Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,932
7,263
6,535
3,865
3,643
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
This rule tracks user and administrator submissions of potential phishing emails to Microsoft for analysis within the Security & Compliance Center. It extracts and logs details such as the submission verdict, rescan verdict, recipients, subject, content, submitter's display name, sender information (P1 and P2), email destination, final delivery verdict, and sender IP address. This provides visibility into an organization's proactive efforts to report and analyze suspected phishing attempts.
Okta Sensitive OAuth Activity Detection
Cortex XDR
This rule detects sensitive OAuth activities within Okta, specifically focusing on OAuth client secret access, token revocation requests, and implicit flow requests. These activities can indicate potential compromise of OAuth clients, attempts to invalidate legitimate tokens, or the use of less secure OAuth flows that could be exploited.
Detects when users are added to groups or applications within Okta, which could potentially grant them elevated privileges. This rule monitors for events indicating changes in user membership for both groups and applications.
Detects Okta Multi-Factor Authentication (MFA) factor enrollment, activation, update, and reset events. These events may indicate an attacker adding their own MFA factor post-compromise to maintain access or removing an existing factor to weaken account security and facilitate unauthorized access.
This rule identifies "impossible travel" scenarios where a user logs in from two geographically distant locations within a short period (less than 2 hours). This can indicate a compromised account being used by an attacker, potentially leveraging VPNs or other proxy services to obscure their true location.
Detects the creation or modification of Power Automate flows that connect to external services commonly used for data exfiltration or command and control, such as webhooks, Gmail, Dropbox, Google Drive, Slack, RSS feeds, custom connectors, or generic HTTP requests/webhooks. This could indicate an adversary attempting to establish persistence or exfiltrate data from the Power Platform environment.
Detects potential “HashJack” prompt injection attempts in AI tool activity. This technique, known as HashJack, attempts to manipulate AI models by hiding instructions after the '#' in a URL. The rule specifically looks for URLs within submitted prompts that contain fragments with suspicious keywords indicative of prompt injection, such as "ignore previous", "override instructions", "system prompt", etc.
Detects the creation of new connectors in Power Automate (formerly Microsoft Flow) that establish connections to external services. This activity is identified by monitoring 'PutConnection' operations within PowerPlatform or MicrosoftFlow audit logs. Such an event could indicate an adversary attempting to integrate malicious services or exfiltrate data.
Detects suspicious modifications to Power Automate flow permissions, including sharing flows or changing role assignments. This could indicate a compromised account attempting to gain unauthorized access or persistence within the Power Platform environment.
Detects when secret scanning rule is deleted for the project or repository.
Detects if the push protection feature is disabled for an organization, enterprise, repositories or custom pattern rules.
Detects when a user disables a critical security feature for an organization.
Detects if the secret scanning feature is disabled for an enterprise or repository.
Detects when an Okta user session starts where the user is behind an anonymising proxy service.
Detects when a user bypasses the push protection on a secret detected by secret scanning.
Detects when Okta identifies new activity in the Admin Console.
Detects when an Okta end-user reports activity by their account as being potentially suspicious.
Detects Bitbucket global SSH access configuration changes.
Detects changes to the bitbucket audit log configuration.
Detects when a secret scanning allowlist rule is added for projects.
Detects when a repository is exempted from secret scanning feature.
Page 118 of 142