Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
505 detections
Filters
Last updated
All Time
Detection languages
245
92
78
48
19
Contributors
141
113
53
46
41
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
210
138
110
80
76
Products / Services
147
74
61
41
28
MITRE Techniques
243
128
69
68
55
CVEs
10
9
5
5
5
IDS Classtypes
4
IDS Protocols
4
This analytic detects mailbox rule creation, a common technique used in Business Email Compromise. It uses a scoring mechanism to identify a combination of attributes often featured in mailbox rules created by attackers. This may indicate that an attacker has gained access to the account.
The following analytic identifies security events from Microsoft Defender, focusing on Exploit Guard and Attack Surface Reduction (ASR) features. It detects Event IDs 1121, 1126, 1131, and 1133 for blocked operations, and Event IDs 1122, 1125, 1132, and 1134 for audit logs. Event ID 1129 indicates user overrides, while Event ID 5007 signals configuration changes. This detection uses a lookup to correlate ASR rule GUIDs with descriptive names. Monitoring these events is crucial for identifying unauthorized operations, potential security breaches, and policy enforcement issues. If confirmed malicious, attackers could bypass security measures, execute unauthorized actions, or alter system configurations.
This rule monitors NetScaler ADC/Gateway system logs for configuration modifications (save, add, or set commands) that occur outside of a designated maintenance window. Such activities, when performed off-hours, may indicate unauthorized persistence, defense evasion, or configuration tampering following successful exploitation.
Identifies NetScaler ADC or Gateway software versions in the inventory that are known to be vulnerable to CVE-2026-88771 and CVE-2026-88772, despite having received the patch for CVE-2026-19490.
Detects command-line activity attempting to disable, unbind, or remove NetScaler AppFW (Web Application Firewall) profiles, signatures, or security policies. This activity is indicative of defense evasion following the exploitation of CVE-2026-88771 or CVE-2026-88772 to suppress security alerting on follow-on malicious activity.
Identifies NetScaler ADC or Gateway software versions in the inventory that are known to be vulnerable to CVE-2026-88771 and CVE-2026-88772, despite having received the patch for CVE-2026-19490.
Detects command-line activity attempting to disable, unbind, or remove NetScaler AppFW (Web Application Firewall) profiles, signatures, or security policies. This activity is indicative of defense evasion following the exploitation of CVE-2026-88771 or CVE-2026-88772 to suppress security alerting on follow-on malicious activity.
Detects instances where a user grants an OAuth application sensitive, high-privilege permissions (e.g., Mail.Read, Files.ReadWrite.All, Directory.ReadWrite.All) that are commonly abused in consent phishing campaigns to maintain persistent, silent access to mail and files independent of user credentials.
Detects attempts to redirect Python package resolution away from the default PyPI index. This is achieved by monitoring pip CLI arguments (--index-url, --extra-index-url), environment variables (PIP_INDEX_URL, PIP_EXTRA_INDEX_URL, PIP_CONFIG_FILE), or the creation/modification of pip configuration files (pip.conf, pip.ini). Such activity is often associated with software supply chain attacks where an adversary attempts to force the installation of malicious packages from a controlled repository.
Detects unauthorized configuration or content changes (e.g., login or portal pages) performed outside of standard business hours by user accounts that have recently exhibited high-risk or compromised authentication behavior. This pattern aligns with tactics observed in the ShinyHunters playbook where compromised accounts are used to deface public-facing applications.
Identifies NetScaler ADC or Gateway software versions in the inventory that are known to be vulnerable to CVE-2026-88771 and CVE-2026-88772, despite having received the patch for CVE-2026-19490.
Detects high-risk operations performed by the Entra ID/AAD Connect synchronization service account (e.g., Sync_* or ADToAADSyncServiceAccount). This account, which often holds broad directory permissions, is a prime target for attackers to gain persistence or escalate privileges within the cloud directory. The rule monitors for unauthorized sign-ins, sensitive configuration changes (such as modifications to federation trust, authentication policies, or directory synchronization settings), and password resets targeting the sync account itself.
Identifies NetScaler ADC or Gateway software versions in the inventory that are known to be vulnerable to CVE-2026-88771 and CVE-2026-88772, despite having received the patch for CVE-2026-19490.
Detects configuration changes to AAA/TACACS+ settings or the creation of local administrative accounts on network devices executed over SSH or Telnet sessions. This behavior is associated with malicious activity by groups such as Salt Typhoon, involving the compromise of telecommunications infrastructure.
Detects the installation of a browser extension that requests excessive permissions, including proxy configuration ('proxy' and 'webRequestAuthProvider') and unrestricted host access ('<all_urls>'). This pattern is commonly exploited by malicious extensions, such as the 'VPN for X' family, to perform adversary-in-the-middle attacks or proxy browser traffic.
Detects the assignment of highly privileged OAuth scopes or application roles to service principals or users within Microsoft Entra ID (formerly Azure AD). This activity is often associated with consent phishing or token abuse, where an adversary attempts to gain long-term programmatic access to sensitive resources like email, files, or directory services using a malicious or compromised application.
This rule detects potentially malicious activity related to AI agent tool manipulation. It flags two primary scenarios: 1) The invocation of an AI tool shortly after an unmanaged or potentially unauthorized modification to its definition, and 2) Detection of prompt injection patterns within the output generated by an AI agent tool, which could indicate an attacker attempting to override the agent's instructions.
Detects an abnormally high volume of configuration changes (15 or more within a 10-minute window) occurring on network appliances such as firewalls or security gateways, originated by a single source user or IP address. This behavior may indicate unauthorized administrative activity, mass policy updates, or malicious tampering.
This rule detects when an OAuth application is granted sensitive Exchange Online permissions, such as 'full_access_as_app', 'Mail.Read', 'Mail.ReadWrite', or 'Mail.Send'. Granting these permissions allows an application to access mailboxes across the tenant without requiring a signed-in user context, which is a common persistence and data exfiltration technique used in Business Email Compromise (BEC) and espionage campaigns.
Detects the addition of suspicious, attacker-controlled URLs (such as webhook.site, ngrok.io, or pipedream.net) as valid redirect URIs in an OAuth application's configuration. This technique can be used by an adversary to intercept OAuth authorization codes or tokens by luring users through a malicious authorization link, enabling persistent unauthorized access without further consent.
Detects high-risk activities related to SAML token-signing certificates, including certificate export from Active Directory Federation Services (AD FS) or Active Directory Certificate Services (AD CS) and unauthorized configuration changes to enterprise application certificate management. These activities are potential precursors to Golden SAML attacks, where an adversary attempts to forge authentication tokens.
Page 3 of 25