Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,064 detections
Filters
Last updated
All Time
Detection languages
597
173
103
71
51
Contributors
184
155
139
90
73
Categories
20,443
11,831
5,875
5,151
4,864
1,064
Platforms
575
266
228
223
118
Products / Services
498
220
130
118
86
MITRE Techniques
488
451
363
349
341
CVEs
10
5
4
3
2
IDS Classtypes
34
3
2
2
1
IDS Protocols
29
9
1
This rule detects potential cloud data exfiltration by identifying anomalous device-code authentication sign-ins followed by high-velocity file or mailbox access. It specifically monitors Microsoft 365 sign-in logs for device-code authentication sessions involving either an application (AppId) or a geographic location not seen in the user's previous 14-day baseline. If such a sign-in is immediately followed (within a 2-hour window) by a rapid burst of activity in SharePoint, OneDrive, or Exchange—defined by at least 20 operations at a rate of 5 or more events per minute—the rule flags the sequence as suspicious. This pattern is characteristic of attackers using stolen device-code tokens to programmatically mass-download or exfiltrate sensitive cloud data.
Slack Anomalous Activity
Cortex XDR
This rule detects anomalous activity reported by Slack's internal anomaly detection system. This includes events such as impossible travel, new device access, suspicious IP changes, and other behavioral anomalies that Slack identifies. The rule extracts relevant user and context information for further investigation.
Detects login or authentication attempts to a Cisco Firewall Management Center (FMC) management interface from non-authorized source IP addresses. The rule specifically flags connections targeting potential low-privilege or service accounts that may indicate unauthorized access attempts or brute-force behavior directed at critical network infrastructure.
PKINIT DC Impersonation from Non-DC Host
Cortex XDR
This rule detects potential Kerberos PKINIT (Pre-Authentication Type 16) authentication requests where a Domain Controller account (identified via User Account Control bit 8192) is targeted by an authentication attempt originating from a non-DC client address. This behavior may indicate an attempt to impersonate or misuse a high-privilege account for lateral movement or persistence.
Detects login or authentication attempts to a Cisco Firewall Management Center (FMC) management interface from non-authorized source IP addresses. The rule specifically flags connections targeting potential low-privilege or service accounts that may indicate unauthorized access attempts or brute-force behavior directed at critical network infrastructure.
This query performs comprehensive field extraction and normalization on SentinelOne Deep Visibility raw logs. It acts as a parsing and preparation layer to structure diverse event categories (process, network, file, registry, authentication, and task events) into a standardized format for security analysis, triage, and threat hunting.
This rule monitors Okta system logs for lifecycle events related to inbound Identity Providers (IdP), specifically creation, modification, activation, deactivation, or deletion. It flags these changes when initiated by clients identified as proxies or associated with known abused ASNs. This activity is indicative of potential cross-tenant impersonation where an attacker with administrative access adds a malicious IdP to federate and impersonate organizational users.
Detects Microsoft Entra ID sign-in events using the Resource Owner Password Credentials (ROPC) flow where the client application displays a blank name. This pattern is commonly associated with attackers spoofing OAuth client IDs to bypass security controls or perform user enumeration.
Detects high-frequency Resource Owner Password Credentials (ROPC) authentication attempts originating from a single IP address against multiple different user accounts within a 15-minute window. This behavior is indicative of a password spraying or brute force campaign targeting cloud authentication services.
Detects high-frequency authentication attempts or broad user targeting originating from scripts using the 'python-requests' library. This behavior is indicative of programmatic password spraying or automated credential stuffing attacks.
This rule detects potential OAuth Device Code Flow phishing attacks where users are directed to malicious lure pages on romnor[.]ca to enter a Microsoft device code. It also alerts on authentication activity associated with a specific malicious OAuth client ID (d3590ed6-52b3-4102-aeff-aad2292ab01c) known to be used by a phishing backend to poll and claim OAuth tokens.
Detects suspicious use of the OAuth 2.0 device code authentication flow. The rule identifies potential token harvesting and phishing attempts by flagging device code sign-ins that originate from unusual user agents, unknown IP addresses or ASNs, unrecognized applications, or for users who have not previously utilized device code authentication. Legitimate, first-party applications like Azure CLI and Azure PowerShell are explicitly excluded to minimize noise.
Detects high volumes of sign-in failures originating from the same IP address, specifically those returning error codes associated with invalid users or incorrect passwords, which is indicative of credential stuffing or user enumeration attacks targeting Entra ID.
Detects sign-in events where a sign-in attempt is performed with a valid application ID but contains a blank application name, indicating potential spoofing of an OAuth client to bypass Conditional Access policies. The rule specifically monitors instances where Conditional Access status is recorded as 'notApplied'.
This rule detects authentication attempts to the 'Device Registration Service' in Entra ID where the User-Agent string contains 'python'. This is often indicative of automated scripts, such as those using libraries like msal, being used to interact with device management APIs, which may be associated with legitimate automation or adversary activity.
This rule serves as an investigation framework for Microsoft Entra ID sign-in events. It enables security analysts to filter, normalize, and inspect user authentication activities, including sign-in types (interactive/non-interactive), device management status, user risk levels, and conditional access status. The query is designed for incident response and forensic analysis rather than automated alerting.
Detects anomalous, high-volume enumeration of Azure OAuth application IDs from a single IP address, indicative of an adversary attempting to map or verify OAuth applications, potentially leveraging spoofed client IDs for discovery or bypass attempts.
Detects high-frequency Resource Owner Password Credentials (ROPC) authentication requests targeting the OAuth token endpoint. Attackers use ROPC for brute-forcing, credential stuffing, or bypassing security controls by directly passing user credentials to the OAuth flow.
Detects high volumes of authentication failures (AADSTS50034) targeting non-existent or invalid usernames from a single source IP address, potentially indicating account enumeration or password spraying activity.
Detects login attempts using an Outlook/Office-specific User-Agent string where the application being accessed does not match common Microsoft 365 services (Outlook, Office, Exchange, Teams, OneDrive, SharePoint, ActiveSync, or Skype). This pattern is often indicative of programmatic attempts to bypass or spoof standard application signatures during credential stuffing or brute force campaigns.
Detects Microsoft Entra ID authentication attempts (Resource Owner Password Credentials - ROPC) where the Client ID and Application Display Name are blank. This pattern is indicative of attackers attempting to enumerate users or bypass security controls by using malformed or spoofed client identification in authentication requests.
Page 18 of 51