Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,936
7,266
6,535
3,866
3,647
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
This rule detects repeated ZTNA/ZPA session restore failures for a single user within a short timeframe (15 minutes). A high number of session restore failures can indicate potential brute force attempts, token manipulation, or automated abuse of session management mechanisms.
Detects potentially unauthorized or suspicious file activities such as bulk downloads, external file sharing, or CASB policy violations monitored by Zscaler ZIA, which may indicate data exfiltration or policy non-compliance.
This rule monitors for high-risk modifications to Zscaler security policies such as disabling SSL inspection or DLP engines, or deleting/modifying firewall and URL filtering rules. It also flags administrative logins from locations previously unseen for that user, which may indicate account compromise or unauthorized access.
Detects users who have downloaded more than 50 files from cloud storage applications within a single hour, potentially indicating data exfiltration or mass data harvesting.
Detects high-volume file deletion or modification activity within sanctioned cloud storage applications, monitored via Netskope. This behavior is indicative of potential ransomware, malicious bulk data destruction, or an insider threat attempting to sabotage data.
Detects anomalous access attempts to Netskope Private Access applications, specifically identifying connections from unmanaged devices, access occurring outside of typical business hours, or access from unusual/unexpected geographic locations.
Detects anomalous mailbox activity in Microsoft 365 where a user account performs both search operations and mail item access, particularly when the activity originates from multiple IP addresses or exceeds a threshold of mail items accessed within a one-hour window. This behavior often indicates potential mailbox compromise or unauthorized data collection.
Detects Okta MFA factor re-enrollment immediately preceded by a burst (>=2) of failed MFA authentication challenges within 15 minutes, indicating attacker-driven MFA takeover following AiTM credential theft.
Imperva Protected Site Removed from WAF
Cortex XDR
Detects an audit event in Imperva Cloud WAF indicating that a protected site configuration has been removed. This action results in the loss of application-protection coverage for the specific site and may indicate unauthorized defensive impairment.
Detects OAuth application authorization events where the granted scopes include highly sensitive access such as Gmail, Drive, or Admin APIs. This rule identifies potential consent phishing attacks where users are tricked into granting malicious third-party applications broad, unauthorized access to their Google Workspace account. The rule excludes common, expected applications like Google Cloud SDK or standard Google services.
Detects mass revocation of OAuth tokens by a user, which may indicate an attacker cleaning up evidence after data extraction, or legitimate administrative incident response activity.
Detects a password reset followed by the deletion of two or more verified security-notification emails (matched to actual notification sender domains) within 24 hours, prioritizing permanent deletions as higher-confidence evidence-destruction behavior.
Detects anomalous device code authentication patterns by monitoring SigninLogs for accounts utilizing the device code flow across multiple countries or with a high volume of attempts within a short timeframe. This behavior is indicative of potential device code phishing or automated authentication abuse.
Detects a Google Workspace OAuth application grant and application-specific password issuance occurring within 30 minutes of a suspicious/AiTM-flagged sign-in, indicating Gmail account takeover.
This rule detects anomalous, high-volume file access activity within SharePoint by monitoring the 'FileAccessed' operation. It calculates a 14-day rolling baseline for each user and triggers an alert when the hourly 'FileAccessed' count significantly exceeds this baseline, specifically when no corresponding 'FileDownloaded' events are present. This behavior aims to detect stream-based data exfiltration techniques that bypass standard download-based DLP controls.
Detects potential password spraying activity characterized by a high number of distinct IP addresses failing authentication for a specific user, followed shortly by a successful authentication for that same user from a geographic location outside the United Kingdom.
Detects inbound voice calls that spoof corporate helpdesk numbers. The rule triggers when an incoming call from an external/PSTN trunk matches a known helpdesk number and exhibits signs of spoofing, specifically either a mismatch between the current call's carrier and historical baseline carrier for that number, or a report by the recipient that the call was suspicious.
Detects non-interactive sign-ins (refresh-token usage) for Microsoft Purview Communication Compliance reviewer accounts (Administrator, Analyst, or Investigator roles) that originate from IP addresses not observed for the user in the previous 21 days. This behavior is indicative of potential token theft or session hijacking attempting to bypass multi-factor authentication.
This rule detects high-volume file access or download operations in SharePoint or OneDrive, performed by non-browser user agents (e.g., Python, PowerShell, cURL, Go). An elevated volume of such actions within a short timeframe is indicative of automated, scripted interaction, which may represent malicious data exfiltration, automated content scraping, or potential account compromise.
This rule detects potential mass data retrieval or excessive access to sensitive-labeled files by an individual user through Microsoft Copilot within a one-hour window. By monitoring the volume of distinct sensitivity-labeled objects accessed, it identifies behavior consistent with a user or compromised account performing high-volume information gathering.
This rule identifies Service Principals in Microsoft Entra ID that have successfully authenticated after a long period of dormancy (defined as 90 days or more). Reactivation of dormant service principals may indicate that an adversary is attempting to revive a persistent access method or abuse credentials that were previously set aside.
Page 92 of 142