Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,064 detections
Filters
Last updated
All Time
Detection languages
597
173
103
71
51
Contributors
184
155
139
90
73
Categories
20,443
11,831
5,875
5,151
4,864
1,064
Platforms
575
266
228
223
118
Products / Services
498
220
130
118
86
MITRE Techniques
488
451
363
349
341
CVEs
10
5
4
3
2
IDS Classtypes
34
3
2
2
1
IDS Protocols
29
9
1
This rule detects a potential SSH password brute force attack. It triggers an alert if there are 30 or more TCP connections to port 22 (SSH) on the home network from a single source IP address within a 60-second window. The 'flow:to_server' and 'flags:S' indicate that it's looking for new connection attempts (SYN packets) directed towards the server.
This rule detects HTTP POST requests to common cloud console login pages (AWS, Microsoft Azure, Google Cloud) that originate from a suspicious IP range. The rule uses a threshold of 5 attempts within 30 seconds from the same source IP to trigger an alert, indicating potential brute-force or credential stuffing attacks against cloud accounts.
This rule detects suspicious NTLM network or remote interactive logon activity. It specifically looks for multiple distinct accounts logging in from the same device and remote IP address within a one-hour window, using NTLM authentication via NtLmSsp or Seclogon processes. This pattern can indicate credential stuffing, NTLM relay attacks, or other forms of credential misuse.
This rule detects suspicious device enrollment attempts via Microsoft Intune Company Portal from a country not previously observed in a user's 7-day sign-in history. It identifies two primary patterns: sustained successful sign-ins from a new country, indicating a potential active session and successful device enrollment (High Severity), or Conditional Access Policy (CAP) blocked attempts from a new country, suggesting an attacker probing with stolen credentials (Medium Severity). The detection aims to identify identity theft leading to unauthorized device enrollment.
This rule detects Telnet login attempts using the default credential 'admin'. It specifically looks for the string 'admin' (case-insensitive) in Telnet traffic flowing to the server. A threshold of 5 attempts within 60 seconds from the same source IP triggers the alert, indicating a potential brute-force or credential stuffing attack against Telnet services.
This rule detects a potential RDP brute force attack by monitoring for a high number of TCP SYN packets directed to port 3389 (RDP) on the home network from a single source IP address within a short timeframe. Specifically, it triggers an alert if 10 or more SYN packets are observed from the same source within 60 seconds, indicating an attempt to establish multiple RDP connections, which is characteristic of a brute force attempt.
This rule detects an anomaly in Kerberos Ticket Granting Ticket (TGT) requests. Specifically, it triggers an alert if more than 50 UDP Kerberos TGT requests are observed from a single source IP address within a 10-second window to the home network on port 88. This behavior could indicate an attempt to enumerate valid user accounts or perform credential stuffing/brute-force attacks against the Kerberos authentication system, potentially as part of a privilege escalation attempt (ATT&CK T1134).
This rule detects a password spraying attack targeting LDAP services. It triggers an alert if there are 50 or more TCP connections to port 389 (LDAP) on the home network within a 60-second window, originating from the same destination IP address. This pattern is indicative of an attacker attempting to authenticate with a small set of passwords against many accounts.
This rule detects potential GitHub token theft or abuse activity by identifying GitHub tokens that are used from an unusually high number of distinct IP addresses or for an unusually high number of uses within a one-hour window. Specifically, it looks for tokens with more than 5 uses and more than 2 distinct IP addresses in an hour. This behavior could indicate that a compromised token is being used by an attacker from multiple locations or in an automated fashion.
Identifies suspicious token authorizations for the Google Chrome OAuth client. Tycoon 2FA operators frequently use this specific client and scope to proxy authentications and capture session cookies. In a complete attack sequence, this event occurs within a 1-second window alongside a login_success and a device registration event.
Detects suspicious activity involving multiple password resets for different users initiated by a single user within a one-hour timeframe in Azure AD. This could indicate an attacker attempting to gain control over multiple accounts.
This rule detects suspicious device enrollment attempts via Microsoft Intune Company Portal from a country not previously observed in a user's 7-day sign-in history. It identifies two primary patterns: sustained successful sign-ins from a new country, indicating a potential active session and successful device enrollment (High Severity), or Conditional Access Policy (CAP) blocked attempts from a new country, suggesting an attacker probing with stolen credentials (Medium Severity). The detection aims to identify identity theft leading to unauthorized device enrollment.
Detects sign-in or Microsoft Graph API activity using user-agent strings characteristic of ROADtools and similar Python-based identity-attack tooling. The rule generalizes beyond ROADtools to catch AzureHound, MicroBurst, MFASweep, GraphRunner, and similar identity attack frameworks by looking for scripting user-agents (python, requests, urllib, curl) which signal non-browser, non-app authentication that is inherently suspicious for Entra ID admin operations.
KQL Query
This rule detects suspicious sign-in activity for a specific user principal name (UPN) within the last 7 days, immediately preceding a device wipe event. It focuses on identifying the actor's initial access or activity before initiating a mass device wipe.
KQL Query
You can replace the country in line 2 using the country codes available at https://learn.microsoft.com/en-us/linkedin/shared/references/reference-tables/country-codes
This rule detects authentication attempts to Microsoft 365 Azure AD from a list of known malicious IP addresses and CIDR ranges associated with the EvilToken phishing campaign. It specifically filters for 'Cmsi:Cmsi' request types, which are indicative of session replay signals used in device code phishing.
Detects possible MFA-approved session replay by identifying abnormal reuse of authenticated sessions across multiple IPs, browsers, and devices compared against a 14-day historical baseline. The rule prioritizes browser/device anomalies over geography since modern attackers often use same-country VPS/proxies.
Detects anomalous Microsoft Entra ID sign-in events where the application accessed is the Microsoft Authentication Broker (AppId 29d9ed98-a469-4536-ade2-f981bc1d605e) and the User-Agent indicates a Node.js automated backend ('node' or 'undici'). This combination strongly suggests Tycoon2FA operator polling for device-code token acquisition.
Detects Microsoft 365 access attempts where the ClientAppId masquerades as Microsoft Office (d3590ed6-52b3-4102-aeff-aad2292ab01c) to bypass conditional access policies, but the UserAgent string reveals the use of a programmatic script (e.g., Python, PowerShell). This mismatch is a known tactic utilized by UNC6671 (BlackFile) during automated data exfiltration operations.
Page 31 of 51