Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,936
7,266
6,535
3,866
3,647
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
This rule monitors SCIM (System for Cross-domain Identity Management) logs for high-volume identity management operations, including account creation, deletion, or entitlement grants within a short 15-minute window. A trigger occurs if an actor performs 10 or more creations, 10 or more deletions, 10 or more entitlement grants, or 3 or more administrative role grants. This behavior may indicate an account compromise performing bulk manipulation of identities to maintain persistence or elevate privileges.
This rule monitors Zscaler Internet Access logs for high volumes of session activity, specifically detecting when a user exceeds a burst threshold of new session creations or consistently operates near the maximum allowed concurrent session limit within a 10-minute window. This behavior may indicate account compromise, automated credential stuffing, or abuse of access policies.
Detects potentially unauthorized or suspicious file activities such as bulk downloads, external file sharing, or CASB policy violations monitored by Zscaler ZIA, which may indicate data exfiltration or policy non-compliance.
This rule detects data synchronization activities between sanctioned enterprise applications and unsanctioned or personal cloud applications using Netskope logs. This pattern often indicates potential shadow IT usage or unauthorized data exfiltration from controlled environments to personal storage services.
Detects a new-device Okta sign-in followed by three or more failed Admin Console authentication attempts originating from a different device/IP context, consistent with privilege escalation using a stolen AiTM session token.
Detects Okta accounts that enroll a new MFA factor within a short window after multiple failed or abandoned MFA authentication attempts. This behavior is indicative of an attacker who has compromised credentials and is attempting to establish persistent access by bypassing or reconfiguring MFA. The rule includes logic to exclude legitimate self-service enrollments that have a corresponding verified helpdesk or change-management ticket.
This rule monitors web browser URL click events for specific patterns (createssopasskey, addssopasskey) often used in vishing-lure campaigns. It identifies potential Adversary-in-the-Middle (AiTM) credential harvesting attempts by cross-referencing clicked URLs against an organization's approved SSO domain allowlist and verifying the presence of an internal referrer in the redirect chain. If a user clicks a suspect link that does not originate from a known internal source and points to an unauthorized external domain, the event is flagged.
Detects successful sign-ins using the device code authentication flow that are infrequent for a specific user and location. This flow is often targeted by attackers attempting to bypass MFA or perform device phishing, as it requires the user to manually authorize the device on a separate platform.
Detects anomalous device code authentication patterns by monitoring SigninLogs for accounts utilizing the device code flow across multiple countries or with a high volume of attempts within a short timeframe. This behavior is indicative of potential device code phishing or automated authentication abuse.
This rule monitors for administrative role updates recorded by PUSH Security. It detects when an actor grants or modifies privileged roles for a target account, which is a common indicator of potential account manipulation, privilege escalation, or persistence establishment within a managed environment.
This rule detects modifications to Google Workspace user account recovery methods, including the generation or deletion of 2SV (2-Step Verification) backup scratch codes, and changes to recovery email addresses or recovery phone numbers. These actions are often performed during account takeover attempts to establish persistence or facilitate bypassing MFA.
Imperva New Protected Site Created
Cortex XDR
Detects the creation of a new site object within the Imperva Cloud WAF environment, as captured by audit trail logs. This event serves as an administrative signal to track onboarding of new applications and monitor for unauthorized or unexpected configuration changes.
Imperva Site WAF Protection Disabled
Cortex XDR
Detects an audit event in Imperva Cloud WAF where a site's protection state is changed to disabled. Disabling WAF protection reduces the security posture of the protected application and may indicate an attempt to impair defensive controls.
This rule detects potentially malicious AI prompt injection attempts targeting web-based AI assistants like Microsoft Copilot or Atlassian Rovo. It monitors CommonSecurityLog data for specific URL parameters (rovoChatPrompt, q, prompt) containing suspicious keywords (e.g., 'ignore', 'system', 'exfiltrate') or unusually long parameter values, which are indicators of efforts to bypass AI safety guardrails or perform data exfiltration via prompt manipulation.
Detects non-interactive sign-ins (refresh-token usage) for Microsoft Purview Communication Compliance reviewer accounts (Administrator, Analyst, or Investigator roles) that originate from IP addresses not observed for the user in the previous 21 days. This behavior is indicative of potential token theft or session hijacking attempting to bypass multi-factor authentication.
This rule detects 'impossible travel' activity performed by users assigned to sensitive Microsoft 365 Communication Compliance roles. It monitors Azure Sign-in logs for successful authentication events occurring within a short timeframe (1 hour) from multiple distinct geographic locations (countries) or different autonomous system numbers (ASNs). This behavior is characteristic of an adversary utilizing stolen session tokens or compromised credentials to access protected administrative functions.
Detects SharePoint Online search queries involving sensitive keywords related to M&A, legal, or financial activities, excluding authorized personnel in departments such as legal or finance. This rule helps identify potential unauthorized internal reconnaissance or data staging activities within an organization's document management system.
Detects a potential account takeover scenario where a user receives a password reset notification email followed within 10 minutes by a non-SSO application password change from the same IP address. This sequence is characteristic of Adversary-in-the-Middle (AiTM) phishing or vishing campaigns where an attacker intercepts session tokens or uses social engineering to force a password reset and immediately secures the account for persistent access.
This rule detects instances where a user grants an OAuth application consent to perform sensitive actions in an Azure AD environment. It specifically filters for high-risk scopes (such as Mail.Read, Files.ReadWrite, or Directory.ReadWrite) granted to applications with publishers other than Microsoft Corporation, which is often indicative of OAuth consent phishing attacks or malicious application integration.
This rule detects modifications to administrative privileges in Google Workspace, including granting or revoking administrative roles and delegating administrative responsibilities. Such activities are critical security events that could indicate unauthorized privilege escalation, account compromise, or malicious administrative activity.
Detects high-frequency failed sign-in attempts (10+ failures in 15 minutes) targeting the Okta Admin Console. The rule filters out common expected failure modes such as password expiration, account lockouts, and known helpdesk account activity to prioritize potential brute-force or credential-stuffing attacks against privileged administrative accounts.
Page 93 of 142