Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,932
7,263
6,535
3,865
3,643
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects administrative changes to Zscaler location templates that disable critical security enforcement settings, specifically Firewall Control, IPS Control, or Acceptable Use Policy (AUP) enforcement. Such modifications may indicate an attempt to weaken an organization's perimeter defense posture.
KQL Query
Detects high-risk user behavior associated with unsanctioned or restricted Generative AI applications, specifically targeting large data uploads (potential data exfiltration) or repeated access following a coaching intervention.
Detects a significant increase in Zscaler Risk360 risk scores or the emergence of new high-impact security insights. This rule monitors for category-specific risk spikes (External Attack Surface, Compromise, Lateral Propagation, or Data Loss) that exceed a defined delta threshold or are flagged as Critical/High severity, serving as a posture-based alert for security investigation.
This rule monitors Zscaler Internet Access logs for high volumes of session activity, specifically detecting when a user exceeds a burst threshold of new session creations or consistently operates near the maximum allowed concurrent session limit within a 10-minute window. This behavior may indicate account compromise, automated credential stuffing, or abuse of access policies.
Detects instances where Netskope Advanced Threat Protection (ATP) identifies a malicious file during a user-initiated upload or download operation.
This rule detects data synchronization activities between sanctioned enterprise applications and unsanctioned or personal cloud applications using Netskope logs. This pattern often indicates potential shadow IT usage or unauthorized data exfiltration from controlled environments to personal storage services.
This rule monitors SCIM (System for Cross-domain Identity Management) logs for high-volume identity management operations, including account creation, deletion, or entitlement grants within a short 15-minute window. A trigger occurs if an actor performs 10 or more creations, 10 or more deletions, 10 or more entitlement grants, or 3 or more administrative role grants. This behavior may indicate an account compromise performing bulk manipulation of identities to maintain persistence or elevate privileges.
This rule detects a potential security risk by identifying instances where a user registers a new security information method (e.g., FIDO2/Passkey) and subsequently logs in using that same authentication method within a 15-minute window. This pattern may indicate an attacker who has gained initial access or compromised credentials and is attempting to establish persistence or facilitate further account takeovers by registering their own multifactor authentication device.
Detects when a user authorizes an OAuth application that requests high or critical permissions in a SaaS environment via Netskope logs. This pattern is commonly used in OAuth-based phishing campaigns or illicit application consent grants where adversaries attempt to gain persistent access to cloud resources.
Detects DLP events from Netskope where sensitive data (PII, PCI, Source Code, or Credentials) is being uploaded or shared, indicating potential data exfiltration.
Detects instances where sensitive or organizational data is uploaded to public text storage repositories like Pastebin or GitHub Gists through Netskope, which may indicate data exfiltration.
Detects sign-ins from known UNC6671 residential-proxy IPs, ranked by rarity (first-seen for the user) and correlated with a following sensitive account action (MFA registration, mailbox rule change, admin role change).
This rule detects suspicious Microsoft Graph API activity involving the enumeration of user accounts within an organization. It specifically monitors for queries targeting personnel in sensitive roles such as payroll, finance, HR, and administration, as well as bulk enumeration attempts. The detection logic also flags usage of the axios HTTP library, a common tool in such reconnaissance campaigns, and aggregates results by source IP/ASN to identify coordinated efforts, such as those associated with the Storm-2755 threat actor.
GitHub Public Repository Created
Cortex XDR
Detects the creation of a new public repository within GitHub. This activity, while often legitimate, poses a potential data exposure risk by making code or sensitive assets publicly accessible. The rule identifies events where repository visibility is explicitly set to public for governance and security review.
This rule detects potential account takeover or persistent access via MFA manipulation by correlating recent MFA-related sign-in failures with subsequent successful identity management operations such as updating security info or registering a new MFA method. This behavior pattern is frequently associated with Adversary-in-the-Middle (AiTM) phishing or vishing attacks where an attacker compromises credentials, overcomes MFA challenges, and then establishes their own MFA device to maintain persistent access.
Detects successful sign-ins using the device code authentication flow that are infrequent for a specific user and location. This flow is often targeted by attackers attempting to bypass MFA or perform device phishing, as it requires the user to manually authorize the device on a separate platform.
Detects bulk SharePoint/M365 file access or download either from a known UNC6671 exfiltration IP, or via a scripting-library user agent that is new for the user and exceeds a volume threshold within a short session window.
This rule detects potentially malicious AI prompt injection attempts targeting web-based AI assistants like Microsoft Copilot or Atlassian Rovo. It monitors CommonSecurityLog data for specific URL parameters (rovoChatPrompt, q, prompt) containing suspicious keywords (e.g., 'ignore', 'system', 'exfiltrate') or unusually long parameter values, which are indicators of efforts to bypass AI safety guardrails or perform data exfiltration via prompt manipulation.
This rule detects repeated ZTNA/ZPA session restore failures for a single user within a short timeframe (15 minutes). A high number of session restore failures can indicate potential brute force attempts, token manipulation, or automated abuse of session management mechanisms.
This rule detects potentially unauthorized command-line activity originating from Power Platform-related execution environments (such as Copilot Studio or Power Platform sandboxes). It specifically monitors for the execution of common system administration binaries like cmd, powershell, or curl, which, when triggered from within a low-code/cloud runtime environment, may indicate a sandbox escape or an attempt to interact with the underlying host operating system.
Page 91 of 142