Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
985 detections
Filters
Last updated
All Time
Detection languages
640
105
82
64
34
Contributors
242
226
216
58
46
Categories
20,443
11,831
5,875
5,151
4,864
985
Platforms
485
405
224
192
62
Products / Services
416
384
182
109
81
MITRE Techniques
498
497
264
235
234
CVEs
4
4
4
3
3
IDS Classtypes
1
This rule identifies successful user sign-ins (ResultType 0) originating from specific Autonomous System Numbers (197540, 216154) where Multi-Factor Authentication (MFA) was not required or not recorded, and where Conditional Access policies either did not apply or succeeded without enforcing MFA.
Detects a pattern of multiple failed authentication attempts (brute force) from an external IP address followed by a successful authentication event on remote access services such as RDP, VPN, or NTLM. The rule filters for non-private IP addresses and flags successes occurring outside of standard business hours.
This rule detects potential credential theft activity by monitoring for unauthorized access to sensitive browser-related credential files (e.g., Login Data, cookies.sqlite) or direct access to the LSASS process memory by non-standard browser processes. It further correlates these events with user sign-ins on previously unknown or unassociated devices within a short timeframe to identify potential account compromise.
Detects successful Azure AD sign-ins where the user agent identifies as a Python requests library version (2.33.1 or 2.34.2) that has not been observed for that specific user account in the preceding 14 days. This behavior is indicative of anomalous automated or scripted access.
Detects inbound emails masquerading as reputable advisory firms (PwC or KPMG) using lookalike sender domains, combined with wire-transfer fraud phrases in the subject line. Correlates with identity logon telemetry for the same fraudulent WhatsApp Business phone number, enabling detection across both email and authentication channels. Note: message body content is not available in the EmailEvents schema, so fraud-phrase matching is subject-only.
Detects a specific adversary pattern termed 'Phantom Deal' where a user is socially engineered into disabling their VPN (by claiming a link won't open), followed immediately by a rapid succession of accesses to the same tracking or canary link from that user account. The rule correlates sign-in events indicating a shift in VPN or MFA context with subsequent bursts of URL clicks.
Detects anomalous sign-in behavior shortly after a successful MFA-authenticated session in Microsoft 365. This rule flags scenarios where a subsequent session for the same user occurs within a short window (30 minutes) from a different IP, ASN, User-Agent, or device identifier, potentially indicating the replay of a stolen session cookie obtained via Adversary-in-the-Middle (AiTM) phishing.
This rule detects the presence of specific file hashes known to be associated with backdoored software builds, specifically related to recent supply chain compromises affecting South Korean software vendors (e.g., HAProxy builds). It monitors device file events, process initiation, and identity logon events to identify systems that have deployed, executed, or been accessed by these malicious binaries.
This rule detects potentially unauthorized access to cloud resources or OAuth applications by identifying sign-ins or API calls originating from IP addresses or locations not previously observed for the user in the 30 days prior to a documented Coder registry compromise exposure window.
Detects potential remote service session hijacking by monitoring for RDP session ID reuse by a different user or unauthorized SSH session reattachment (e.g., tmux/screen hijacking). It correlates logon events with process execution to identify instances where an existing session is accessed by an account other than the original owner, while excluding legitimate service/support account activity.
Detects anomalous remote interactive or network logons where the specific account and remote host/IP combination has not been observed in the previous 14 days. The rule correlates these new login events with subsequent process execution on the destination host within a short window (5 minutes) to identify potential lateral movement where an adversary uses valid credentials to log in and immediately execute commands.
Detects successful logon events (Event ID 4624) utilizing Schannel (TLS client certificate) or PKU2U (peer authentication) logon processes. This behavior may indicate an attacker using forged or stolen certificates to authenticate against a system, potentially bypassing Kerberos-based authentication monitoring.
This rule detects the presence of specific file hashes known to be associated with backdoored software builds, specifically related to recent supply chain compromises affecting South Korean software vendors (e.g., HAProxy builds). It monitors device file events, process initiation, and identity logon events to identify systems that have deployed, executed, or been accessed by these malicious binaries.
Detects anomalous authentication patterns indicative of session token replay attacks. The rule identifies instances where a user successfully performs an MFA-authenticated, interactive sign-in, followed shortly (within 5-60 minutes) by a single-factor sign-in for the same user. The suspicious activity is characterized by a shift to a different IP/ASN, an unmanaged device (non-trusted), and a change in browser or OS identifiers, all while the user's geolocation (city/country) remains consistent. This behavioral pattern is highly consistent with the use of residential proxy infrastructure to replay stolen session tokens, effectively bypassing MFA.
Detects anomalous authentication patterns indicative of session token replay attacks. The rule identifies instances where a user successfully performs an MFA-authenticated, interactive sign-in, followed shortly (within 5-60 minutes) by a single-factor sign-in for the same user. The suspicious activity is characterized by a shift to a different IP/ASN, an unmanaged device (non-trusted), and a change in browser or OS identifiers, all while the user's geolocation (city/country) remains consistent. This behavioral pattern is highly consistent with the use of residential proxy infrastructure to replay stolen session tokens, effectively bypassing MFA.
Detects anomalous authentication patterns indicative of session token replay attacks. The rule identifies instances where a user successfully performs an MFA-authenticated, interactive sign-in, followed shortly (within 5-60 minutes) by a single-factor sign-in for the same user. The suspicious activity is characterized by a shift to a different IP/ASN, an unmanaged device (non-trusted), and a change in browser or OS identifiers, all while the user's geolocation (city/country) remains consistent. This behavioral pattern is highly consistent with the use of residential proxy infrastructure to replay stolen session tokens, effectively bypassing MFA.
Detects a suspicious sequence of interactive sign-ins to Microsoft management and profile-related applications from unmanaged devices occurring within a tight 15-minute window. This behavior is indicative of post-compromise activity, potentially associated with activity clusters such as UNC6671, where an attacker interacts with account settings shortly after compromising a session.
Detects a suspicious sequence of interactive sign-ins to Microsoft management and profile-related applications from unmanaged devices occurring within a tight 15-minute window. This behavior is indicative of post-compromise activity, potentially associated with activity clusters such as UNC6671, where an attacker interacts with account settings shortly after compromising a session.
Detects a suspicious sequence of interactive sign-ins to Microsoft management and profile-related applications from unmanaged devices occurring within a tight 15-minute window. This behavior is indicative of post-compromise activity, potentially associated with activity clusters such as UNC6671, where an attacker interacts with account settings shortly after compromising a session.
This rule detects user authentication events that deviate significantly from a 14-day historical baseline of known devices, operating systems, browsers, and network locations (ASN). It flags logins where at least two out of four key metadata signals (DeviceId, OS, Browser, ASN) have changed compared to the user's historical pattern, specifically targeting successful authentications that did not trigger a fresh multi-factor authentication (MFA) challenge, potentially indicating token theft or unauthorized session reuse.
Detects successful Azure AD sign-ins where the user agent identifies as a Python requests library version (2.33.1 or 2.34.2) that has not been observed for that specific user account in the preceding 14 days. This behavior is indicative of anomalous automated or scripted access.
Page 23 of 47