Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,064 detections
Filters
Last updated
All Time
Detection languages
597
173
103
71
51
Contributors
184
155
139
90
73
Categories
20,439
11,829
5,873
5,151
4,864
1,064
Platforms
575
266
228
223
118
Products / Services
498
220
130
118
86
MITRE Techniques
488
451
363
349
341
CVEs
10
5
4
3
2
IDS Classtypes
34
3
2
2
1
IDS Protocols
29
9
1
This rule detects user activity that Azure AD Identity Protection has flagged as 'investigationsThreatIntelligence'. This risk event type indicates that a sign-in or user behavior is unusual for the user or consistent with known attack patterns, often leveraging threat intelligence feeds to identify suspicious activity. It suggests potential compromise of user accounts or malicious sign-in attempts.
This rule detects sign-in attempts originating from a country that is considered new or infrequent for the user based on their past activity locations. This behavior can indicate a compromised account being used by an attacker from an unusual geographic location.
This rule detects anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser. This indicates a potential compromise of user credentials or an attempt to bypass authentication mechanisms.
This rule detects successful logon events (EventID 4624) where the LogonType is 9, which signifies a new credentials logon. This logon type is typically associated with the 'RunAs' command or similar functionality, where a user explicitly provides alternate credentials to execute a program or access a resource. Adversaries may use this technique to execute code with different user privileges or to move laterally within an environment using stolen or compromised credentials.
Detects the use of a specific default username, 'thisisnotvaliduser', during an interactive logon (LogonType 9) event (EventID 4624) on a Windows system. This specific username is associated with the DiagTrackEoP Proof-of-Concept (POC) for privilege escalation.
This rule identifies user activity originating from an IP address that has been flagged as an anonymous proxy. Such activity can indicate an attempt to obscure the true origin of a sign-in, which is often associated with malicious intent like credential stuffing, account takeover, or bypassing geographical restrictions.
Indicates that a password spray attack has been successfully performed.
Indicates the SAML token issuer for the associated SAML token is potentially compromised. The claims included in the token are unusual or match known attacker patterns
NTLM Brute Force
Sigma
Detects common NTLM brute force device names
Indicates access attempt to the PRT resource which can be used to move laterally into an organization or perform credential theft
Anomalous Token
Sigma
Indicates that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is played from an unfamiliar location.
Anonymous IP Address
Sigma
Indicates sign-ins from an anonymous IP address, for example, using an anonymous browser or VPN.
Indicates sign-in from a malicious IP address known to be malicious at time of sign-in.
Indicates sign-ins from IP addresses infected with malware that is known to actively communicate with a bot server.
Page 51 of 51