Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,064 detections
Filters
Last updated
All Time
Detection languages
597
173
103
71
51
Contributors
184
155
139
90
73
Categories
20,439
11,829
5,873
5,151
4,864
1,064
Platforms
575
266
228
223
118
Products / Services
498
220
130
118
86
MITRE Techniques
488
451
363
349
341
CVEs
10
5
4
3
2
IDS Classtypes
34
3
2
2
1
IDS Protocols
29
9
1
Detects the TeamFiltration/UNK_CondorFiltration spray signature: a large
number of distinct target UserPrincipalNames within a single tenant, each
receiving only a handful of sign-in attempts, spread across many distinct
AWS EC2-hosted source IPs/regions within a short time window. Individual
sign-ins from AWS-hosted IP ranges (VPN gateways, corporate cloud proxies,
remote contractors) are not flagged on their own; the rule requires both
the account-fanout and the IP-rotation dimensions to co-occur for the same
tenant in the same window.
number of distinct target UserPrincipalNames within a single tenant, each
receiving only a handful of sign-in attempts, spread across many distinct
AWS EC2-hosted source IPs/regions within a short time window. Individual
sign-ins from AWS-hosted IP ranges (VPN gateways, corporate cloud proxies,
remote contractors) are not flagged on their own; the rule requires both
the account-fanout and the IP-rotation dimensions to co-occur for the same
tenant in the same window.
Detects a distributed password spraying campaign targeting cloud accounts, characterized by a large number of distinct accounts being targeted simultaneously from multiple AWS-hosted IP addresses, with a low volume of attempts per account per hour to evade standard threshold-based detection.
Detects a multi-stage attack chain originating with a healthcare-themed phishing email (e.g., billing or patient coordination lures) that leads to a link click, followed by a subsequent suspicious user sign-in from a non-managed/non-compliant device for the same recipient. This correlates email threat data, URL click telemetry, and sign-in logs to identify potential credential harvesting.
Detects a multi-stage attack chain originating with a healthcare-themed phishing email (e.g., billing or patient coordination lures) that leads to a link click, followed by a subsequent suspicious user sign-in from a non-managed/non-compliant device for the same recipient. This correlates email threat data, URL click telemetry, and sign-in logs to identify potential credential harvesting.
Detects instances where an AI agent tool invocation contains potential credential data (API keys, tokens) followed by a suspicious sign-in or Key Vault access event from an atypical location for that specific identity within a short timeframe. This rule monitors for potential exfiltration or abuse of credentials handled or exposed by AI agents.
This rule detects a multi-stage attack correlation where a user receives multiple inbound emails flagged for high likelihood of being LLM-generated (and containing urgency/credential-harvesting language) and subsequently performs a voice or video authentication attempt that is flagged by deepfake detection systems with a low confidence score, indicating a potential impersonation attempt.
This rule detects a correlation between an Active Directory Certificate Services (AD CS) certificate request (Event ID 4887) containing certificate attributes (SAN, altname, or UPN) and a subsequent Kerberos TGT request (Event ID 4768) within an hour, where the requested account name does not match the ticket user. This behavior is indicative of potential certificate-based authentication abuse, such as 'ESC1' or 'Golden Certificate' attacks where a certificate is requested and immediately used for credential impersonation.
Detects potential OAuth device code phishing attempts by identifying sign-ins via the device code flow using applications not previously used by the specific user, especially when occurring in a burst pattern across multiple users.
This rule detects potential social engineering attacks where an external or federated user impersonates an IT or helpdesk entity within Microsoft Teams (via chats, messages, or calls) followed shortly by an MFA registration or password reset event for the targeted user. This sequence is indicative of a vishing or phishing attack aimed at account takeover.
This rule detects a multi-stage phishing attack sequence: it correlates the receipt of an invoice-themed email containing an anonymous SharePoint link with the subsequent local creation of a Windows Internet Shortcut (.url) file, followed by a Microsoft OAuth device-code authentication sign-in attempt by the user within a short timeframe. This behavior is indicative of an adversary tricking a user into downloading a malicious shortcut that facilitates OAuth device code phishing.
Detects high-volume credential brute-forcing activity targeting Dahua IP camera administrative interfaces (Ports 80/37777). The rule identifies a pattern of multiple connection failures across multiple distinct targets followed by a successful connection, which is highly characteristic of automated credential stuffing or password spraying attacks against embedded IoT devices.
Detects a correlation between a DNS query for a potential typosquatting or brand-lookalike domain (newly observed within the last 30 days) and a subsequent sign-in authentication event originating from the same client IP within a 30-minute window. This behavior is indicative of an attacker, such as ShinyHunters vishing operators, directing victims to a lookalike SSO phishing portal to harvest credentials and MFA tokens before attempting access to the legitimate environment.
The EntraIdSignInEvents table exposes the JA4 fingerprint in the GatewayJA4 field. But looking at the complete fingerprint alone does not tell us much. The interesting part starts when we break it down. With a simple KQL query, we can separate the TLS version, SNI, number of cipher suites, extensions and ALPN, together with the cipher and extension hashes. Then we can see how many sign-ins, users, IPs and countries are behind each JA4. The idea is simple: understand what is normal first, then look for what is different.
Detects the abuse of the DFS Namespace Management (DFSNM) interface by monitoring calls to NetrDfsAddStdRoot (opnum 12) and NetrDfsRemoveStdRoot (opnum 13). An adversary can trigger these functions to coerce a Windows host to authenticate to an attacker-controlled remote host using NTLM, facilitating NTLM relay attacks.
Detects MFA request abuse (T1621) by identifying a user receiving 5 or more MFA push, SMS, or call denials/timeouts within a 10-minute window across Entra ID, Okta, or Duo authentication logs. This behavior is indicative of an MFA fatigue attack, where an adversary continuously triggers MFA prompts until the user eventually approves the request out of frustration or confusion.
Detects high-volume account existence checks targeting the Microsoft Teams API. The rule identifies anomalous authentication attempts characterized by the use of outdated Electron/Chrome user-agent strings associated with the TeamFiltration tool, specifically targeting the Microsoft Teams API AppId (1fec8e78-bce4-4aaf-ab1b-5451cc387264).
Detects user authentication events to recruitment, career, or applicant-tracking applications where the connection originates from an anonymizing proxy, VPN, or datacenter IP address. This behavior has been observed as a precursor to North Korean IT worker recruitment fraud, where attackers mask their true geographic location to gain unauthorized employment.
Detects a sequence of suspicious identity activities indicative of a post-account-takeover pivot. The rule identifies a user profile engaging in corporate VPN SAML SSO probing, triggering a MFA enrollment interrupt in Azure, and subsequently accessing multiple Microsoft 365 applications (Azure Portal, OfficeHome, SharePoint) within a 30-minute window.
Detects anomalous OAuth 2.0 device authorization grant requests where the Microsoft Authentication Broker application ID is utilized by non-standard clients, specifically the python-requests library. This pattern is indicative of the GhostCode phishing backend infrastructure, which attempts to programmatically perform device code phishing rather than relying on interactive browser-based flows.
Detects credential-spraying activity against WordPress sites where an actor performs a sequence of POST requests targeting both xmlrpc.php (typically the 'wp.getUsersBlogs' method) and wp-login.php. The rule specifically identifies attackers that attempt to evade detection or increase success rates by falling back to wp-login.php after initially using XML-RPC within a short duration.
Detects non-interactive sign-in events to M365 that claim to be from the Outlook client application but utilize suspicious or unexpected User-Agent strings (e.g., Python requests, specific Firefox versions). This behavior is often indicative of programmatic access or automated tools used by attackers to harvest credentials or interact with mailboxes, bypassing standard browser-based authentication controls.
Page 6 of 51