Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,064 detections
Filters
Last updated
All Time
Detection languages
597
173
103
71
51
Contributors
184
155
139
90
73
Categories
20,443
11,831
5,875
5,151
4,864
1,064
Platforms
575
266
228
223
118
Products / Services
498
220
130
118
86
MITRE Techniques
488
451
363
349
341
CVEs
10
5
4
3
2
IDS Classtypes
34
3
2
2
1
IDS Protocols
29
9
1
Detects anomalous device registration behavior where a user account registers multiple unique devices within a very short timeframe (less than 90 seconds). This behavior is characteristic of device code phishing attacks, where an adversary uses automated scripts to rapidly register devices after obtaining authorization codes from victims.
Detects anomalous AWS STS GetCallerIdentity activity characterized by multiple failed authentication attempts (InvalidClientTokenId, SignatureDoesNotMatch, AccessDenied, AuthFailure, InvalidAccessKeyId). This pattern is consistent with an adversary performing bulk validation of stolen or harvested AWS IAM access keys to identify valid credentials.
Detects repeated authentication attempts over PPTP (port 1723) or L2TP (port 1701) protocols originating from an external network, indicative of potential brute-force activity against remote access services.
This rule detects the repeated use of known default credentials (specifically common factory passwords) across multiple device hostnames. It monitors process command lines or event log data for password patterns matching specific hardcoded strings associated with camera device vulnerabilities. By aggregating hits across different devices, it identifies potential automated brute-force or credential-stuffing campaigns targeting IoT camera infrastructure.
This rule detects the repeated use of known default credentials (specifically common factory passwords) across multiple device hostnames. It monitors process command lines or event log data for password patterns matching specific hardcoded strings associated with camera device vulnerabilities. By aggregating hits across different devices, it identifies potential automated brute-force or credential-stuffing campaigns targeting IoT camera infrastructure.
Detects high-frequency HTTP requests to the Dahua easy4ipcloud.com password recovery endpoint. The rule monitors for abnormal volumes of reset requests from a single IP address, which is indicative of an attacker attempting to use offline-generated recovery codes to bypass authentication on Dahua IoT devices.
Detects a sequence of events indicative of an Adversary-in-the-Middle (AiTM) attack, specifically 'NovaCookies'. The rule identifies a phishing email lure (DocuSign/SharePoint-themed) received by a user, followed within a 6-hour window by an anomalous Microsoft 365 sign-in from that same user. The anomalous sign-in is defined by either risk flags or conditional access failure, suggesting potential replay of a captured session cookie.
Detects anomalous, high-frequency password submission patterns from a single IP address within a short timeframe, which is indicative of an Adversary-in-the-Middle (AiTM) phishing proxy (e.g., NovaCookies) testing multiple credentials before proceeding to MFA.
Detects rapid, non-interactive sign-ins to the Microsoft Device Registration Service following a device-code authentication. This pattern is characteristic of attackers using scripted clients (such as python-requests) to automate the registration of rogue devices after harvesting tokens via device-code phishing.
This rule hunts for indicators associated with the TrustSink technique, which involves using rogue External Authentication Methods (EAM) or malicious OIDC providers to bypass authentication or maintain persistence within a cloud environment. It monitors Azure AD sign-in and audit logs, alongside DNS and network events, for references to known malicious domains and URLs used for EAM-based attacks.
This rule hunts for indicators associated with the TrustSink technique, which involves using rogue External Authentication Methods (EAM) or malicious OIDC providers to bypass authentication or maintain persistence within a cloud environment. It monitors Azure AD sign-in and audit logs, alongside DNS and network events, for references to known malicious domains and URLs used for EAM-based attacks.
This rule monitors various logs (device network events, Entra ID sign-ins, cloud application events, and email events) for any interaction with a predefined list of indicator IP addresses identified as being associated with malicious actor egress traffic.
This rule monitors for ADFS-related security events that may indicate credential theft or authentication bypass attempts. It flags anomalous federated sign-in events (e.g., MFA bypass, unfamiliar location), unauthorized access to the ADFS DKM container in Active Directory, and suspicious attempts to export ADFS token-signing certificates.
This rule detects activity associated with the 'Ghostcode' threat campaign by monitoring multiple telemetry sources. It identifies connections to known malicious IP addresses and domains, patterns consistent with phishing kit hosting, and specific URL structures used in credential harvesting or payload delivery. The rule correlates sign-in logs, device network events, DNS queries, and email telemetry to identify potential compromise.
This rule detects activity associated with the 'Ghostcode' threat campaign by monitoring multiple telemetry sources. It identifies connections to known malicious IP addresses and domains, patterns consistent with phishing kit hosting, and specific URL structures used in credential harvesting or payload delivery. The rule correlates sign-in logs, device network events, DNS queries, and email telemetry to identify potential compromise.
Detects high-volume authentication attempts against Fortinet network appliances where multiple distinct source IPs successfully authenticate against multiple distinct accounts matching specific administrative naming patterns. This pattern is indicative of potential credential stuffing or brute-force campaigns targeting edge infrastructure.
Detects usage of the OAuth device code authentication flow by high-value accounts (Finance, Accounts Payable, Admins). This flow is often abused in phishing campaigns to obtain access tokens by coercing users to authorize malicious applications via a code entry process.
This rule detects authentication events using the Device Code OAuth flow where the user account name contains keywords associated with sensitive or privileged roles (such as 'finance', 'admin', 'accounts'), originating from non-private (external) IP addresses. This activity is indicative of potential device code phishing attacks targeting sensitive user accounts.
Detects suspicious OAuth device code authorization requests matching the GhostCode phishing kit's pattern. The rule identifies the use of a known Microsoft Authentication Broker App ID (29d9ed98-a469-4536-ade2-f981bc1d605e) coupled with the 'python-requests' user agent, which are characteristic indicators of the phishing backend server attempting to authorize malicious requests.
This rule detects successful authentication events using the Microsoft OAuth device code flow, which is often abused in phishing campaigns to hijack user sessions. It flags authentication attempts that match specific device authorization URLs, include signs of bypassing security warnings, or indicate a lack of direct user authentication interaction.
Detects OAuth 2.0 device authorization grant requests utilizing the Microsoft Authentication Broker application ID (29d9ed98-a469-4536-ade2-f981bc1d605e) with sensitive scopes like 'https://graph.microsoft.com/.default'. This specific application ID is frequently impersonated by phishing kits (e.g., GhostCode) to facilitate token theft via device code flow abuse, where adversaries trick users into authenticating to a legitimate-looking but attacker-controlled flow.
Page 11 of 51