Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,064 detections
Filters
Last updated
All Time
Detection languages
597
173
103
71
51
Contributors
184
155
139
90
73
Categories
20,443
11,831
5,875
5,151
4,864
1,064
Platforms
575
266
228
223
118
Products / Services
498
220
130
118
86
MITRE Techniques
488
451
363
349
341
CVEs
10
5
4
3
2
IDS Classtypes
34
3
2
2
1
IDS Protocols
29
9
1
Detects the use of the default, hardcoded 'sk-1234' secret key for HS256 JWT signing in LiteLLM proxy logs. This configuration is insecure and allows for the forgery of arbitrary user session tokens.
Detects anomalous unauthenticated password reset requests targeting the Keycloak reset-credentials endpoint. The rule monitors for high-volume password reset attempts from single source IP addresses, specifically flagging those that target common administrative usernames or attempt to reset passwords across multiple distinct user accounts, which may indicate exploitation attempts (e.g., CVE-2026-18963).
Detects inbound traffic, sign-ins, and email activity originating from the Anthropic IP range 160.79.104.0/21.
Detects inbound traffic, sign-ins, and email activity originating from the Anthropic IP range 160.79.104.0/21.
Detects inbound traffic, sign-ins, and email activity originating from the Anthropic IP range 160.79.104.0/21.
This rule detects various event types (email, identity authentication, network connections, and cloud audit logs) originating from or interacting with the specific IP address range 160.79.104.0/22 to 160.79.111.0/22, which is associated with known malicious activity.
Detects anomalous authentication attempts where a single source IP validates a high volume of distinct Service Principal or App Client IDs within a short timeframe with a high failure rate. This pattern is indicative of attackers performing bulk validation of stolen API keys or OAuth credentials, likely harvested through mobile application decompilation (APK/IPA analysis).
Detects instances where the Grafana MCP (Model Context Protocol) server's service account identity executes administrative tools (such as 'grafana_api_request') within a session that lacks a verified, prior authentication event (bearer token). This pattern suggests an adversary may be spoofing or hijacking a privileged service account session to perform unauthorized administrative actions.
Detects anomalous unauthenticated password reset requests targeting the Keycloak reset-credentials endpoint. The rule monitors for high-volume password reset attempts from single source IP addresses, specifically flagging those that target common administrative usernames or attempt to reset passwords across multiple distinct user accounts, which may indicate exploitation attempts (e.g., CVE-2026-18963).
Detects instances where the Grafana MCP (Model Context Protocol) server's service account identity executes administrative tools (such as 'grafana_api_request') within a session that lacks a verified, prior authentication event (bearer token). This pattern suggests an adversary may be spoofing or hijacking a privileged service account session to perform unauthorized administrative actions.
KQL Query from file: grafana-mcp-grafanaapirequest-call-without-prior-bearer-auth.kql
Detects instances where the Grafana MCP (Model Context Protocol) server's service account identity executes administrative tools (such as 'grafana_api_request') within a session that lacks a verified, prior authentication event (bearer token). This pattern suggests an adversary may be spoofing or hijacking a privileged service account session to perform unauthorized administrative actions.
Detects anomalous authentication attempts where a single source IP validates a high volume of distinct Service Principal or App Client IDs within a short timeframe with a high failure rate. This pattern is indicative of attackers performing bulk validation of stolen API keys or OAuth credentials, likely harvested through mobile application decompilation (APK/IPA analysis).
Detects several potentially malicious activities related to Active Directory Certificate Services (AD CS). This includes high volumes of failed requests (potential enumeration), requests for sensitive templates (privilege escalation), and potential impersonation attempts using Subject Alternative Names (SANs). These activities are associated with AD CS abuse techniques.
Detects signs of Adversary-in-the-Middle (AiTM) phishing kits by identifying sequential, rapid-fire attempts to authenticate using multiple distinct MFA methods (such as push notifications, TOTP codes, or SMS) within a single sign-in session. These attempts are combined with explicit failure states (rejected passwords, rejected codes, or denied MFA requests), suggesting an attacker is relaying authentication challenges in real-time to a victim.
This rule monitors for modifications to the PostgreSQL configuration file 'pg_hba.conf', specifically looking for changes that would enable 'trust' authentication, followed by successful database logins using that method within one hour. This behavior is indicative of an attacker modifying authentication rules to gain unauthorized, passwordless access to a database.
Detects unauthenticated execution of sensitive Grafana MCP tools (tools/call, grafana_api_request) by identifying session IDs that lack a corresponding authenticated handshake event. This behavior is indicative of potential session spoofing or abuse of the MCP protocol where an attacker attempts to interact with privileged tools without performing a valid authentication handshake.
Detects instances where the Grafana MCP (Model Context Protocol) server's service account identity executes administrative tools (such as 'grafana_api_request') within a session that lacks a verified, prior authentication event (bearer token). This pattern suggests an adversary may be spoofing or hijacking a privileged service account session to perform unauthorized administrative actions.
Detects anomalous authentication attempts where a single source IP validates a high volume of distinct Service Principal or App Client IDs within a short timeframe with a high failure rate. This pattern is indicative of attackers performing bulk validation of stolen API keys or OAuth credentials, likely harvested through mobile application decompilation (APK/IPA analysis).
Detects high-frequency password reset or credential recovery attempts originating from a single source IP against multiple user accounts. This behavior is indicative of an automated enumeration or brute-force attack, potentially exploiting vulnerabilities such as the referenced CVE-2026-18963.
Detects high-frequency password reset or credential recovery attempts originating from a single source IP against multiple user accounts. This behavior is indicative of an automated enumeration or brute-force attack, potentially exploiting vulnerabilities such as the referenced CVE-2026-18963.
Page 15 of 51