Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,064 detections
Filters
Last updated
All Time
Detection languages
597
173
103
71
51
Contributors
184
155
139
90
73
Categories
20,443
11,831
5,875
5,151
4,864
1,064
Platforms
575
266
228
223
118
Products / Services
498
220
130
118
86
MITRE Techniques
488
451
363
349
341
CVEs
10
5
4
3
2
IDS Classtypes
34
3
2
2
1
IDS Protocols
29
9
1
This rule detects suspicious sign-in activities that occur shortly after a network connection to an IP address associated with 'Lab539 Clickfix'. It correlates risky sign-in events from Azure Active Directory (AAD) with network connection logs from devices. Specifically, it looks for AAD sign-ins with a risk level of 30 or higher, from non-guest, non-compliant, and non-managed devices, where the IP address has not been seen for that user in the last 30 days. This is then joined with network connection events to IP addresses found in the 'Lab539 Clickfix' external data, ensuring the sign-in occurs after the network connection within a short timeframe. The 'Lab539 Clickfix' reference suggests a connection to a known threat or campaign, possibly related to phishing or credential compromise.
This rule detects anomalous user activity patterns, specifically focusing on suspicious changes to directories or other behaviors that Microsoft Entra ID Protection identifies as 'anomalousUserActivity'. This could indicate compromised accounts or insider threats.
Detects instances where an SSH service on an OpenCanary honeypot node has had a login attempt. This indicates an adversary attempting to gain unauthorized access to a system, likely through brute-force or credential stuffing attacks against the honeypot.
This rule identifies the suspicious use of the AWS Security Token Service (STS) API call `GetSessionToken`. This API call is used to request temporary, limited-privilege credentials for an IAM user or role. Attackers may use `GetSessionToken` to generate temporary tokens to move laterally within an AWS environment or escalate privileges by assuming roles with broader permissions. The rule specifically looks for `GetSessionToken` calls made by an `IAMUser`.
Detects the addition of a new root certificate authority to an Azure AD tenant. This action can be performed by an attacker to establish persistence and enable certificate-based authentication for unauthorized access, potentially bypassing traditional password-based authentication mechanisms. This is a critical security event as it can lead to privilege escalation and persistent access within the Azure AD environment.
Detects when users successfully authenticate to Azure AD using only single-factor authentication, indicating that MFA was not required or was bypassed. This could be due to misconfiguration, an attacker bypassing MFA, or legitimate exceptions.
Detects when successful authentications to important applications occur using only single-factor authentication. This could indicate a weakened security posture for critical resources or a bypass of expected multi-factor authentication policies.
This rule detects the use of the hacktool Ruler by Sensepost, specifically looking for 'RULER' in the Workstation or WorkstationName fields of Windows Security Event IDs 4776 (Credential Validation) and 4624/4625 (Logon/Logoff). Ruler is a tool designed to abuse Microsoft Exchange services.
This rule detects failed attempts to elevate privileges (PIM activation) in Azure Active Directory from devices that are not designated as Privileged Access Workstations (PAW) or Secure Access Workstations (SAW). It specifically looks for messages indicating 'Add member to role completed (PIM activation)' in the sign-in logs, combined with conditions that identify non-compliant devices, unapproved IP addresses, unapproved countries, or unapproved device information. The rule is designed to flag suspicious privilege elevation attempts that originate from unauthorized or untrusted environments, which could indicate a compromised account or an attempt to bypass security controls.
This rule detects sign-in attempts to Azure Active Directory from devices that are marked as non-compliant. Non-compliant devices typically lack required security configurations, updates, or policies, and their use for authentication can indicate a potential security risk, such as a compromised device or an attempt to bypass security controls.
This rule detects the addition of a Security Identifier (SID) to an Active Directory object's SID History attribute. Attackers can manipulate the SID History to gain unauthorized privileges, often by adding SIDs of highly privileged accounts (like Domain Admins) to a compromised user or computer object. This allows the compromised account to impersonate the privileged account and bypass access controls. The rule specifically looks for Event IDs 4765 (SID History added to an account) or 4766 (SID History added to a group) or Event ID 4738 (User Account Changed) where the 'SidHistory' field is not null or '%%1793' (which indicates no SID History).
Identifies when an account in a privileged role has not signed in for a specified number of days, indicating a potentially stale or unused privileged account. Such accounts can be a security risk if compromised, as they might not be actively monitored.
This rule detects sign-in attempts to Azure AD where the authentication requirement was single-factor, the sign-in was successful (ResultType: 0), the network location details were empty (indicating an unknown or unclassified location), and the device ID was also empty (indicating an unknown or unregistered device). This combination suggests a sign-in from an unknown device and potentially an untrusted location, which could be indicative of an adversary attempting to gain initial access or maintain persistence.
Detects when the 'SeEnableDelegationPrivilege' user right is assigned in Active Directory. This privilege allows a user to control other Active Directory user objects, which can be abused for privilege escalation and persistence within a domain.
Identifies when the same privilege role has multiple activations by the same user, which could indicate an attempt to bypass time-based access restrictions or an adversary repeatedly activating a role for malicious purposes. This alert is triggered by the 'sequentialActivationRenewalsAlertIncident' risk event type in Azure PIM.
Detects when a user successfully logs on to sanctioned applications from an IP address identified as risky by Microsoft Cloud App Security. This indicates a potential compromise of the user's account or an attempt to access resources from an unusual and potentially malicious location.
Detects logons using NTLM authentication, which can indicate the presence of legacy systems or be leveraged by attackers for lateral movement or credential access. Event ID 8002 specifically indicates an NTLM authentication event.
This rule detects login attempts against the Telnet service running on an OpenCanary honeypot. OpenCanary is designed to attract and detect unauthorized access attempts, so any login attempt to its Telnet service indicates potential malicious activity or reconnaissance against the honeypot.
This rule detects modifications to the "DsrmAdminLogonBehavior" registry value. Attackers may modify this value to abuse the Directory Services Restore Mode (DSRM) administrator account for persistence and access to Active Directory. The DSRM account is a local administrator account on a Domain Controller, typically used for restoring AD backups or recovering from failures. By changing "DsrmAdminLogonBehavior" from its default value of '0' (only usable in DSRM) to '1' (usable when AD DS service is stopped) or '2' (always usable), attackers can gain persistent access to the Domain Controller outside of DSRM, facilitating credential access and defense evasion.
This detection identifies attempts to authenticate with an empty public key fingerprint in Progress MOVEit Transfer, which is a key indicator of potential exploitation of the CVE-2024-5806 vulnerability. Such attempts are characteristic of the authentication bypass technique used in this vulnerability, where attackers try to impersonate valid users without providing proper credentials. While occasional empty key fingerprint authentication attempts might occur due to misconfigurations, a sudden increase or attempts from unexpected sources could signify malicious activity. This analytic helps security teams identify and investigate potential exploitation attempts of the MOVEit Transfer authentication bypass vulnerability.
Researching about how to classify ISP based on different factors, I created a query based on ISP sign-in attempts.
Page 37 of 51