Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,832 detections
Filters
Last updated
All Time
Detection languages
1,375
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,456
11,839
5,876
5,155
4,865
2,832
Platforms
1,449
916
693
670
264
Products / Services
994
701
613
469
216
MITRE Techniques
1,240
912
484
482
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
This rule detects suspicious Azure AD sign-in activity originating from a single user account that utilizes the 'deviceCode' authentication protocol while simultaneously exhibiting activity from multiple distinct and highly specific User Agent strings (Python requests library and Microsoft Outlook 16.0.17425). This pattern is indicative of potential token theft or automated credential harvesting where a legitimate OAuth flow is subverted to gain persistent access.
Detects rapid, sequential identity-validation API calls (such as GetCallerIdentity, GetSessionToken, or AssumeRole) performed across a large number of distinct AWS access keys from a single source within a short time window. This pattern is indicative of automated tooling validating a harvested corpus of AWS access keys to identify active credentials.
Detects rapid, sequential identity-validation API calls (such as GetCallerIdentity, GetSessionToken, or AssumeRole) performed across a large number of distinct AWS access keys from a single source within a short time window. This pattern is indicative of automated tooling validating a harvested corpus of AWS access keys to identify active credentials.
Detects instances where a single proxy service API key or account is used from an abnormally high number of distinct IP addresses within a short timeframe. This behavior is indicative of credential theft and unauthorized sharing or exploitation of proxy credentials by third-party actors.
Detects instances where a single proxy service API key or account is used from an abnormally high number of distinct IP addresses within a short timeframe. This behavior is indicative of credential theft and unauthorized sharing or exploitation of proxy credentials by third-party actors.
Detects instances where a single proxy service API key or account is used from an abnormally high number of distinct IP addresses within a short timeframe. This behavior is indicative of credential theft and unauthorized sharing or exploitation of proxy credentials by third-party actors.
Detects instances where a single proxy service API key or account is used from an abnormally high number of distinct IP addresses within a short timeframe. This behavior is indicative of credential theft and unauthorized sharing or exploitation of proxy credentials by third-party actors.
This rule monitors for various types of events (user logons, network connections, API audits, cloud app events, and email traffic) originating from a specific CIDR block (160.79.104.0/21), which is flagged as suspicious or unauthorized.
This rule detects various event types (email, identity authentication, network connections, and cloud audit logs) originating from or interacting with the specific IP address range 160.79.104.0/22 to 160.79.111.0/22, which is associated with known malicious activity.
Detects Google Workspace login activity that's classified as suspicious by Google.
This rule detects the creation or modification of inbox rules in Microsoft 365 that exhibit suspicious behaviors, such as hiding messages, deleting them, moving them, or automatically forwarding/redirecting them to external addresses. It also flags rules that contain finance-related keywords, often used in Business Email Compromise (BEC) campaigns.
This rule detects potentially unauthorized access to Microsoft Graph API resources (Mail or Files) following a device-code authentication event for the same user. It identifies scenarios where a previously unknown application client performs read operations within 24 hours of a device-code login, which is characteristic of 'ARToken' or 'EvilProxy' type device-code phishing and session proxy attacks.
Detects suspicious Entra ID device registration and Primary Refresh Token (PRT) issuance occurring shortly after an OAuth Device Code sign-in. This pattern is indicative of ARToken-style post-compromise persistence, where an attacker leverages a stolen device code to register a rogue device and establish a persistent session.
Detects automated mailbox access operations such as 'MailItemsAccessed' or 'Search-Mailbox' that are filtered by specific, high-risk financial or Business Email Compromise (BEC) keywords in the email subject line. This behavior is indicative of an automated 'inbox-monitor' style attack, where a compromised OAuth token is used to systematically scrape mailboxes for sensitive financial data.
Detects unauthorized attempts to manipulate cgroup files (e.g., cgroup.procs) within Kubernetes pods using kubectl exec/attach sessions. This technique is often associated with SPIRE attestation spoofing or container escape attempts where an attacker attempts to influence process management or isolation constraints from within the container via the Kubernetes API.
This rule monitors Office 365 activity for anomalous search behavior, specifically targeting high volumes of distinct search queries involving site collections, web structures, or index ID patterns. Such patterns are indicative of automated data discovery or enumeration activities performed against SharePoint or OneDrive environments.
This rule detects modifications to Group Policy Objects (GPO) or Microsoft Entra (formerly Azure AD) policies that weaken established security controls. For GPO, it monitors Event ID 5136 for changes to security-relevant attributes (e.g., disabling firewall or real-time monitoring) in Active Directory. For Entra, it monitors audit logs for administrative operations that reduce security posture, such as disabling MFA, lowering authentication trust, or deleting Conditional Access policies. It includes filters to exclude legitimate, documented change management activities.
Detects the creation of new AWS access keys or login profiles for a target identity immediately following the deletion or modification of a credential for the same identity, where the actors performing the two actions are different. This pattern indicates an adversary creating persistent access after a security incident responder or automated system has revoked a previously compromised credential.
Detects a suspicious sequence of events within JFrog Artifactory where an account accesses sensitive code-signing material (rubygems/gemspec/signing keys) and subsequently performs administrative actions (user addition/role assignment/privilege escalation) within a one-hour window, indicating potential account takeover or exploitation.
Detects a suspicious sequence of events within JFrog Artifactory where an account accesses sensitive code-signing material (rubygems/gemspec/signing keys) and subsequently performs administrative actions (user addition/role assignment/privilege escalation) within a one-hour window, indicating potential account takeover or exploitation.
This rule detects potentially malicious interaction with specific GCP service account identifiers and client IDs. It monitors multiple log sources—including cloud audit logs, sign-in activity, security logs, and device network events—to identify unauthorized access, command and control communication, or data exfiltration attempts targeting Google API services (specifically oauth2.googleapis.com and sheets.googleapis.com).
Page 54 of 135