Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,666 detections
Filters
Last updated
All Time
Detection languages
1,077
189
170
102
53
Contributors
520
361
306
67
52
Categories
20,443
11,831
5,875
5,151
4,864
1,666
Platforms
1,091
590
440
252
122
Products / Services
1,130
476
189
125
118
MITRE Techniques
944
842
437
416
412
CVEs
12
12
9
6
5
IDS Classtypes
1
1
Detects a suspicious pattern where a highly privileged on-premises synchronized user account signs into Azure Active Directory (Entra ID) and immediately performs sensitive administrative actions (role assignment or OAuth application consent grant) within a 30-minute window. This behavior is indicative of credential abuse by the Storm-2372 actor to escalate privileges within a tenant.
This rule detects an unusual number of local or remote interactive logons (LogonType 2 or 10) by the 'SYSTEM' account within a one-hour window. While the SYSTEM account is legitimate, direct interactive logons are rare and multiple occurrences could indicate an attempt to escalate privileges or maintain persistence by an attacker.
Detects a successful self-service password reset for a privileged or high-value account when the initiating context does not match an approved helpdesk workflow. This could indicate an attacker attempting to gain access to an account by resetting its password without proper authorization.
This rule detects successful sign-ins using the OAuth 2.0 Device Code Flow. This flow is often abused in phishing attacks (device code phishing) where an attacker tricks a user into authenticating a malicious application. A successful sign-in using this method could indicate a compromised account or a successful phishing attempt.
Detects potential Browser-in-the-Middle (BitM) session hijacking by identifying scenarios where a single user account authenticates successfully from multiple geographically distinct external IP addresses within a short (10-minute) window, suggesting a parallel session is being used by an attacker.
Detects suspected Browser-in-the-Middle (AiTM) activity by identifying successful multi-factor authentication followed by session activity from a different source IP address or with a different user-agent string within a 10-minute window, suggesting token theft or session hijacking.
Detects successful Device Code authentication followed immediately by a new device registration, a tactic used to extend access via PRT generation. This behavior is indicative of an attacker using a stolen device code to register a new device, thereby gaining persistent access to the user's account.
Detects anomalous logins (impossible travel/session anomalies) utilizing the Kali365 Live desktop application User-Agent combined with IP shifting. This rule identifies instances where a user logs in with the 'kali365-live/1.0.0' User-Agent from an IP address different from a previous successful login by the same user within a 4-hour window, where the previous login used a different User-Agent.
This rule detects modifications to SSH authorized_keys files on Linux-based SD-WAN controllers, or successful SSH public key authentication events involving the vmanage-admin user, including attempts to identify authentication from unexpected source IP addresses.
Correlates a successful login from RedVDS infrastructure followed immediately by massive internal directory reconnaissance (e.g., SharpHound execution). This rule detects when an account logs in from a RedVDS IP address and then within an hour executes a process associated with BloodHound or SharpHound for Active Directory reconnaissance.
Detects a session issued through browser MFA and subsequently used through a non-interactive, mobile, or command-line client. This behavior is indicative of an adversary potentially using a stolen session token to bypass multi-factor authentication.
This rule detects successful OAuth logins originating from IP addresses identified as residential proxies. This behavior can indicate an adversary attempting to bypass geo-blocking or other IP-based restrictions, potentially using stolen credentials (Valid Accounts) or after a successful phishing campaign (Spearphishing Link) to gain initial access or maintain persistence.
Detects the creation of a Temporary Access Pass (TAP) by a service principal or agent identity, rather than a human administrator. This scenario indicates a potential compromise where a Temporary Access Agent with UserAuthMethod-TAP.ReadWrite.All permission is abused to generate a TAP for a Global Administrator.
Detects successful sign-ins to specific Azure AD applications known to bypass Conditional Access policies, where Conditional Access was not applied. This could indicate an attempt to circumvent security controls.
Monitors Cisco SD-WAN (vManage, vBond, vSmart) appliance logs for authentication events against management accounts. It specifically identifies logins from known malicious IP addresses associated with threat actor activities and flags anomalous authentication methods such as PAM/keyboard-interactive and unvalidated administrative access.
This rule monitors Cisco SD-WAN logs (vManage, auth, and syslog) for suspicious administrative activity including credential manipulation, unauthorized password changes, successful vManage-admin SSH logins, and potential configuration exfiltration via vManage API calls.
Detects the modification of sensitive banking or payment election records (e.g., direct deposit details) in Workday or similar HR SaaS platforms shortly after a user login event from the same source IP. This behavior is consistent with 'Payroll Pirate' style attacks where adversaries use stolen session tokens (via AiTM phishing) to redirect employee salary payments.
Detects anomalous SSH lateral movement originating from the Cisco SD-WAN Manager (vManage) to other control plane components (vSmart/vBond). This rule correlates network connections on port 22 with successful SSH logins using privileged or service-related accounts, which is indicative of potential post-exploitation activity or pivoting within an SD-WAN control plane environment.
Identifies successful device code authentications originating from non-trusted named locations. This can indicate an attempt to bypass multi-factor authentication or compromise an account through device code phishing.
Detects successful authentications where a Temporary Access Pass (TAP) was used as the primary authentication method. TAPs bypass standard password and MFA requirements, and their usage outside of expected scenarios (like onboarding or account recovery) could indicate an adversary bypassing authentication mechanisms.
Detects anomalous authentication patterns where a single source IP address exhibits multiple failed login attempts followed by at least one successful login within a 10-minute time window, indicative of credential stuffing or password spraying.
Page 61 of 80