUserRiskEvents and SigninLogs tables to identify potentially compromised user accounts.
Detects Keycloak password reset attempts (UPDATE_PASSWORD) where the user has not performed the required preceding email verification (SEND_RESET_PASSWORD) and lacks a valid action-token. This pattern suggests an attempt to bypass the standard password reset workflow.
Detects successful authentication events to the Okta Admin Console originating from known proxy services, anonymization networks, or suspicious infrastructure. This activity may indicate an attempt to use compromised administrative credentials to gain unauthorized access to the Identity Provider (IdP) for downstream reconnaissance or persistence.
Detects Microsoft Teams messages containing specific external domains, which may indicate phishing or unauthorized sharing of malicious links within the organization.
Detects non-interactive sign-ins, such as those using refresh or session tokens, originating from an IP address, ASN, device, or country that does not match the user's recent interactive sign-in history. The absence of an MFA challenge for these new contexts is characteristic of session token replay attacks, often associated with AiTM phishing campaigns.
Page 86 of 142