Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,064 detections
Filters
Last updated
All Time
Detection languages
597
173
103
71
51
Contributors
184
155
139
90
73
Categories
20,443
11,831
5,875
5,151
4,864
1,064
Platforms
575
266
228
223
118
Products / Services
498
220
130
118
86
MITRE Techniques
488
451
363
349
341
CVEs
10
5
4
3
2
IDS Classtypes
34
3
2
2
1
IDS Protocols
29
9
1
Slack Anomalous Activity Detected
Cortex XDR
This rule detects anomalous activity reported by Slack's internal anomaly detection system. This includes events such as impossible travel, new device access, suspicious IP changes, and other behavioral anomalies that could indicate a compromised account or unauthorized access to a Slack workspace.
Detects brute-force tools (Hydra, NLBrute) originating from known RedVDS infrastructure IP ranges/ASNs, indicating cybercriminal VDI abuse.
Detects an account granting offline access, mail, files, directory, or user impersonation permissions shortly after anomalous authentication. This rule is designed to identify potential persistence mechanisms established by adversaries leveraging OAuth applications, as seen in campaigns like Tycoon 2FA AITM.
Detects when a user grants consent to a third-party application via the OAuth consent framework, specifically looking for grants that include highly privileged permissions such as Mail.ReadWrite, Contacts.Read, or offline_access. This can indicate a compromised user account being used to establish persistence or gain further access through a malicious application.
This rule detects attempts to register a new Authenticator app or phone number for multi-factor authentication (MFA) from an IP address that is not typically associated with the user's sign-in behavior. This could indicate a compromised account where an attacker is attempting to establish a new MFA method to maintain access.
Detects high-volume credential stuffing attacks targeting the WordPress 'wp-login.php' endpoint. The rule monitors for multiple geographically distinct source IP addresses submitting HTTP POST requests to the login page within a 2-minute window. It specifically identifies traffic patterns associated with common infostealer-harvested credential campaigns (such as Vidar, Stealc, or DanaBot) by matching a specific User-Agent string associated with the campaign.
Identifies logins from known malicious VPN/Proxy exit nodes geolocated in Canada, specifically attempting to bypass geographic conditional access rules. This rule joins location data with threat intelligence indicators to detect suspicious access patterns.
Detects anomalous, non-interactive Microsoft Graph sign-in activity consistent with the Payroll Pirate session hijacking campaign. The rule flags instances where the same user account authenticates via Microsoft Graph using the 'Firefox/131.0' user agent from multiple distinct source IP addresses within a 6-hour window, indicating potential stolen session token replay from distributed proxy infrastructure.
Detects events in Okta where there is the eventType of "user.session.impersonation.grant".
This grants access in the context of the user. This could be high privilege admin access.
This grants access in the context of the user. This could be high privilege admin access.
Identifies the compromised session token being reused rapidly across Exchange Online, SharePoint, and Teams from a single IP to harvest data. This rule detects when a single account object ID and IP address access 3 or more distinct applications within a 5-minute window, which could indicate the reuse of a compromised token.
Detects MFA factor activation, device enrollment, and password resets originating from residential/commercial proxy infrastructure, often associated with threat groups like BlackFile/UNC6671/Cordial Spider.
Detects a compromised account revoking refresh tokens, signing out other sessions, or replacing authentication state to retain exclusive access. This behavior is indicative of an attacker attempting to maintain exclusive control over a compromised account by invalidating other legitimate sessions or tokens.
Detects high volumes of sign-in failures or instances where Conditional Access policies are not applied, particularly for unregistered devices, indicating potential attempts to bypass security controls or perform brute-force attacks against cloud authentication.
Detects Railway server OS leaking via User-Agent during automated token exchanges. This rule specifically looks for sign-in logs where the User-Agent string indicates a Linux x86_64 system and a Chrome browser version 145 or 146.
Detects Kerberos AS-REQ events (Event ID 4768) where pre-authentication is not used (PreAuthType 0). This is a common indicator of attempts to perform Kerberoasting or AS-REP roasting, as attackers may attempt to request tickets for accounts without requiring the initial pre-authentication step.
Detects AS-REQ requests for accounts where Kerberos pre-authentication is disabled (PreAuthType 0) and insecure ticket encryption types (0x17, 0x18, 0x1) are used. This behavior is indicative of an AS-REP Roasting attack, where an adversary attempts to obtain the encrypted AS-REP response for an account to perform offline brute-force password cracking.
This rule detects high-volume HTTP POST requests to the FortiGate SSL VPN logincheck URI, specifically '/remote/logincheck', over common HTTPS ports (443, 4433, 8443, 9443, 10443). It uses a threshold of 5 requests from the same source IP within 30 seconds to identify potential credential stuffing or password spraying attacks against FortiGate devices, often associated with the 'FortiBleed' campaign.
This rule detects attempts to bypass Conditional Access policies by exchanging a Primary Refresh Token (PRT) for an Azure Active Directory (AAD) Graph token on a device that is either of 'Unknown' ownership or lacks a check-in history, despite being marked as compliant. This behavior could indicate an adversary attempting to gain unauthorized access to resources by leveraging a compromised PRT on an unmanaged or suspicious device, circumventing Conditional Access controls.
Tycoon2FA PHaaS User Agent Detection
Cortex XDR
Detects user agents associated with Tycoon2FA phishing-as-a-service (PHaaS) campaigns, specifically targeting credential relay (axios/1.13.x) and device code phishing (node/undici) variants. The rule identifies sign-in attempts from unmanaged and non-compliant devices using these specific user agents during a device code flow authentication.
Time-series correlation detecting Pass-The-Hash authentication behavior immediately following the extraction of LSASS memory.
Detects automated programmatic token refreshes (BAV2ROPC) originating from Railway IP space. This rule specifically looks for sign-in logs in Azure Active Directory where the UserAgent contains 'BAV2ROPC' and the IPAddress falls within known Railway PaaS IP ranges.
Page 24 of 51