Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
985 detections
Filters
Last updated
All Time
Detection languages
640
105
82
64
34
Contributors
242
226
216
58
46
Categories
20,443
11,831
5,875
5,151
4,864
985
Platforms
485
405
224
192
62
Products / Services
416
384
182
109
81
MITRE Techniques
498
497
264
235
234
CVEs
4
4
4
3
3
IDS Classtypes
1
Detects anomalous device code authentication patterns by monitoring SigninLogs for accounts utilizing the device code flow across multiple countries or with a high volume of attempts within a short timeframe. This behavior is indicative of potential device code phishing or automated authentication abuse.
Detects two distinct offensive patterns: Impacket PsExec usage, identified by a Type-3 network logon followed within 2 minutes by an ADMIN$ service installation matching typical PsExec naming patterns; and DCSync replication requests originating from non-Domain Controller accounts.
This rule identifies anomalous SonicWall VPN login attempts by tracking successful logins over a rolling 30-day baseline. It alerts when a user successfully authenticates from an IP address not previously seen in their baseline activity, specifically during off-hours (00:00 to 05:00).
This rule identifies Service Principals in Microsoft Entra ID that have successfully authenticated after a long period of dormancy (defined as 90 days or more). Reactivation of dormant service principals may indicate that an adversary is attempting to revive a persistent access method or abuse credentials that were previously set aside.
This rule detects potential malicious activity associated with the 'ClickFix' technique, commonly linked to Midnight Blizzard. It identifies a sequence of events where a device attempts to resolve or fetch a 'wpad.dat' file (a common indicator of proxy configuration manipulation or man-in-the-middle attempts) followed shortly thereafter by the execution of 'powershell.exe' or 'mshta.exe' spawned from 'explorer.exe' on the same host within a 30-minute window. This pattern is indicative of a user being coerced into executing malicious scripts under the guise of fixing connectivity or security prompts.
Detects successful sign-ins using the device code authentication flow that are infrequent for a specific user and location. This flow is often targeted by attackers attempting to bypass MFA or perform device phishing, as it requires the user to manually authorize the device on a separate platform.
Detects anomalous device code authentication patterns by monitoring SigninLogs for accounts utilizing the device code flow across multiple countries or with a high volume of attempts within a short timeframe. This behavior is indicative of potential device code phishing or automated authentication abuse.
This rule detects 'impossible travel' activity performed by users assigned to sensitive Microsoft 365 Communication Compliance roles. It monitors Azure Sign-in logs for successful authentication events occurring within a short timeframe (1 hour) from multiple distinct geographic locations (countries) or different autonomous system numbers (ASNs). This behavior is characteristic of an adversary utilizing stolen session tokens or compromised credentials to access protected administrative functions.
Detects sign-in events using 'deviceCode' authentication or single-factor authentication via mobile/desktop clients where the device identifier has not been seen in the previous 30 days. This pattern can indicate an adversary using a new device to access an account, potentially utilizing stolen sessions or bypassing MFA.
This rule detects hosts exhibiting behavior consistent with an active ransomware or destructive attack in progress, by correlating five distinct attack-chain stages within a rolling 24-hour window: environment/AD enumeration, network share discovery, lateral movement via RDP, credential dumping, and backup/recovery destruction.
This rule detects Remote Interactive (RDP) logon events performed by a local administrator account where the source of the connection is identified as the local host (127.0.0.1, ::1) or the device itself. This pattern is indicative of attackers using tunneling tools, such as the SNOWGLAZE SOCKS proxy, to relay RDP traffic through a compromised host to bypass network-level security controls.
This rule detects potentially malicious activity against accounts classified as having a high blast radius. It correlates three stages of behavior: observed failed authentication attempts (brute force) against a high-blast-radius account, a password reset for that same account, and a subsequent successful logon outside of standard business hours (using Logon Types 3 or 10). The rule uses a password reset event as the mandatory anchor and flags suspicious sequences of events leading up to or following this change.
This rule identifies potential post-Adversary-in-the-Middle (AiTM) session hijacking by correlating suspicious initial authentication events (e.g., AiTM indicators, unusual behavioral flags) with subsequent successful sign-ins originating from known residential proxies or anonymization VPN providers within a 24-hour window.
This rule detects 'impossible travel' activity performed by users assigned to sensitive Microsoft 365 Communication Compliance roles. It monitors Azure Sign-in logs for successful authentication events occurring within a short timeframe (1 hour) from multiple distinct geographic locations (countries) or different autonomous system numbers (ASNs). This behavior is characteristic of an adversary utilizing stolen session tokens or compromised credentials to access protected administrative functions.
Detects signs of Adversary-in-the-Middle (AiTM) token or session replay attacks by correlating device browsing activity on known phishing domains with subsequent user sign-in events. The rule triggers if a sign-in occurs within 10 minutes of a phishing-domain visit from a different, non-corporate IP address, or if a single session exhibits multiple distinct non-corporate IP addresses within that same window.
This rule identifies Service Principals in Microsoft Entra ID that have successfully authenticated after a long period of dormancy (defined as 90 days or more). Reactivation of dormant service principals may indicate that an adversary is attempting to revive a persistent access method or abuse credentials that were previously set aside.
This rule identifies anomalous SonicWall VPN login attempts by tracking successful logins over a rolling 30-day baseline. It alerts when a user successfully authenticates from an IP address not previously seen in their baseline activity, specifically during off-hours (00:00 to 05:00).
Detects process discovery activities (using tasklist.exe, wmic, or Get-Process) performed on a Windows endpoint shortly after an 'MSP Support' account logon, commonly associated with reconnaissance during exploitation of N-able N-central vulnerabilities.
This rule identifies successful user sign-ins originating from IP addresses associated with residential or commercial VPN ASNs that have not been observed in the user's historical sign-in data (past 30 days). By comparing current activity against a baseline of known user locations, it flags potentially unauthorized access through masked connections.
Certighost
KQL
These credentials are used to perform DCSync or other activities, resulting in logon events from domain controller computer account originating from a non-domain controller IP address.
This rule detects potential malicious activity associated with the 'ClickFix' technique, commonly linked to Midnight Blizzard. It identifies a sequence of events where a device attempts to resolve or fetch a 'wpad.dat' file (a common indicator of proxy configuration manipulation or man-in-the-middle attempts) followed shortly thereafter by the execution of 'powershell.exe' or 'mshta.exe' spawned from 'explorer.exe' on the same host within a 30-minute window. This pattern is indicative of a user being coerced into executing malicious scripts under the guise of fixing connectivity or security prompts.
Page 27 of 47