Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
839 detections
Filters
Last updated
All Time
Detection languages
438
190
77
62
40
Contributors
120
114
72
71
68
Categories
464
233
193
152
122
Platforms
288
274
154
88
56
Products / Services
220
169
162
90
76
MITRE Techniques
18,123
15,646
12,594
8,402
6,230
839
CVEs
6
5
5
5
5
IDS Classtypes
4
2
IDS Protocols
1
This rule detects administrative updates to a user account in Azure Active Directory (Microsoft Entra ID) that involve modifying authentication methods to include 'SoftwareTokenActivated' associated with HMAC-SHA1 and specific authentication type configurations. Such modifications may indicate an adversary attempting to register a new MFA device or method to maintain persistence or bypass existing security controls.
Detects individual access events to sensitive Microsoft Graph control-plane endpoints, including directory roles, role management, authentication methods, applications, service principals, and OAuth permissions. This rule is designed to be paired with a broader correlation rule to identify potential reconnaissance or persistence activities involving high-privilege configuration changes.
Detects the registration of a new MFA or security information method (such as StrongAuthenticationMethod, phone, or software OTP token) on an Azure AD/Entra account. This activity is often consistent with attacker-controlled MFA enrollment, used to maintain persistent access after an initial identity compromise, such as one resulting from passkey-themed phishing.
Detects login events to the 'My Sign-Ins' portal (mysignins.microsoft.com) by users. This portal is a high-value target for adversaries who have gained access to a session via token theft or session hijacking, as it allows them to modify or add authentication methods (such as MFA devices) to establish long-term persistence in the victim's account.
This rule detects instances where a user account performs a password update without any preceding or associated account verification events (such as email verification, reset requests, or action execution) within a short timeframe. This behavior can be indicative of account compromise where an adversary modifies credentials for a compromised user account.
This KQL detects potential social engineering and vishing activity in Microsoft Teams over the last 30 days.
This rule detects modifications to the PostgreSQL authentication configuration file (pg_hba.conf), which controls client authentication. It also identifies replication connection requests from source IP addresses that have not been observed in the previous 7 days, indicating a potential attempt to exfiltrate database data via unauthorized replication.
Detects changes to Keycloak realm configurations that enable the 'Forgot password' (resetPasswordAllowed) setting. This specific configuration change is associated with temporary mitigation strategies for CVE-2026-18963 on known-vulnerable versions of Keycloak.
Detects instances where a user grants OAuth application permissions to GitHub or Slack shortly (within 30 minutes) after signing into a low-trust application (Discourse or OpenAI Community), suggesting a potential session hijacking or trusted-relationship abuse scenario where an attacker leverages an existing SSO session to authorize malicious applications.
Detects instances where a user grants OAuth application permissions to GitHub or Slack shortly (within 30 minutes) after signing into a low-trust application (Discourse or OpenAI Community), suggesting a potential session hijacking or trusted-relationship abuse scenario where an attacker leverages an existing SSO session to authorize malicious applications.
Detects instances where a user grants OAuth application permissions to GitHub or Slack shortly (within 30 minutes) after signing into a low-trust application (Discourse or OpenAI Community), suggesting a potential session hijacking or trusted-relationship abuse scenario where an attacker leverages an existing SSO session to authorize malicious applications.
Detects anomalous administrative activity within Microsoft Exchange by identifying accounts performing multiple suspicious operations within a short timeframe. This rule flags activities like modifying transport rules, virtual directories, or management role assignments, which are often indicative of malicious persistence or configuration tampering, while excluding known authorized service accounts.
Detects an authentication event followed by a computer account change event (Event ID 4742) targeting a domain controller computer account. This pattern may indicate unauthorized modifications to domain controller machine accounts, which is often associated with persistence or privilege escalation attempts.
Detects user creation, capability granting, or role modification events occurring on WordPress sites where the Admin Menu Editor plugin (versions 2.35 or 2.36) is active and the associated user account has administrator privileges. This pattern is often indicative of exploitation of known vulnerabilities in this specific plugin to perform unauthorized administrative actions.
This rule detects administrative SQL statements (ALTER ROLE, CREATE ROLE, or GRANT) that assign the REPLICATION attribute to a database role. The REPLICATION attribute in PostgreSQL allows a user to initiate streaming replication and perform logical decoding. This is a security-sensitive privilege, as users with this attribute can potentially bypass standard access controls or, if the environment is misconfigured or vulnerable (e.g., CVE-2026-6471), potentially leverage malicious replication plugins to achieve arbitrary code execution.
KQL Query from file: postgresql-replication-account-escalated-to-superuser-cve-2026-6471.kql
This rule detects administrative updates to a user account in Azure Active Directory (Microsoft Entra ID) that involve modifying authentication methods to include 'SoftwareTokenActivated' associated with HMAC-SHA1 and specific authentication type configurations. Such modifications may indicate an adversary attempting to register a new MFA device or method to maintain persistence or bypass existing security controls.
Detects login events to the 'My Sign-Ins' portal (mysignins.microsoft.com) by users. This portal is a high-value target for adversaries who have gained access to a session via token theft or session hijacking, as it allows them to modify or add authentication methods (such as MFA devices) to establish long-term persistence in the victim's account.
Detects the gitlab-triage automation tool being invoked with a personal access token scoped to the broad 'api' permission rather than a narrower issue/MR-only scope, inflating the blast radius if the token leaks.
Detects when a user who has successfully authenticated to a system is subsequently added to the 'Domain Admins' group within a 15-minute window. This behavior often indicates an adversary performing privilege escalation after gaining initial access to an account.
Detects unauthorized modification of the Nacos database users table, specifically identifying direct INSERT or UPDATE statements used to plant a backdoor administrative account. The rule correlates database modifications with abnormal authentication patterns, such as a password hash update occurring after a failed login attempt to the Nacos application.
Page 9 of 40