Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,004 detections
Filters
Last updated
All Time
Detection languages
1,442
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,443
11,831
5,875
5,151
4,864
3,004
Platforms
1,199
673
623
512
218
Products / Services
880
726
311
257
229
MITRE Techniques
1,661
1,109
905
468
464
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
Detects changes to the Access Control List (ACL) of the AdminSDHolder object in Active Directory. AdminSDHolder is a protected object whose ACL is automatically propagated by the SDProp process every 60 minutes to all privileged groups and accounts in the domain. Modifying the ACL on this object allows an adversary to establish a durable, self-healing backdoor by granting persistent access to high-privileged security principals.
Detects potential help-desk impersonation or social engineering activity involving account credential or MFA method resets, followed shortly by a sign-in from an unknown device or geography. The rule excludes activity tied to established ticketing systems or standard automated password expiration processes.
Sequence detection for the three-step chain — credential reset, MFA/authenticator reset, new device registration — completing within 40 minutes for one user, directly modeling the Scattered Spider/UNC3944 speed-to-domain-admin playbook from Mandiant M-Trends 2026.
Flags Temporary Access Pass issuance to accounts holding privileged directory roles, especially when issued by Tier-1 support rather than a PIM-approved workflow — TAP is the modern equivalent of the helpdesk MFA bypass abused in Scattered Spider-style intrusions.
Flags Global Administrator / Privileged Role Administrator role grants occurring within one hour of a password/MFA reset or TAP issuance on the same account — the terminal step of a completed helpdesk-vishing takeover.
Detects a suspicious pattern where an inbound Microsoft Teams call or chat from an untrusted external guest tenant is followed within 30 minutes by a credential, MFA, or account-recovery action on the target user's account in Entra ID. This behavior is indicative of a vishing-over-Teams attack where an adversary impersonates IT support to facilitate unauthorized account recovery or MFA bypass.
Detects cloud service principals identified as AI agents or assistants performing sensitive API operations such as IAM policy modifications or storage configuration changes. This pattern may indicate that an AI service account has been compromised or misused to perform reconnaissance, privilege escalation, or persistence, exceeding its intended scope of operation.
Detects AI agents attempting to disable or bypass security guardrails, approval gates, or content filters. Additionally, it identifies high-risk or destructive actions taken by an AI agent that lack the required preceding human-approval audit record.
Detects anomalous behavior by an AI agent identity by monitoring for off-hours activity, significant statistical spikes in task invocation volumes compared to a 30-day baseline, or the execution of task categories not previously associated with that specific agent. Such behaviors may indicate account hijacking or unauthorized command injection.
Detects the creation of a new local user account named 'ops' or an account with 'full' group privileges on MikroTik RouterOS. This rule is designed to identify potential persistence mechanisms following the exploitation of MikroTrick vulnerabilities (CVE-2026-67279/CVE-2026-86060), often indicated by anomalous prior login patterns.
Detects unauthorized or unreviewed modifications to AI model weights, retraining jobs, or pushes to the model registry within MLOps pipelines. This activity is monitored to prevent AI model weight poisoning, ensuring that all model-related changes undergo required peer-review or approval processes before deployment.
Detects instances where a user account consents to an OAuth application requesting high-privilege or sensitive scopes such as Mail.Read, Files.ReadWrite.All, or offline_access. This behavior is a common indicator of consent phishing attacks, where adversaries trick users into granting persistent access to their cloud resources via malicious OAuth applications.
This rule detects potentially malicious activity involving Service Principals in Microsoft Entra ID. It identifies two scenarios: 1) Impossible travel, where a service principal authenticates from two distinct geographic locations within a 60-minute window, and 2) Administrative modifications to a service principal's credentials or authentication methods (e.g., adding secrets, certificates, or MFA methods), which may indicate persistence or credential abuse.
Detects potential SaaS supply-chain attacks where a third-party application or connector triggers an OAuth permission scope escalation or publishes a new version, followed by the associated service account initiating outbound network connections to rare or newly-registered domains within a 24-hour window.
Detects a suspicious sequence of events: an anomalous login (new device, new location, or high-risk sign-in) followed by the assumption of a highly privileged role (via AssumeRole, PIM, or role elevation) and subsequent sensitive administrative actions (e.g., creating access keys, modifying IAM policies, or disabling security auditing). This pattern is indicative of cloud identity compromise and privilege escalation, commonly seen in attacks involving groups like Scattered Spider.
Detects when a user account assigned to high-privileged roles (Global Administrator or Authentication Policy Administrator) performs sensitive operations such as application registration, service principal creation, or modifications to authentication policies within a short timeframe (4 hours) of a successful sign-in. This activity is often associated with the initial setup phases of MFA bypass or persistence techniques in Entra ID.
Detects successful administrative logins to VMware ESXi, vCenter, or related VDI infrastructure (Horizon) by users who have recently performed a password or MFA reset. This pattern is indicative of a helpdesk-based social engineering attack (vishing) or credential compromise where the attacker regains account access and immediately pivots to critical virtualization management infrastructure to facilitate ransomware deployment.
Detects high-risk administrative actions in Entra ID, such as role assignments, user creation, or password resets, occurring shortly after a user authenticates using the device code flow. This pattern is indicative of a post-compromise takeover where an adversary utilizes a stolen or coerced device code session to escalate privileges.
Detects a post-compromise pattern on a WordPress site where an attacker, after an initial login, rapidly accesses multiple sensitive administrative pages (plugins.php, profile.php, etc.) within a short window, suggesting nonce harvesting. This activity is correlated with the subsequent creation of a suspected webshell file named 's.php'.
Detects the creation or modification of inbox rules in Microsoft 365 that filter messages containing financial keywords (e.g., 'direct deposit', 'bank') and perform actions designed to hide or suppress these emails (e.g., 'MoveToFolder', 'DeleteMessage', 'MarkAsRead', 'StopProcessingRules'). This behavior is commonly used by adversaries to hide notification emails regarding financial transactions, which could alert the user to unauthorized activity.
Detects M365 administrative actions related to mailbox forwarding rules or OAuth application consent that occur in the absence of a Multi-Factor Authentication (MFA) claim, particularly when preceded by non-interactive session events (LogonType 0) using REST client protocols. This pattern is indicative of potential session hijacking or token replay attacks, where an adversary leverages a compromised session to establish persistence or gain ongoing access to the environment without re-authenticating.
Page 25 of 144