Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,064 detections
Filters
Last updated
All Time
Detection languages
597
173
103
71
51
Contributors
184
155
139
90
73
Categories
20,443
11,831
5,875
5,151
4,864
1,064
Platforms
575
266
228
223
118
Products / Services
498
220
130
118
86
MITRE Techniques
488
451
363
349
341
CVEs
10
5
4
3
2
IDS Classtypes
34
3
2
2
1
IDS Protocols
29
9
1
Detects abnormal MFA session behavior by monitoring user sessions with multiple IPs or browsers over 24h. Note: KQL 14-day historical baseline and set_difference logic is approximated.
Detects possible Adversary-in-the-Middle (AiTM) attacks, session cookie replay, MFA session hijacking, token theft, and stolen cloud session reuse by identifying abnormal SessionId reuse across multiple IPs, browsers, and devices. This detection compares current session activity against a 14-day historical user behavior baseline to identify new or abnormal behavior. It includes risk scoring and account classification, while reducing false positives from token refresh activity and common Microsoft Teams noise.
Entra ID TAP Sign In
Cortex XDR
Looks for a Temporary Access Pass in Entra ID
Detects the generation of pre-authentication session cookies via intentionally failed login attempts to the `login_only` endpoint. This detects the initial staging phase of the CVE-2026-41940 exploit chain.
Okta Sensitive OAuth Activity Detection
Cortex XDR
This rule detects sensitive OAuth activities within Okta, specifically focusing on OAuth client secret access, token revocation requests, and implicit flow requests. These activities can indicate potential compromise of OAuth clients, attempts to invalidate legitimate tokens, or the use of less secure OAuth flows that could be exploited.
Detects modifications to the msDS-KeyCredentialLink attribute on Delegated Managed Service Account (dMSA) objects, indicating a potential Shadow Credential (X.509 certificate) planting. This allows an attacker to bypass managed password rotation and maintain permanent PKINIT access, as seen in the dMSA Ouroboros attack chain. The rule also monitors Event 4768 (PKINIT TGT requests with pre-authentication type 17) and Event 4662 (S4U2Self Object Access) for dMSA objects, which are key indicators of this attack.
MC1293480: https://admin.cloud.microsoft/?ref=MessageCenter/:/messages/MC1293480
Identifies potential use of ROADtools for Azure AD reconnaissance by monitoring for Azure CLI/PowerShell App IDs coupled with a Python user agent in sign-in logs. This rule specifically looks for sign-ins to 'Windows Azure Active Directory' resource where the user agent string contains 'python' or the device detail string contains 'Python', and the App ID or App Display Name matches known Azure AD PowerShell or Azure CLI applications.
This rule identifies "impossible travel" scenarios where a user logs in from two geographically distant locations within a short period (less than 2 hours). This can indicate a compromised account being used by an attacker, potentially leveraging VPNs or other proxy services to obscure their true location.
This rule detects an IP address attempting to log in unsuccessfully to more than 20 distinct user accounts. This behavior is indicative of a brute-force attack or password spraying attempt against multiple accounts from a single source.
This rule detects an IP address attempting to log in unsuccessfully to more than 20 distinct user accounts. This behavior is indicative of a brute-force attack or password spraying attempt against multiple accounts from a single source.
This rule detects login events with a high-risk score (0.8 or greater) as determined by the 'castle' log source. It normalizes event and risk fields to ensure consistent detection.
Detects when the same SessionId is used to sign in from more than one location across interactive and non-interactive sign-ins.
This rule detects suspicious sign-in activity for a specific user principal name (UPN) within the last 7 days, immediately preceding a device wipe event. It focuses on identifying the actor's initial access or activity before initiating a mass device wipe.
Detects sign-in with properties that are unfamiliar to the user. The detection considers past sign-in history to look for anomalous sign-ins.
Detects a login attempt in Google Workspace flagged as a potential attack by a government-backed threat actor
Detects when Okta identifies new activity in the Admin Console.
Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly.
The application then uses those credentials to authenticate the user against the identity provider.
The application then uses those credentials to authenticate the user against the identity provider.
Detects when a Microsoft Cloud App Security reported a risky sign-in attempt due to a login associated with an impossible travel.
This rule detects and monitors sign-in attempts to third-party Artificial Intelligence (AI) applications within an organization's environment. It identifies sign-ins to known AI vendors and tools by matching keywords in application display names and resource display names from Entra ID (formerly Azure AD) sign-in logs. The rule specifically excludes Microsoft's own Copilot products to focus on 'shadow AI' usage. It aggregates sign-in attempts, successes, failures, unique users, and common failure reasons to provide insights into the adoption and potential risks associated with unsanctioned AI tool usage.
Identifies that users were active from an IP address that has been identified as an anonymous proxy IP address.
Page 32 of 51