Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,064 detections
Filters
Last updated
All Time
Detection languages
597
173
103
71
51
Contributors
184
155
139
90
73
Categories
20,443
11,831
5,875
5,151
4,864
1,064
Platforms
575
266
228
223
118
Products / Services
498
220
130
118
86
MITRE Techniques
488
451
363
349
341
CVEs
10
5
4
3
2
IDS Classtypes
34
3
2
2
1
IDS Protocols
29
9
1
Detects instances where the Grafana MCP (Model Context Protocol) server's service account identity executes administrative tools (such as 'grafana_api_request') within a session that lacks a verified, prior authentication event (bearer token). This pattern suggests an adversary may be spoofing or hijacking a privileged service account session to perform unauthorized administrative actions.
Detects invocations of the 'grafana_api_request' tool that lack a preceding valid bearer-token authentication event for the same session. This indicates a potential scenario where a server or service account token is being used on behalf of an unauthenticated caller, bypassing normal authentication requirements for the Grafana API.
Detects access to common authentication/login endpoints.
Detects signs of Adversary-in-the-Middle (AiTM) phishing kits by identifying sequential, rapid-fire attempts to authenticate using multiple distinct MFA methods (such as push notifications, TOTP codes, or SMS) within a single sign-in session. These attempts are combined with explicit failure states (rejected passwords, rejected codes, or denied MFA requests), suggesting an attacker is relaying authentication challenges in real-time to a victim.
This rule monitors for high or medium-risk user events and sign-in activities within Azure Active Directory. It correlates data from both the AADUserRiskEvents and SigninLogs tables to identify potentially compromised user accounts.
Detects Keycloak password reset attempts (UPDATE_PASSWORD) where the user has not performed the required preceding email verification (SEND_RESET_PASSWORD) and lacks a valid action-token. This pattern suggests an attempt to bypass the standard password reset workflow.
This rule detects messages sent or chats created in Microsoft Teams by external or guest users where the chat name or message content impersonates IT support, helpdesk, or other official organizational entities. It specifically looks for keywords commonly used in phishing attempts to trick users into believing the sender is a legitimate internal service.
This rule aggregates sign-in log activity for a specific user to identify the volume and distribution of authentication attempts across different IP addresses, applications, and client types within a specified time range. It is primarily used for identifying anomalies in access patterns that might indicate credential abuse or unauthorized access.
The following analytic detects when su runs from a page-cache-corrupted binary.
When this happens a partial corruption of its runtime state can prevent it from resolving the identity of the calling user.
Under normal conditions, su logs both the target account and the invoking user.
When exploitation has occurred via this path, the invoking username field is absent.
This activity is significant because it indicates a possible privilege escalation attempt, allowing a user to gain root access.
If confirmed malicious, an attacker could achieve full control over the system, execute arbitrary commands, and compromise the entire environment.
When this happens a partial corruption of its runtime state can prevent it from resolving the identity of the calling user.
Under normal conditions, su logs both the target account and the invoking user.
When exploitation has occurred via this path, the invoking username field is absent.
This activity is significant because it indicates a possible privilege escalation attempt, allowing a user to gain root access.
If confirmed malicious, an attacker could achieve full control over the system, execute arbitrary commands, and compromise the entire environment.
Detects sign-in activity within Microsoft Entra ID characterized by User-Agent strings indicative of automated tools, command-line HTTP clients, and security testing software. This rule is designed for anomaly detection and necessitates correlation with other context such as source IP, authentication results, and user behavior to identify potential malicious activity.
Detects high-frequency state changes in authentication events for a single account within a short time window. This type of 'flapping' behavior, where an account repeatedly toggles between different authentication statuses (e.g., success and failure) on one or more hosts, can be an indicator of brute force attempts, credential stuffing, or misconfigured automated authentication services.
This rule detects messages sent or chats created in Microsoft Teams by external or guest users where the chat name or message content impersonates IT support, helpdesk, or other official organizational entities. It specifically looks for keywords commonly used in phishing attempts to trick users into believing the sender is a legitimate internal service.
Detects high-frequency state changes in authentication events for a single account within a short time window. This type of 'flapping' behavior, where an account repeatedly toggles between different authentication statuses (e.g., success and failure) on one or more hosts, can be an indicator of brute force attempts, credential stuffing, or misconfigured automated authentication services.
A GitHub maintainer account related to the keyv/cacheable npm package ecosystem was compromised. The attacker published malicious versions of these packages, which affected more than 400 npm packages. The malware is designed to steal cloud credentials, developer secrets, CI/CD secrets, AI tool configuration files, and cryptocurrency wallet data. It also creates persistence using Claude Code hooks and VS Code tasks.json files, and sends stolen data to attacker-controlled GitHub repositories and C2 domains.
Reference article: https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack
Reference article: https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack
Detects anomalous device code authentication patterns by monitoring SigninLogs for accounts utilizing the device code flow across multiple countries or with a high volume of attempts within a short timeframe. This behavior is indicative of potential device code phishing or automated authentication abuse.
Detects Okta accounts that enroll a new MFA factor within a short window after multiple failed or abandoned MFA authentication attempts. This behavior is indicative of an attacker who has compromised credentials and is attempting to establish persistent access by bypassing or reconfiguring MFA. The rule includes logic to exclude legitimate self-service enrollments that have a corresponding verified helpdesk or change-management ticket.
Detects anomalous device code authentication patterns by monitoring SigninLogs for accounts utilizing the device code flow across multiple countries or with a high volume of attempts within a short timeframe. This behavior is indicative of potential device code phishing or automated authentication abuse.
This rule identifies potential post-Adversary-in-the-Middle (AiTM) session hijacking by correlating suspicious initial authentication events (e.g., AiTM indicators, unusual behavioral flags) with subsequent successful sign-ins originating from known residential proxies or anonymization VPN providers within a 24-hour window.
Detects MFA authentication attempts in Duo where the source IP address is identified by Duo as a known anonymous proxy, VPN, or Tor exit node. Such infrastructure is frequently used by adversaries to mask their true origin during credential stuffing, session hijacking, or post-compromise activity.
This rule detects instances where a user has explicitly marked an MFA push notification as fraudulent within the Duo Security platform. This indicates that an unauthorized party may have triggered an MFA request using stolen credentials, and the legitimate user is actively denying the authentication attempt.
This rule detects a potential password spraying attack followed by a successful sign-in from a non-UK location. It monitors for a threshold of failed sign-in attempts from distinct source IPs for a specific user within a 4-hour window, followed by a subsequent successful sign-in event from a different geographical location.
Page 17 of 51