Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,960
7,270
6,537
3,867
3,651
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects anomalous, non-interactive Microsoft Graph sign-in activity consistent with the Payroll Pirate session hijacking campaign. The rule flags instances where the same user account authenticates via Microsoft Graph using the 'Firefox/131.0' user agent from multiple distinct source IP addresses within a 6-hour window, indicating potential stolen session token replay from distributed proxy infrastructure.
Detects unauthorized changes to sensitive payroll information (such as bank accounts or direct deposit details) or suspicious inbox rule creations within Microsoft 365 or HR SaaS environments that occur immediately following anomalous authentication activity. The rule targets indicators of AiTM (Adversary-in-the-Middle) session hijacking, such as unusual user agents, unmanaged device usage, or potential token reuse.
This rule detects a multi-stage attack sequence where a user is subjected to a 'spam bomb' (large volume of inbound emails in a short time), followed by an external Microsoft Teams contact, and concluding with the execution of legitimate remote support tools (Quick Assist or MSRA) on the victim's endpoint, which is a common pattern for social engineering and technical support fraud.
Detects suspicious activities within GitHub repository logs that indicate potential supply chain attacks, including the use of unauthorized workflow names, the creation of orphan snapshot branches, dependabot impersonation attempts, commit messages containing known campaign markers, exposure of internal secrets (HAS_GCR_TOKEN), and the push of suspicious files or configuration modifications.
Detects events in Okta where there is the eventType of "user.session.impersonation.grant".
This grants access in the context of the user. This could be high privilege admin access.
This grants access in the context of the user. This could be high privilege admin access.
Detects potential financial data exfiltration by monitoring for bulk downloads of files with financial keywords from SaaS/Office365 platforms, and identifies unauthorized processes attempting to access sensitive financial application data files (.qbw, .qbb, etc.) on local systems.
Detects suspicious OAuth application or service principal registration, or permission consent, performed by users who are not part of designated IT administrator groups. This rule flags high-privilege permission grants (e.g., Mail.Read, Directory.ReadWrite.All) or application consent events, which are common methods for establishing long-term persistence in cloud environments.
Slack Canvas External Access & Tampering
Cortex XDR
Detects external users accessing internal Slack canvases and suspicious canvas deletion or access level changes. Canvases can contain sensitive runbooks, credentials, and organizational data, making these actions critical to monitor for potential data exfiltration or unauthorized access.
Detects MFA factor activation, device enrollment, and password resets originating from residential/commercial proxy infrastructure, often associated with threat groups like BlackFile/UNC6671/Cordial Spider.
Detects messages sent or chats created by external/guest users in Microsoft Teams where the sender's name or user ID impersonates IT or support personnel, indicating a potential phishing attempt.
Detects programmatic file downloads from SharePoint and OneDrive using automation tools like PowerShell, PnP, Graph SDK, Python, Node.js, or generic CLI tools (curl, wget) rather than typical browser access. This can indicate data exfiltration.
Detects a browser session that contacts an EvilTokens Device Code phishing endpoint (/api/device/status/) and then immediately navigates to onedrive.live.com, indicating the attacker backend returned status:completed and the kit executed window.location.replace to redirect the victim to OneDrive after token capture. This sequence suggests a successful device code phishing attack where the victim's credentials or tokens have been captured, and they are then redirected to a legitimate service to avoid suspicion.
Detects a compromised account revoking refresh tokens, signing out other sessions, or replacing authentication state to retain exclusive access. This behavior is indicative of an attacker attempting to maintain exclusive control over a compromised account by invalidating other legitimate sessions or tokens.
Detects messages sent or chats created by external/guest users in Microsoft Teams where the sender's name or user ID impersonates IT or support personnel, indicating a potential phishing attempt.
Detects when a single user initiates a high volume (5 or more) of external guest user invitations within a one-hour window. This behavior can be indicative of reconnaissance or attempts to establish persistence by an compromised account by inviting external identities into the tenant.
Detects any modification (add, update, or delete) to Entra ID cross-tenant access settings. Adversaries may manipulate these trust configurations to weaken inbound security restrictions, establish unauthorized access between tenants, or facilitate cross-tenant impersonation.
Detects potential Adversary-in-the-Middle (AiTM) phishing activity by identifying successful user sign-ins from a new, historically unseen IP address occurring within 30 minutes of a legitimate sign-in from a known IP, indicating the potential replay of a stolen session or refresh token.
Detects MFA device registration occurring during a suspicious session heavily focused on HR portal access. This rule correlates MFA registration events with access to HR applications like Workday or ADP within a 10-minute window, indicating potential account takeover or unauthorized access attempts.
Detects unauthorized access attempts to ServiceNow Scripted REST APIs, specifically targeting misconfigured endpoints that do not require authentication. This rule monitors for requests made by the 'guest' user, known malicious IP addresses, or requests missing authorization headers directed at potentially vulnerable APIs like 'related_list_edit'.
Detects session hijacking attempts where a session cookie is used from a different IP address or user-agent immediately following a successful MFA authentication event. This behavior is indicative of an adversary replaying a stolen session token.
Detects session hijacking consistent with Browser-in-the-Middle (BitM) attacks like Bluekit PhaaS, where an attacker captures an authenticated session token. The rule identifies instances where a successful MFA-protected login event is immediately followed by a session reuse event from a different IP address or network location, which is indicative of the attacker utilizing the intercepted session.
Page 111 of 142