Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,613 detections
Filters
Last updated
All Time
Detection languages
1,725
690
264
214
190
Contributors
985
505
494
256
209
Categories
814
787
728
629
473
Platforms
2,069
629
488
459
346
Products / Services
769
666
525
193
185
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
3,613
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
Detects an suspicious progression of activities originating from identified AI assistant/agent processes. The rule monitors for a chain of behaviors occurring within a 15-minute window: execution of an AI agent/tool, followed by host discovery (network/system enumeration), access to sensitive local credential files, archival of data, and outbound network communication to common file-sharing/exfiltration platforms.
Detects potential Adversary-in-the-Middle (AiTM) session token theft by monitoring for an initial interactive sign-in followed shortly by a non-interactive token refresh from a different IP address and browser fingerprint without a multi-factor authentication (MFA) challenge. This behavior is indicative of an adversary replaying captured session cookies via reverse-proxy infrastructure.
Detects the granting of elevated mailbox permissions (FullAccess, SendAs, SendOnBehalf, or broad folder access) by an OAuth application or service principal. This behavior is indicative of a compromise where an actor uses an App-only context to establish persistence and stage internal spearphishing, bypassing standard administrative monitoring controls.
This rule detects when an OAuth application is granted sensitive Exchange Online permissions, such as 'full_access_as_app', 'Mail.Read', 'Mail.ReadWrite', or 'Mail.Send'. Granting these permissions allows an application to access mailboxes across the tenant without requiring a signed-in user context, which is a common persistence and data exfiltration technique used in Business Email Compromise (BEC) and espionage campaigns.
This rule detects administrative changes to cloud storage configurations (AWS S3, Azure Blob, and GCP Storage) that result in public or anonymous read/write access to buckets or containers, which could lead to unauthorized data exposure.
Detects modifications to cloud storage configurations in Azure and GCP that grant public access to containers or blobs. Attackers may leverage this to expose sensitive data stored in cloud environments by changing permissions to be publicly readable.
Detects unauthorized or risky configuration changes in Google Cloud Storage or Azure Storage accounts that grant public access (e.g., allUsers/allAuthenticatedUsers or public blob access) specifically on storage resources identified as production or sensitive (PII/financial data).
Detects modifications to Google Cloud Storage bucket IAM policies that grant access to 'allUsers' or 'allAuthenticatedUsers'. This activity indicates a potential misconfiguration or an attempt by an attacker to stage or exfiltrate data by making bucket contents publicly accessible.
Detects the creation or modification of Microsoft 365/Exchange inbox rules that suggest malicious staging or exfiltration activities. This includes rules configured for external email auto-forwarding, automatic deletion of messages, or movement of emails into hidden/system folders (e.g., RSS Subscriptions, Archive) which may be filtered based on sensitive keywords related to financial or credential theft (e.g., invoice, wire, payment).
Detects successful sign-in events in Entra ID where MFA is marked as satisfied, but no interactive MFA challenge (e.g., Push, FIDO2, SMS) was recorded as completed in the authentication details. This behavior, when correlated with a new IP, device, or user-agent relative to a 30-day baseline, is highly indicative of session token replay or AitM (Adversary-in-the-Middle) attacks attempting to bypass MFA requirements.
Detects a suspicious pattern where a user authenticates to a remote access portal (like Citrix or VPN) without multi-factor authentication (MFA) or with an existing risk flag, followed by a surge in file activity (creation, modification, or renaming of >500 files or >200 distinct files) on the same account within a 24-hour window, potentially indicating compromised credential usage for staging data for exfiltration or ransomware.
This rule detects potentially malicious bulk mailbox exfiltration operations (such as New-MailboxExportRequest, New-ComplianceSearch, or Search-Mailbox) performed by an account within 24 hours of experiencing a high or medium-risk sign-in event, suggesting post-compromise data harvesting.
Detects access to sensitive browser credential and cookie files by processes that are not recognized web browsers or their designated update components. This behavior is highly indicative of credential theft activity where an adversary is attempting to extract stored credentials or session cookies from local browser storage.
Detects anomalous, high-volume mailbox read (MailItemsAccessed) activity for a specific user compared to their historical daily baseline. The rule triggers when access volume significantly exceeds baseline averages, particularly when the activity originates from an IP address not previously observed for that specific user, which is a common indicator of automated email exfiltration via stolen session token replay.
This rule detects potential Adversary-in-the-Middle (AiTM) phishing activity by identifying session token or cookie reuse. It monitors for instances where a valid authentication session is established from one IP address and then immediately used again by the same user with the same session ID from a different IP address and potentially a different User-Agent, indicating that an attacker has hijacked and replayed the MFA-satisfied session.
Detects the creation or modification of mailbox inbox rules that configure forwarding or redirection to external addresses, or rules that automatically delete or move messages based on sensitive keyword filters (e.g., 'invoice', 'password'). It specifically looks for indicators of mailbox hiding (hidden rules) which are frequently used by attackers to maintain persistence and conceal activity, particularly following unauthorized access or token theft.
This rule monitors Azure AD sign-in logs for patterns indicative of Adversary-in-the-Middle (AiTM) phishing attacks. It triggers when a successful authentication includes MFA and exhibits specific flags associated with proxy-based session hijacking, such as unfamiliar risk details or clear evidence of proxy-based token issuance.
This rule detects the suspicious archival of browser credential files (e.g., Login Data, Cookies, wallet.dat) or the transmission of data to common command-and-control (C2) services such as Telegram, Discord, or raw IP addresses using common system tools like PowerShell, curl, or certutil.
Detects an account performing a mass download or synchronization of files from SharePoint or OneDrive within a 30-minute window, occurring within two hours of a medium or high-risk Azure AD sign-in event. This pattern is indicative of potential account takeover and subsequent data exfiltration by an adversary using harvested credentials.
Detects potential account compromise by aggregating multiple high-fidelity indicators of adversary activity for a single user within a 72-hour window. The rule triggers when at least three distinct stages of an attack chain are identified, specifically: credential theft/infostealer activity, anomalous sign-in (token reuse/impossible travel), mailbox or OAuth configuration changes, and mass data exfiltration.
This rule detects potentially malicious behavior in package manager post-install scripts (npm, pip). It monitors for child processes like shells, network utilities (curl, wget), or command-line arguments indicative of credential harvesting (e.g., accessing .ssh, .aws/credentials, environment variables) initiated by package management processes.
Page 6 of 173