Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,934
7,265
6,535
3,865
3,645
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects instances where a nested REST request is initiated while the application context is performing a post-save event, specifically identified by a 'parse_request' status or type indicator. This pattern may signify an adversary attempting to impersonate an administrator within the application to perform unauthorized actions during data processing.
This rule detects authentication attempts to the 'Device Registration Service' in Entra ID where the User-Agent string contains 'python'. This is often indicative of automated scripts, such as those using libraries like msal, being used to interact with device management APIs, which may be associated with legitimate automation or adversary activity.
Detects a PyPI release of mrmustard 0.7.4 with no corresponding GitHub tag, indicating the package was published outside the project's normal release process.
Detects new device registrations in Microsoft Entra ID where the device display name is prefixed with 'Forg365-', a pattern used by the Forg365 PhaaS (Phishing-as-a-Service) platform. This activity is indicative of an adversary establishing persistent, unmanaged device access to compromised Microsoft 365 accounts.
This rule serves as an investigation framework for Microsoft Entra ID sign-in events. It enables security analysts to filter, normalize, and inspect user authentication activities, including sign-in types (interactive/non-interactive), device management status, user risk levels, and conditional access status. The query is designed for incident response and forensic analysis rather than automated alerting.
Detects anomalous activity in Microsoft 365 calendar events where potential C2 data is exfiltrated or synchronized. This is identified by the creation or modification of calendar events containing suspicious file names (e.g., File0.txt, File1.txt) or specific command-and-control markers within the event subject.
Detects suspicious modifications or deletions of Outlook calendar events using the Microsoft Graph API, potentially indicating the use of calendar infrastructure as a command-and-control (C2) heartbeat or exfiltration channel. The rule monitors for specific pattern-based event updates or deletions following calendar enumeration, which is a technique used to maintain persistent communication or exfiltrate small amounts of data.
Detects anomalous access to Outlook calendar attachments via the Microsoft Graph API, specifically targeting a file named 'file0.txt'. This activity may indicate a technique where attackers use calendar events as a covert channel for data exfiltration or delivery of malicious payloads.
Detects anomalous access to Outlook calendar attachments via the Microsoft Graph API, specifically targeting a file named 'file0.txt'. This activity may indicate a technique where attackers use calendar events as a covert channel for data exfiltration or delivery of malicious payloads.
Detects Microsoft 365 Outlook calendar events being updated via Graph API where the subject is changed to a suspicious C2-like string (e.g., 'Boss Report ID:' or 'Boss update ID:'). This behavior is consistent with attackers using Outlook calendar events as a covert communication channel or for command and control signaling.
This rule detects scenarios where a user's session originates from the 'Microsoft Authentication Broker' and another application (like 'OfficeHome' or 'One Outlook Web') within a short window (15 minutes), but from different source IP addresses. This indicates potential session hijacking or the use of stolen session cookies by an external actor.
Detects anomalous, high-volume enumeration of Azure OAuth application IDs from a single IP address, indicative of an adversary attempting to map or verify OAuth applications, potentially leveraging spoofed client IDs for discovery or bypass attempts.
Detects unauthenticated exploitation attempts targeting WordPress sites using wp2shell techniques. The rule identifies malicious payloads attempting to leverage RSS, Navigation, or Calendar Gutenberg blocks in conjunction with the batch REST API to achieve Remote Code Execution.
Detects high-frequency Resource Owner Password Credentials (ROPC) authentication requests targeting the OAuth token endpoint. Attackers use ROPC for brute-forcing, credential stuffing, or bypassing security controls by directly passing user credentials to the OAuth flow.
Detects high volumes of authentication failures (AADSTS50034) targeting non-existent or invalid usernames from a single source IP address, potentially indicating account enumeration or password spraying activity.
Detects multiple authentication failure attempts (error code 700016: Application not found in directory) originating from the same IP address against multiple user accounts. This pattern is indicative of an adversary attempting to find or exploit service principals or misconfigured applications across the tenant.
Detects incoming email messages containing common prompt injection strings aimed at manipulating Large Language Models (LLMs). The rule scans email bodies for directives such as 'ignore previous instructions', 'save this to your memory', or other obfuscation patterns frequently used in adversarial prompting to bypass LLM safety guardrails or perform unauthorized data extraction.
Detects the registration of a new FIDO2 security key or passkey in Entra ID that is associated with a sign-in from an unmanaged or non-compliant device shortly before or after the registration. This behavior often suggests a vishing or social engineering scenario where an attacker guides a user through an authentication method registration process while impersonating IT support.
Detects Microsoft Entra ID authentication failures (AADSTS700016) where a client ID is provided that does not exist in the directory. This error often indicates attackers attempting to spoof legitimate OAuth client applications to perform reconnaissance or bypass conditional access policies.
Detects a sign-in failure with error code 50199 (indicating a device-code interrupt/waiting state) followed immediately by a successful sign-in from the same source IP address. This pattern is characteristic of device-code phishing attacks, where an attacker intercepts a device code and completes the authentication process on behalf of the victim.
Detects Microsoft Entra ID sign-in events using the non-interactive OAuth device-code protocol against the 'common' tenant endpoint where MFA was not applied. This behavior is consistent with OAuth device-code phishing campaigns (e.g., Storm-2372/DEBULL) that exploit Conditional Access device-code flow allowances to bypass standard authentication controls.
Page 99 of 142