Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,936
7,266
6,537
3,866
3,647
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects high-risk administrative actions within Netskope, including the deletion of security policies, modification of Data Loss Prevention (DLP) rules, disabling of threat protection features, or the creation of new API tokens and administrative accounts. The rule flags these activities as 'critical' or 'high' severity, particularly if they occur outside standard business hours.
Detects anomalous activity where a user account experiences access denials across a high number of distinct applications (>= 5) within a 15-minute window via Zscaler Private Access. This pattern often indicates unauthorized exploration, directory probing, or automated credential testing against enterprise resources.
Detects high-risk user behavior associated with unsanctioned or restricted Generative AI applications, specifically targeting large data uploads (potential data exfiltration) or repeated access following a coaching intervention.
Detects Microsoft Entra ID Protection risk telemetry for sign-ins with unfamiliar properties. Microsoft evaluates characteristics such as ASN, browser, device, and location against the user's historical behavior to identify anomalous sign-ins that may warrant investigation.
Detects DLP events from Netskope where sensitive data (PII, PCI, Source Code, or Credentials) is being uploaded or shared, indicating potential data exfiltration.
Detects DLP policy violations flagged by Netskope when users upload, share, post, or send files within Slack or Microsoft Teams. This rule monitors for DLP profile matches which may indicate unauthorized exfiltration or exposure of sensitive data via collaboration tools.
This rule detects potential brute force or password spraying activity by identifying a user account that experiences at least 5 login failures followed by a successful login for the same application and source IP address within a one-hour window. This pattern is indicative of an attacker who has successfully guessed credentials after multiple attempts.
Detects anomalous activity where a user account experiences access denials across a high number of distinct applications (>= 5) within a 15-minute window via Zscaler Private Access. This pattern often indicates unauthorized exploration, directory probing, or automated credential testing against enterprise resources.
Detects external Microsoft Teams calls involving screen sharing and potential impersonation of trusted entities. The rule filters for calls where the `identity_name` (likely the external caller's domain or display name) matches patterns associated with free/abused TLDs, cheap/throwaway TLDs, phishing-common TLDs, high-risk specialty TLDs, PHaaS kit TLDs, or common impersonated entity names (e.g., 'microsoft', 'helpdesk', 'it.support'). This combination indicates a high risk of credential theft or remote access tool installation via vishing tactics.
Detects DLP policy violations flagged by Netskope when users upload, share, post, or send files within Slack or Microsoft Teams. This rule monitors for DLP profile matches which may indicate unauthorized exfiltration or exposure of sensitive data via collaboration tools.
This rule detects a potential security risk by identifying instances where a user registers a new security information method (e.g., FIDO2/Passkey) and subsequently logs in using that same authentication method within a 15-minute window. This pattern may indicate an attacker who has gained initial access or compromised credentials and is attempting to establish persistence or facilitate further account takeovers by registering their own multifactor authentication device.
Provides a role-centric view of Microsoft Entra Privileged Identity Management (PIM) usage by correlating role eligibility, activation history, and recently activated assignments.
The query helps security and identity teams understand:
Which privileged roles have the most eligible users.
Which roles are actively being used.
Which roles are rarely or never activated.
Which users currently hold activated privileged access.
How broadly privileged roles are distributed across the organization.
This is useful for privilege governance reviews, role rationalization, least-privilege initiatives, and identifying over-provisioned privileged access.
The query helps security and identity teams understand:
Which privileged roles have the most eligible users.
Which roles are actively being used.
Which roles are rarely or never activated.
Which users currently hold activated privileged access.
How broadly privileged roles are distributed across the organization.
This is useful for privilege governance reviews, role rationalization, least-privilege initiatives, and identifying over-provisioned privileged access.
This rule monitors and aggregates Microsoft Entra ID Privileged Identity Management (PIM) group activation logs to provide a dashboard view of group usage, member count, and recent role activations. It facilitates governance by identifying high-usage, low-usage, or unused PIM-eligible groups by correlating historical and recent activation activity with current membership data.
This detection identifies sensitive data such as social security numbers, passwords, API keys, and credit card numbers being sent in prompts to AWS Bedrock Claude models. Exposure of sensitive data through AI prompts may indicate data loss, credential leakage, or insider threat activity.
Detects a Cortex management audit event indicating that a Broker VM high-availability cluster has no available standby node, signaling reduced redundancy and potential risk to data collection services.
Detects instances where Zscaler AI Protect (AI Guard) flags attempts to perform prompt injection or jailbreak against Large Language Model (LLM) or GenAI applications. The rule monitors blocked requests and allowed requests that exceed a high confidence score threshold (0.75), identifying potential malicious interactions with generative AI services.
Detects instances where Netskope security solution has identified and blocked web-based traffic classified as malware or a security threat.
Detects high-volume file deletion or modification activity within sanctioned cloud storage applications, monitored via Netskope. This behavior is indicative of potential ransomware, malicious bulk data destruction, or an insider threat attempting to sabotage data.
Detects anomalous access attempts to Netskope Private Access applications, specifically identifying connections from unmanaged devices, access occurring outside of typical business hours, or access from unusual/unexpected geographic locations.
Detects administrative changes to Zscaler location templates that disable critical security enforcement settings, specifically Firewall Control, IPS Control, or Acceptable Use Policy (AUP) enforcement. Such modifications may indicate an attempt to weaken an organization's perimeter defense posture.
Detects instances where an administrator account experiences multiple authentication failures within a 15-minute window, followed by a successful authentication attempt from the same client IP address. This pattern is indicative of potential brute force or password spraying activity where the attacker successfully guessed the credentials after multiple failed attempts.
Page 89 of 142