Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,064 detections
Filters
Last updated
All Time
Detection languages
597
173
103
71
51
Contributors
184
155
139
90
73
Categories
20,443
11,831
5,875
5,151
4,864
1,064
Platforms
575
266
228
223
118
Products / Services
498
220
130
118
86
MITRE Techniques
488
451
363
349
341
CVEs
10
5
4
3
2
IDS Classtypes
34
3
2
2
1
IDS Protocols
29
9
1
This rule detects device registration activities in Entra ID using the specific AppId associated with the DCL broker, which is commonly leveraged to register unauthorized virtual devices. This registration process is often used by adversaries to facilitate Primary Refresh Token (PRT) acquisition, enabling persistent access or bypassing conditional access controls.
This rule detects suspicious sign-in attempts to Microsoft services (login.microsoftonline.com, graph.microsoft.com, outlook.office365.com) that occur within 30 minutes of a user clicking on a URL associated with these services. The sign-in is considered suspicious if it originates from a user agent commonly used by automated tools (e.g., axios, curl, python-requests, httpclient, Go-http-client) and is flagged with a 'atRisk' or 'high' risk level by Azure AD. This combination suggests a potential credential compromise following a phishing attempt, where an attacker might be using automated tools to leverage stolen credentials.
This rule computes a composite risk score for user authentication events across multiple identity and network providers (Okta, Azure AD, VPNs, etc.). It flags suspicious patterns including impossible travel, credential stuffing indicators (multiple failures followed by success), new or unknown devices, and lateral movement attempts (concurrent access to both VPN and SSO services). Only users meeting a risk score threshold of 40 or higher with at least one successful authentication are reported.
Detects malicious activities targeting Cisco Catalyst SD-WAN infrastructure, including connections from known malicious IP addresses (UAT-8616), unauthenticated vManage API access attempts indicative of exploitation (CVE-2026-20182), and anomalous control-plane signaling (OMP/DTLS/NETCONF) from unauthorized external sources.
Detects rapid succession of MFA authentication requests originating from multiple distinct countries within a 10-minute window, a common pattern indicating an MFA fatigue (push bombing) attack targeting a specific user.
Detects potential Pass-the-Hash (PtH) activity by identifying NTLM Type 3 logons where the account domain originates from outside the local or known corporate domain. The rule specifically excludes system-related accounts such as ANONYMOUS LOGON, WORKGROUP, and NT AUTHORITY, focusing on attempts to authenticate against internal resources using potentially forged or captured credentials.
Detects sign-in events using the device code authentication flow (OAuth 2.0 device authorization grant) where the originating IP address is external to the organization's private network. This flow is often abused by attackers to bypass traditional MFA or interact with headless environments via common HTTP client libraries like Python requests, Go-http, or Axios.
This rule detects potential lateral movement activity by identifying a single user account attempting to log on to five or more distinct computers with at least ten logon attempts within a five-minute window. It specifically looks for successful logons (EventID 4624) with network, remote interactive, or remote desktop logon types (LogonType 3, 9, 10) and excludes machine accounts (TargetUserName not ending with '$'). This pattern can indicate an adversary attempting to spread across the network using compromised credentials.
Detects evidence of CVE-2026-48558 exploitation, where SimpleHelp servers fail to cryptographically verify OIDC tokens. This vulnerability allows unauthenticated attackers to create privileged technician accounts and bypass Multi-Factor Authentication (MFA). The rule monitors for 'New Anon' log tags in OIDC authentication flows or unauthorized HTTP POST requests to SimpleHelp technician management endpoints.
Detects Microsoft Device Code grant type authentications in Entra ID sign-in logs, consistent with the EvilTokens phishing kit abusing the OAuth device code flow to steal tokens without capturing passwords. Flags DeviceCode protocol sign-ins from browser-based clients, which is atypical for legitimate device code usage.
This rule monitors authentication events across various SaaS platforms (Jira, Okta, Azure AD, Google Workspace, Auth0, OneLogin) to detect suspicious activity. It calculates a risk score based on indicators such as impossible travel, high volume of distinct source IPs or geographic locations, and anomalous user agent activity, flagging sessions that exceed a defined risk threshold.
This rule detects potential brute-force or credential stuffing attempts against web application authentication endpoints by monitoring patterns of success and failure. It aggregates requests over 5-minute intervals, calculating a risk score based on high volumes of authentication failures relative to successful requests from individual source IPs targeting sensitive API paths (e.g., auth, session, login, token).
This rule detects potential brute-force or credential stuffing attempts against web application authentication endpoints by monitoring patterns of success and failure. It aggregates requests over 5-minute intervals, calculating a risk score based on high volumes of authentication failures relative to successful requests from individual source IPs targeting sensitive API paths (e.g., auth, session, login, token).
This rule detects unauthorized exploitation attempts against Gitea environments vulnerable to CVE-2026-20896. When Gitea is configured with REVERSE_PROXY_TRUSTED_PROXIES set to permit all sources, an attacker can bypass authentication by injecting the 'X-WEBAUTH-USER: admin' header in HTTP requests. This allows the attacker to gain administrative privileges and perform unauthorized actions, such as creating new admin accounts or accessing restricted API endpoints.
Detects successful exploitation of the CVE-2026-48558 OIDC authentication bypass vulnerability in SimpleHelp. The rule monitors for a forged OIDC response processed by the OIDCAuthenticator followed immediately by the registration of a new technician account marked with the [New Anon] identifier, indicating identity verification failure and unauthorized privileged account creation.
This rule detects network connections and user sign-ins originating from IP addresses identified as belonging to Iran. It also identifies sign-ins where the reported country is Iran, but the IP address is not found within the provided Iranian IP list, which could indicate IP geolocation discrepancies or obfuscation attempts.
This rule detects and summarizes Kerberos authentication ticket requests (EventID 4765) and Kerberos authentication ticket request failures (EventID 4766) by subject username on an hourly basis. A high volume of these events for a single user could indicate credential stuffing, brute-force attempts, or other authentication-related anomalies.
This rule detects repeated attempts to use privileges for access checks (EventID 4673) by a single user within a one-hour window, excluding the 'SeTrustedCredentialManagerAccessPrivilege'. A high count of such events (5 or more) could indicate an attempt at privilege escalation or unusual system access behavior.
This rule detects potential exploitation of the CVE-2026-48558 vulnerability in SimpleHelp servers by monitoring for specific sequences of log markers related to authentication bypass and unauthorized configuration changes. It flags anomalous technician registrations, OIDC attribute fetching, and 'New Anon' configuration saves within a 60-second window, which are indicative of an attacker attempting to gain unauthorized access or manipulate session security.
Detects Microsoft Graph API enumeration of privileged directory endpoints using a token with only User.Read scope and password-only authentication (amr: pwd). This activity is consistent with the exploitation of CVE-2025-0309, often associated with tooling like AzureHound/roadtx, which abuses hidden Conditional Access exclusion policies.
This rule detects suspicious activity related to Azure AD device registration. It identifies instances where a single user principal name (UPN) performs 5 or more device registrations or adds members to groups within a one-hour window, specifically targeting device resources. This could indicate an adversary attempting to register multiple devices to bypass conditional access policies or gain persistent access.
Page 20 of 51