Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,936
7,266
6,537
3,866
3,647
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects user activity involving unsanctioned or 'Shadow IT' applications that have a low or poor Cloud Confidence Index (CCI) rating, as reported by Netskope. This rule helps identify potential security risks associated with the use of unapproved or newly observed cloud services.
This rule detects potential brute force or password spraying activity by identifying a user account that experiences at least 5 login failures followed by a successful login for the same application and source IP address within a one-hour window. This pattern is indicative of an attacker who has successfully guessed credentials after multiple attempts.
Detects users who have triggered five or more blocks by Netskope security policies for high-risk web categories such as Anonymizers, Hacking, Gambling, or Adult Content. This behavior may indicate an attempt to circumvent security controls or persistent engagement with prohibited content.
Detects anomalous, non-browser process activity interacting with Microsoft Teams APIs associated with the TWINLOOT threat campaign. The rules identify suspicious token retrieval requests and unauthorized authentication headers from processes that do not identify as legitimate browser or Teams application agents, indicating potential abuse of application access tokens and authentication flows.
Detects audit events in Imperva Cloud WAF where SSL/TLS configuration has been explicitly removed from a protected site. This change impacts the security posture of HTTPS delivery and requires validation to ensure it was an authorized administrative action.
This rule identifies active, high or critical severity regulatory compliance violations (e.g., GDPR, HIPAA, PCI-DSS, NIST) reported by Zscaler Data Security Posture Management (DSPM). It further highlights assets with repeat violations across multiple regulatory frameworks, facilitating prioritization of remediation efforts for critical compliance gaps.
KQL Query
Detects instances where an administrator account experiences multiple authentication failures within a 15-minute window, followed by a successful authentication attempt from the same client IP address. This pattern is indicative of potential brute force or password spraying activity where the attacker successfully guessed the credentials after multiple failed attempts.
Detects a significant increase in Zscaler Risk360 risk scores or the emergence of new high-impact security insights. This rule monitors for category-specific risk spikes (External Attack Surface, Compromise, Lateral Propagation, or Data Loss) that exceed a defined delta threshold or are flagged as Critical/High severity, serving as a posture-based alert for security investigation.
Detects users who have triggered five or more blocks by Netskope security policies for high-risk web categories such as Anonymizers, Hacking, Gambling, or Adult Content. This behavior may indicate an attempt to circumvent security controls or persistent engagement with prohibited content.
Detects sensitive files in cloud storage environments that have been shared publicly or with external entities, as identified by Netskope CASB (DLP) policies. This rule monitors for events where storage objects are assigned broad access permissions (e.g., 'public', 'anyone with link') in conjunction with DLP incident triggers.
Detects instances where sensitive or organizational data is uploaded to public text storage repositories like Pastebin or GitHub Gists through Netskope, which may indicate data exfiltration.
Detects Zscaler ZIA logs identified as Advanced Threat Protection events, specifically targeting URL categories like Phishing and WebSpam, or traffic classified as Advanced Security Risk. The rule aggregates these events by user to identify potential malicious activity, flagging sessions where threats were allowed as higher severity.
Detects instances where Netskope Advanced Threat Protection (ATP) identifies a malicious file during a user-initiated upload or download operation.
Detects sensitive files in cloud storage environments that have been shared publicly or with external entities, as identified by Netskope CASB (DLP) policies. This rule monitors for events where storage objects are assigned broad access permissions (e.g., 'public', 'anyone with link') in conjunction with DLP incident triggers.
This rule detects messages sent or chats created in Microsoft Teams by external or guest users where the chat name or message content impersonates IT support, helpdesk, or other official organizational entities. It specifically looks for keywords commonly used in phishing attempts to trick users into believing the sender is a legitimate internal service.
Detects anomalous mailbox access via the MailItemsAccessed operation, specifically identifying the unique ClientAppId and API pairing associated with the Storm-2755 (Payroll Pirates) adversary campaign. This activity indicates unauthorized access to email content, typically targeting high-value personnel such as payroll, finance, and HR staff through Adversary-in-the-Middle (AiTM) techniques.
This rule detects potentially malicious service principal activity by correlating the granting of sensitive app roles with subsequent spikes in sign-in volume. It monitors AuditLogs for 'Add app role assignment to service principal' events involving high-privilege roles, then joins this data with AADServicePrincipalSignInLogs to identify if the service principal experiences a sudden, significant increase in hourly sign-ins compared to its historical baseline within 24 hours of the permission change.
This rule detects potentially malicious mailbox search and item access activity in Microsoft 365. It monitors for users who trigger both 'Search' and 'MailItemsAccessed' actions within a one-hour window. The detection logic flags behavior that includes a high volume of mail access (more than 10 events) or access originating from multiple distinct IP addresses, which are common indicators of automated collection or credential compromise.
This rule detects potentially unauthorized command-line activity originating from Power Platform-related execution environments (such as Copilot Studio or Power Platform sandboxes). It specifically monitors for the execution of common system administration binaries like cmd, powershell, or curl, which, when triggered from within a low-code/cloud runtime environment, may indicate a sandbox escape or an attempt to interact with the underlying host operating system.
Detects Google Workspace bulk export/Takeout activity occurring shortly after an OAuth grant or app-password creation, or an unusual volume of export/download events, consistent with automated Gmail/Docs/Keep data exfiltration.
Page 90 of 142