Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,064 detections
Filters
Last updated
All Time
Detection languages
597
173
103
71
51
Contributors
184
155
139
90
73
Categories
20,443
11,831
5,875
5,151
4,864
1,064
Platforms
575
266
228
223
118
Products / Services
498
220
130
118
86
MITRE Techniques
488
451
363
349
341
CVEs
10
5
4
3
2
IDS Classtypes
34
3
2
2
1
IDS Protocols
29
9
1
Detects high-frequency login attempts directed at the management CGI interface of Dahua camera devices. The rule identifies multiple attempts from a specific source IP towards the camera's authentication endpoints (login, RPC2_Login) over common management ports (80, 37777).
This rule detects suspicious activity related to specific hardcoded indicators 'p2pwn', 'p2password', and references to 'cve-2024-39943'. It scans authentication logs (Identity) and EDR logs (process command lines) for these terms, flagging potential unauthorized access, credential use, or exploitation attempts associated with this specific threat activity.
This rule detects potential Adversary-in-the-Middle (AiTM) activity by identifying a sequence where a user experiences a sign-in interruption (ResultType 50199) followed by a successful sign-in with the same SessionId but from a different, anomalous User-Agent (typically associated with automated tools like Axios). This pattern indicates the reuse of intercepted session tokens to bypass multi-factor authentication.
This rule detects potential security configuration tampering by correlating the modification of a Conditional Access policy (e.g., changing users or conditions) with the registration of a new external authentication method configuration by the same user within a 3-hour window. This behavior may indicate an attacker attempting to establish persistence or facilitate bypass of authentication requirements by modifying CA policies and adding a rogue authentication method.
This rule hunts for indicators associated with the TrustSink technique, which involves using rogue External Authentication Methods (EAM) or malicious OIDC providers to bypass authentication or maintain persistence within a cloud environment. It monitors Azure AD sign-in and audit logs, alongside DNS and network events, for references to known malicious domains and URLs used for EAM-based attacks.
Detects a suspicious sequence of events where a user engagement (voice/video call) involving themes of urgency or helpdesk interaction is closely followed by a high-risk administrative action (e.g., password reset, MFA device enrollment, or financial transfer) by the same user, where the communication session context differs from standard activity, indicative of a deepfake-enabled vishing attack.
Detects high-frequency authentication attempts originating from user agents associated with automation frameworks (Selenium, Playwright, Puppeteer, etc.). This pattern is often indicative of automated credential stuffing, brute force attacks, or CAPTCHA/2FA bypass attempts orchestrated by headless browsers.
Detects multiple MFA push notifications generated within a short timeframe for a single user during a Self-Service Password Reset (SSPR) flow. This behavior is indicative of an attacker attempting to perform MFA fatigue/push harassment to gain unauthorized access via SSPR or to bypass account security controls.
Detects instances where the device code authentication protocol is utilized. This protocol is commonly used for headless devices, but is also frequently abused by adversaries for phishing and device code flow abuse to acquire unauthorized access tokens.
This rule detects a suspicious monetization pattern where a user account experiences a high-risk sign-in event, followed shortly (within 2 hours) by the creation or modification of inbox rules. This pattern is often indicative of account compromise, where an adversary configures mailbox rules (e.g., forwarding or redirection) to facilitate data exfiltration or financial fraud.
This rule detects a suspicious monetization pattern where a user account experiences a high-risk sign-in event, followed shortly (within 2 hours) by the creation or modification of inbox rules. This pattern is often indicative of account compromise, where an adversary configures mailbox rules (e.g., forwarding or redirection) to facilitate data exfiltration or financial fraud.
This rule detects a suspicious monetization pattern where a user account experiences a high-risk sign-in event, followed shortly (within 2 hours) by the creation or modification of inbox rules. This pattern is often indicative of account compromise, where an adversary configures mailbox rules (e.g., forwarding or redirection) to facilitate data exfiltration or financial fraud.
Detects a suspicious sequence of events where a user engagement (voice/video call) involving themes of urgency or helpdesk interaction is closely followed by a high-risk administrative action (e.g., password reset, MFA device enrollment, or financial transfer) by the same user, where the communication session context differs from standard activity, indicative of a deepfake-enabled vishing attack.
Detects high-frequency authentication attempts originating from user agents associated with automation frameworks (Selenium, Playwright, Puppeteer, etc.). This pattern is often indicative of automated credential stuffing, brute force attacks, or CAPTCHA/2FA bypass attempts orchestrated by headless browsers.
Detects anomalous, high-volume account enumeration against the Microsoft Self-Service Password Reset (SSPR) endpoint from a single source IP. The rule identifies a pattern of mixed response codes, specifically interleaving '50034' (Account does not exist) with successful or other outcomes, which indicates the use of automated tools to validate the existence of corporate accounts via response differentiation.
Detects login attempts to internet-exposed FortiGate SSL VPN or firewall management interfaces using suspicious, generic, or potentially leaked administrative account patterns such as fgt-*, FortiManager-*, or tech-support-*. These accounts typically suggest attempts to exploit default, hardcoded, or publicly shared credentials on network infrastructure.
Detects high-frequency authentication attempts originating from ScreenConnect processes on a single host within a 15-minute window. This behavior is indicative of session hijacking or authentication bypass attempts targeting ScreenConnect, such as those associated with CVE-2026-84869.
Detects high-frequency login attempts directed at the Dahua Easy4IP SDK port 37777, consistent with automated brute-force toolkits like async_brute.py. The rule monitors for a specific packet sequence indicating authentication attempts within a short timeframe.
Detects high-concurrency brute-force attempts against Dahua Easy4IP-enabled devices targeting port 37777, identified by specific binary patterns (opcode 0xA0) in the packet payload. This indicates an automated attempt to compromise device authentication.
This rule identifies enterprise resource access from OnePlus or OxygenOS devices that lack proper management or compliance. It calculates an exposure score based on factors including device management status, compliance state, device trust type, and whether the device is newly observed. The rule flags high and medium priority exposure incidents, specifically targeting non-managed or non-compliant BYOD devices, which could represent an increased risk profile for corporate data access.
This rule identifies enterprise resource access from OnePlus or OxygenOS devices that lack proper management or compliance. It calculates an exposure score based on factors including device management status, compliance state, device trust type, and whether the device is newly observed. The rule flags high and medium priority exposure incidents, specifically targeting non-managed or non-compliant BYOD devices, which could represent an increased risk profile for corporate data access.
Page 9 of 51