Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,064 detections
Filters
Last updated
All Time
Detection languages
597
173
103
71
51
Contributors
184
155
139
90
73
Categories
20,443
11,831
5,875
5,151
4,864
1,064
Platforms
575
266
228
223
118
Products / Services
498
220
130
118
86
MITRE Techniques
488
451
363
349
341
CVEs
10
5
4
3
2
IDS Classtypes
34
3
2
2
1
IDS Protocols
29
9
1
This rule identifies enterprise resource access from OnePlus or OxygenOS devices that lack proper management or compliance. It calculates an exposure score based on factors including device management status, compliance state, device trust type, and whether the device is newly observed. The rule flags high and medium priority exposure incidents, specifically targeting non-managed or non-compliant BYOD devices, which could represent an increased risk profile for corporate data access.
This rule detects activity associated with the 'Ghostcode' threat campaign by monitoring multiple telemetry sources. It identifies connections to known malicious IP addresses and domains, patterns consistent with phishing kit hosting, and specific URL structures used in credential harvesting or payload delivery. The rule correlates sign-in logs, device network events, DNS queries, and email telemetry to identify potential compromise.
Detects the use of the device code authentication protocol in Azure Sign-in logs, which is a common vector used in Adversary-in-the-Middle (AiTM) phishing attacks to hijack OAuth tokens.
Detects suspicious Microsoft Intune device enrollment activities characterized by the use of a spoofed User-Agent (matching Microsoft Office/Outlook strings) and rapid, multiple enrollment attempts within a short timeframe. This behavior is associated with adversary use of device-code phishing kits to enroll rogue devices using stolen session tokens.
Detects high-volume account existence checks targeting the Microsoft Teams API. The rule identifies anomalous authentication attempts characterized by the use of outdated Electron/Chrome user-agent strings associated with the TeamFiltration tool, specifically targeting the Microsoft Teams API AppId (1fec8e78-bce4-4aaf-ab1b-5451cc387264).
Detects a sequence of suspicious identity activities indicative of a post-account-takeover pivot. The rule identifies a user profile engaging in corporate VPN SAML SSO probing, triggering a MFA enrollment interrupt in Azure, and subsequently accessing multiple Microsoft 365 applications (Azure Portal, OfficeHome, SharePoint) within a 30-minute window.
Detects a sequence of suspicious identity activities indicative of a post-account-takeover pivot. The rule identifies a user profile engaging in corporate VPN SAML SSO probing, triggering a MFA enrollment interrupt in Azure, and subsequently accessing multiple Microsoft 365 applications (Azure Portal, OfficeHome, SharePoint) within a 30-minute window.
Detects high-volume account existence checks targeting the Microsoft Teams API. The rule identifies anomalous authentication attempts characterized by the use of outdated Electron/Chrome user-agent strings associated with the TeamFiltration tool, specifically targeting the Microsoft Teams API AppId (1fec8e78-bce4-4aaf-ab1b-5451cc387264).
Detects anomalous sign-in patterns from a single IP address that target multiple accounts with a high success rate within a short timeframe. This behavior is indicative of targeted credential guessing or password spraying informed by reconnaissance, as it deviates from the typical low-success-rate patterns of broad brute-force attacks.
Detects repeated authentication attempts over PPTP (port 1723) or L2TP (port 1701) protocols originating from an external network, indicative of potential brute-force activity against remote access services.
Detects potential password spraying activity in Azure Active Directory by identifying a single source IP address that authenticates against multiple distinct user accounts within a short time frame. The rule flags instances where there are numerous authentication attempts across many users, characterized by a low per-user failure count followed by at least one successful authentication, which is indicative of a successful password spray attempt.
Detects a burst of MFA push/approval prompts (5+ in 10 minutes) to one user culminating in an eventual approval after repeated denials/timeouts — the push-bombing technique Scattered Spider and Mutant Spider pair with helpdesk vishing to exhaust remaining MFA resistance.
Detects anomalous Kerberos ticket requests characteristic of Golden Ticket attacks. These forged tickets are created offline using the KRBTGT account hash, bypassing legitimate KDC TGT issuance, and frequently exhibit default Mimikatz artifacts such as RC4 encryption or extended ticket lifetimes.
This rule detects potential MFA fatigue attacks (Push Bombing) by monitoring sign-in logs for a high volume of authentication prompts directed at a single user within a one-hour window. It specifically identifies patterns where a user receives multiple denied MFA push requests followed by at least one successful approval. The rule also accounts for suspicious behavior such as requests originating from multiple IP addresses or geographic locations.
This rule monitors authentication events for the 'deviceCode' protocol where multi-factor authentication (MFA) was not required or completed. This is a common indicator of device code phishing attacks, where an adversary lures a user into authorizing a malicious device or application, often bypassing organizational MFA policies.
Detects the use of the OAuth device code authentication flow in Azure AD/Entra ID sign-in events. This flow is frequently abused by attackers who use vishing or SMS phishing pretexts to trick users into authorizing a device login, enabling the attacker to obtain a valid session token without direct credential harvesting or cookie theft.
Detects high-volume authentication attempts against Fortinet network appliances where multiple distinct source IPs successfully authenticate against multiple distinct accounts matching specific administrative naming patterns. This pattern is indicative of potential credential stuffing or brute-force campaigns targeting edge infrastructure.
This rule detects activity associated with the 'Ghostcode' threat campaign by monitoring multiple telemetry sources. It identifies connections to known malicious IP addresses and domains, patterns consistent with phishing kit hosting, and specific URL structures used in credential harvesting or payload delivery. The rule correlates sign-in logs, device network events, DNS queries, and email telemetry to identify potential compromise.
Detects several potentially malicious activities related to Active Directory Certificate Services (AD CS). This includes high volumes of failed requests (potential enumeration), requests for sensitive templates (privilege escalation), and potential impersonation attempts using Subject Alternative Names (SANs). These activities are associated with AD CS abuse techniques.
Detects network requests to the Microsoft authentication service specifically targeting the /common/oauth2/deviceauth endpoint, which is used in the OAuth 2.0 Device Authorization Grant flow. While legitimate for device authentication (e.g., CLI tools, smart devices), this flow can be abused by adversaries for phishing attacks to bypass traditional credential-based MFA, allowing them to gain persistent access to a user account once the target authorizes the code.
This rule detects non-interactive Azure AD sign-in attempts that utilize the device code authentication flow, specifically targeting a Microsoft authentication broker App ID while originating from a Python-requests user agent. This combination is often indicative of automated scripts or malicious tools attempting to bypass standard authentication workflows to gain access to cloud resources.
Page 10 of 51