Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,832 detections
Filters
Last updated
All Time
Detection languages
1,375
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,456
11,839
5,876
5,155
4,865
2,832
Platforms
1,449
916
693
670
264
Products / Services
994
701
613
469
216
MITRE Techniques
1,240
912
484
482
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects instances where Microsoft Copilot memory content (identified by hash) remains identical before and after a significant account security event, such as a password reset or session revocation. This behavior suggests that an adversary may have injected malicious or persistent data into the user's Copilot memory, which survives standard account remediation actions.
This rule detects a significant spike in usage for Azure Cognitive Services, specifically for operations like Chat Completions or Image Generation. By comparing the request count per caller to their historical average (hourly), the rule identifies potential abuse, service disruption, or unauthorized resource usage.
This rule detects anomalous behavior indicative of post-compromise reconnaissance within Jira or Atlassian environments. It monitors CloudAppEvents for high volumes of distinct view actions (e.g., issues, projects, boards, reports) performed by a single account within a one-hour window, which may signify an attacker using a compromised API token or account to harvest sensitive information from engineering and security work items.
Detects anomalous human-like interactive browsing behavior from the 'qa@snowflake.net' Jira service account. This account is typically restricted to automated ticket creation via GitHub Actions; broad exploration of Jira boards, timelines, and reports indicates a potential account compromise where an API token has been exfiltrated and repurposed for reconnaissance.
Identifies Microsoft Entra Privileged Identity Management (PIM) role activations occurring outside normal business hours or during weekends.
The query reviews role management audit events, converts timestamps to a defined local timezone, and highlights successful privileged role activations that occur outside business hours and on weekends.
This detection helps security teams identify unusual, privileged access activity that may warrant additional investigation, especially for highly privileged roles.
The query reviews role management audit events, converts timestamps to a defined local timezone, and highlights successful privileged role activations that occur outside business hours and on weekends.
This detection helps security teams identify unusual, privileged access activity that may warrant additional investigation, especially for highly privileged roles.
This detection identifies potential cross-region inference abuse in AWS Bedrock Claude models. Cross-region inference abuse may indicate attempts to bypass regional restrictions, exfiltrate data, or perform unauthorized actions across different AWS regions.
Detects anomalous human-like interactive browsing behavior from the 'qa@snowflake.net' Jira service account. This account is typically restricted to automated ticket creation via GitHub Actions; broad exploration of Jira boards, timelines, and reports indicates a potential account compromise where an API token has been exfiltrated and repurposed for reconnaissance.
This detection identifies prompts with hostile or aggressive sentiment being sent to AWS Bedrock Claude models. Hostile prompts may indicate potential abuse, harassment, or other malicious intent.
Detects when a user authorizes an OAuth application that requests high or critical permissions in a SaaS environment via Netskope logs. This pattern is commonly used in OAuth-based phishing campaigns or illicit application consent grants where adversaries attempt to gain persistent access to cloud resources.
Detects Microsoft Entra audit events where a user is added to either the Global Administrator or Cloud Device Administrator built-in roles, which are high-privilege administrative roles.
Detects when a new credential is added to an existing application. Any additional credentials added outside of expected processes could be a malicious actor using those credentials.
This detection identifies unusually large prompts sent to AWS Bedrock Claude models by calculating the statistical baseline of input token counts and flagging requests that exceed one standard deviations above the mean. Abnormally large prompts may indicate prompt injection attacks, data exfiltration attempts, or abuse of the AI service.
Detects a successful Microsoft Entra audit event where a new partner tenant is added to cross-tenant access settings. This change impacts trust-related configuration and inter-tenant access policies, requiring validation against approved organizational changes.
This rule detects the addition of TXT or CNAME records within Azure-managed DNS zones that correspond to third-party email sending platforms, specifically Amazon SES or Resend. It monitors for the creation of DKIM selectors or SPF records that authorize these services to send emails on behalf of the organization's domain, which can be used to facilitate email spoofing or phishing.
This rule identifies newly created cloud accounts (AWS or Google Cloud) that exhibit immediate and high-volume API activity within an hour of their creation. This pattern is indicative of resource hijacking, where attackers exploit promotional or startup cloud credits to perform unauthorized tasks, such as hosting proxied API services for resale.
KQL Query
KQL Query
Detects anomalous mailbox access via the MailItemsAccessed operation, specifically identifying the unique ClientAppId and API pairing associated with the Storm-2755 (Payroll Pirates) adversary campaign. This activity indicates unauthorized access to email content, typically targeting high-value personnel such as payroll, finance, and HR staff through Adversary-in-the-Middle (AiTM) techniques.
This rule detects potentially unauthorized or suspicious administrative actions in an Azure environment following a login to specific AI-related applications (AI Gateway, LLM Proxy, or Model Router). It triggers when a user authenticates without applying Conditional Access policies or without Multi-Factor Authentication (MFA), followed immediately (within 30 minutes) by sensitive Azure administrative operations such as role assignments, Key Vault access, or VM write operations.
This rule detects potentially unauthorized or suspicious administrative actions in an Azure environment following a login to specific AI-related applications (AI Gateway, LLM Proxy, or Model Router). It triggers when a user authenticates without applying Conditional Access policies or without Multi-Factor Authentication (MFA), followed immediately (within 30 minutes) by sensitive Azure administrative operations such as role assignments, Key Vault access, or VM write operations.
Detects Microsoft Entra audit activity where a service principal is granted high-impact application permissions, such as directory, application, group, mail, file, or role-management write access. This activity is significant as compromised applications can leverage these permissions to perform actions without requiring an interactive user.
Page 68 of 135