Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,065 detections
Filters
Last updated
All Time
Detection languages
598
173
103
71
51
Contributors
184
155
139
90
73
Categories
20,453
11,837
5,876
5,154
4,865
1,065
Platforms
576
266
228
223
118
Products / Services
499
220
130
118
86
MITRE Techniques
488
451
364
349
341
CVEs
10
5
4
3
2
IDS Classtypes
34
3
2
2
1
IDS Protocols
29
9
1
This rule detects an unusual pattern of multiple login attempts from several unique devices using Windows Hello for Business within a short timeframe (5 minutes) for a single user. This could indicate an MFA bypass attempt or a compromised account where an adversary is attempting to gain access from various devices.
This rule detects potential multi-factor authentication (MFA) bypass attempts for privileged accounts. It identifies instances where an administrative user attempts 10 or more sign-ins from 3 or more unique devices within a 5-minute window, specifically when the authentication method is 'Push notification to app' and the result type is '0' (success). This behavior could indicate an adversary attempting to bypass MFA for a privileged account.
This rule detects suspicious authentication behavior where a user logs in with multiple unique devices and multiple MFA methods within a short timeframe (5 minutes). This could indicate an attempt to bypass multi-factor authentication or account compromise.
This rule detects repeated failed or successful logon attempts (EventID 4625 or 4624) to sensitive system accounts like 'SYSTEM', 'LOCAL SERVICE', 'NETWORK SERVICE', or 'ADMIN$' from non-system accounts. It specifically looks for interactive (LogonType 10), remote interactive (LogonType 3), or unlock (LogonType 9) logons, and triggers if there are 3 or more such attempts within an hour for the same account and computer.
This rule detects anomalous access to cloud services, specifically Salesforce, Drift, Salesloft, HubSpot, and Marketo, that may indicate OAuth token abuse. It identifies scenarios where a high volume of actions (8 or more) occur within a short timeframe (3 hours or less) from a single IP address but with multiple unique user agents (2 or more). The detection is further refined by looking for actions related to 'Add delegated permission grant' or 'Create service principal', which are indicative of an attacker attempting to establish persistence or escalate privileges after gaining access through a compromised OAuth token.
Detects forged Golden SAML tokens used for identity federation bypass
Detects unauthorized access to manufacturing process historian databases (OSIsoft PI, Honeywell PHD, Aspen IP.21) by non-engineering accounts from unexpected workstations. The rule correlates audit logs showing access to historian systems with sign-in logs for specific applications, identifying users with a high volume of access within a short timeframe.
This rule detects multiple attempts by a user account to perform a Directory Synchronization (DirSync) operation, which is a common indicator of a DCSync attack. The rule specifically looks for Event ID 4662 with properties containing 'DS-DirSync' or '131072', filters for user accounts, excludes known service accounts, and triggers if there are 5 or more attempts from the same account and computer.
Detects attempts to abuse the device code flow targeting Microsoft Office and Authentication Broker applications from unmanaged and non-compliant devices with unbound tokens. This activity is indicative of device code phishing, where an attacker tricks a user into authenticating a malicious application.
This rule detects a high volume of remote desktop session changes (logon/logoff) for a single user within a one-hour window. Event IDs 4778 and 4779 indicate a session reconnected or disconnected, respectively. A high count (>=10) could suggest suspicious activity such as session hijacking, rapid reconnections by an attacker, or automated tools interacting with remote sessions.
This rule detects potential Kerberos Golden Ticket attacks by identifying Kerberos authentication service (AS) request events (EventID 4768) where the ticket encryption type is 0x17 (RC4-HMAC) and the difference between the event generation time and the ticket's start time is greater than one day. This large time difference can indicate a forged ticket with an invalid timestamp, a common characteristic of Golden Tickets. The rule then summarizes these events by target username and computer, flagging instances where three or more such events occur.
This rule detects multiple attempts (10 or more within an hour) from a single IP address to access administrative interfaces on a web server. It specifically looks for URI queries containing keywords like 'admin', 'wp-admin', or 'administrator' in W3CIISLog data. Such activity often indicates a brute-force attack or scanning for administrative login pages.
This rule detects potential MFA bypass attempts by identifying multiple successful sign-ins from the same user within an hour where Conditional Access policies were not applied, and no MFA method was used. This could indicate an adversary circumventing security controls to gain unauthorized access.
This rule detects an unusual pattern of multiple login attempts from several unique devices using Windows Hello for Business within a short timeframe (5 minutes) for a single user. This could indicate an MFA bypass attempt or a compromised account where an adversary is attempting to gain access from various devices.
This rule detects potential multi-factor authentication (MFA) bypass attempts for privileged accounts. It identifies instances where an administrative user attempts 10 or more sign-ins from 3 or more unique devices within a 5-minute window, specifically when the authentication method is 'Push notification to app' and the result type is '0' (success). This behavior could indicate an adversary attempting to bypass MFA for a privileged account.
Detects access to the Intune admin portal from devices that are not marked as compliant or lack a device ID. This may indicate potential credential theft, session replay from unmanaged infrastructure, or AiTM phishing proxies bypassing basic MFA.
This rule detects potential Kerberos Golden Ticket attacks by identifying Kerberos authentication service (AS) request events (EventID 4768) where the ticket encryption type is 0x17 (RC4-HMAC) and the difference between the event generation time and the ticket's start time is greater than one day. This large time difference can indicate a forged ticket with an invalid timestamp, a common characteristic of Golden Tickets. The rule then summarizes these events by target username and computer, flagging instances where three or more such events occur.
This rule detects a VNC brute force login attempt. It triggers when there are 10 or more TCP connections to port 5900 (the default VNC port) from the same source IP address within a 30-second window, indicating a rapid succession of login attempts.
Detects when the same SessionId is used to sign in from more than one location across interactive and non-interactive sign-ins.
This rule detects an unusually high volume of logon events (both successful and failed) or a large number of unique users attempting to log on within a 5-minute window. This behavior is indicative of potential brute-force attacks or credential stuffing attempts against Windows systems.
This rule detects suspicious activity related to Azure AD device registration. It identifies instances where a single user principal name (UPN) performs 5 or more device registrations or adds members to groups within a one-hour window, specifically targeting device resources. This could indicate an adversary attempting to register multiple devices to bypass conditional access policies or gain persistent access.
Page 28 of 51