Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
985 detections
Filters
Last updated
All Time
Detection languages
640
105
82
64
34
Contributors
242
226
216
58
46
Categories
20,443
11,831
5,875
5,151
4,864
985
Platforms
485
405
224
192
62
Products / Services
416
384
182
109
81
MITRE Techniques
498
497
264
235
234
CVEs
4
4
4
3
3
IDS Classtypes
1
This rule is meant to help analysts quickly spot a high-confidence indicator related to Google NetNTLMv1 Deprecation RainbowTables. It is written to be easy to understand and to keep false alarms low by focusing on a very specific match: a Windows logon event that explicitly shows LM or NTLMv1 as the package used. A match does not automatically prove an attacker is currently active, and it does not prove a file was executed, but it does mean the event is important because it lines up with a public threat intelligence source. When this triggers, start by identifying the host, user, and timeframe involved, then decide whether the activity is expected for that system. If it is unexpected, preserve the related logs and any files, and look for nearby events that could explain how the indicator appeared, such as a download, a new process, or a new connection. If the same indicator appears on multiple systems, treat it as a scoping signal and expand the investigation window. Use the reference link (https://cloud.google.com/blog/topics/threat- intelligence/net-ntlmv1-deprecation-rainbow-tables) to document where the indicator came from and to support incident notes and reporting.
This rule detects sign-in attempts by 'Break Glass' accounts. Break Glass accounts are emergency access accounts typically used in situations where normal administrative access methods are unavailable. Monitoring their usage is critical due to the high privileges usually associated with these accounts. The rule joins sign-in logs with a watchlist of identities to specifically identify activity related to these designated accounts.
This rule detects potential RDP lateral movement by identifying accounts that log on to multiple distinct workstations via RDP (LogonType 10) within a one-hour window, where the workstation name is different from the computer name. A logon chain of more than two distinct computers for the same account and IP address within an hour is flagged as suspicious.
Detects successful anonymous user logins on Windows systems. This activity can be legitimate for accessing public resources but is also commonly used by attackers for enumeration and unauthorized access (e.g., ZeroLogon).
Detects a successful user login from a country that is on a restricted or high-risk list. This can indicate account compromise or policy violation.
Detects Windows logon events where the account name starts with 'WAC_' and belongs to a domain outside of the organization's tenant. This pattern is a key indicator for CVE-2026-20965 exploitation, where an attacker uses a forged token from an external tenant to gain unauthorized access to a Windows Admin Center (WAC) managed machine.
Detects a user successfully logging in from multiple different countries within a short time frame (4 hours). This is a strong indicator of account takeover (T1078).
This rule detects anomalous logon activity for accounts containing 'your admin service account name' by comparing actual logon volumes against a dynamically generated machine learning baseline. It focuses on identifying deviations from expected behavior for these administrative service accounts over a 14-day lookback period, with a sensitivity threshold of 2.5.
This detection identifies successful logon activity (Event ID 4624) on a device that has been reported as stolen or missing. Such activity is highly suspicious and could indicate unauthorized access. The rule enriches the alert with ISP IP information from Azure AD sign-in logs to aid in investigation.
This rule detects logon events from Windows Admin Center (WAC) virtual accounts where the associated user principal name (UPN) belongs to an external or unknown tenant. This activity is a key indicator of compromise for CVE-2026-20965, where an attacker uses a forged token from an external tenant to gain unauthorized access.
This rule identifies successful device logons that meet all of the following criteria:
Logon was successful
Logon was performed by a non-machine account
Logon type is not a service or scheduled task
Logon occurred:
- Before 06:00 local time, or
- After 20:00 local time, or
- On Saturday or Sunday
The configuration details can be modified (timezone, start and end hours...) as needed.
Logon was successful
Logon was performed by a non-machine account
Logon type is not a service or scheduled task
Logon occurred:
- Before 06:00 local time, or
- After 20:00 local time, or
- On Saturday or Sunday
The configuration details can be modified (timezone, start and end hours...) as needed.
The purpose of this query is to identify accounts that have logged in from multiple different countries within a short time window (last hour or last day).
This is typically used for security monitoring to detect suspicious or anomalous authentication behavior.
This is typically used for security monitoring to detect suspicious or anomalous authentication behavior.
This query analyzes login events to identify users with more than five failed login attempts. It filters for login-related events, groups the data by username, endpoint name, failure reason, login type, and associated indicators, then counts the number of failed attempts. The results are sorted in descending order of failed attempts to highlight potentially suspicious activity.
This rule detects new device registrations in Azure Active Directory (AAD) that originate from an IP address not previously associated with the user's account within the last 29 days. It filters out registrations from corporate IP ranges and common mobile operating systems (iOS, Android) to reduce noise. The rule categorizes the risk level of the IP address based on historical sign-in counts, focusing on 'High Risk - New IP' events. It then enriches these events with additional sign-in details like device name, risk level during sign-in, country, and city.
Detect unauthorized access by identifying new country sign-ins for users through AADSignInEventsBeta analytics.
This rule detects potential Pass the Hash (PtH) activity by monitoring Windows Security Event IDs 4624 (successful logon) and 4625 (failed logon) where the LogonType is 3 (Network) and the LogonProcessName is 'NtLmSsp'. It specifically filters out 'ANONYMOUS LOGON' to reduce false positives. This combination of events indicates an attempt to authenticate over the network using NTLM, which is characteristic of PtH attacks for lateral movement.
Detects when Microsoft Cloud App Security (MCAS) reports a risky sign-in attempt due to an impossible travel scenario. This indicates a potential compromise of user credentials where an attacker logs in from a geographically distant location in a short timeframe, making physical travel impossible.
This rule detects interactive console logons (LogonType 2) to server systems and domain controllers. It specifically looks for successful (EventID 528, 4624) and failed (EventID 529, 4625) interactive logon attempts. The rule filters out events where the logon process name is 'Advapi' and the computer is a workstation, aiming to reduce false positives from legitimate workstation activities.
This rule detects successful remote logons by users whose usernames start with 'Admin' (e.g., Administrator, Admin-SQL) on Windows systems. It specifically looks for Event ID 4624 (successful logon), Logon Type 10 (RemoteInteractive), and the Negotiate authentication package. The rule aims to identify potential misuse of administrative accounts for remote access, which could indicate privilege escalation, persistence, or lateral movement. Its effectiveness relies on an internal pattern for administrator usernames and a policy mandating that these accounts are only used as secondary accounts.
Detects a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to localhost, and the target user SID is the built-in local Administrator account. This may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from a domain joined limited user to local System privileges.
Detects successful RDP logons originating from public IP addresses. This can indicate an exposed RDP port being accessed externally, potentially by an attacker.
Page 40 of 47