Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,868 detections
Filters
Last updated
All Time
Detection languages
2,527
525
299
218
131
Contributors
999
706
554
263
188
Categories
1,449
1,199
1,092
793
576
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
1,757
1,449
1,121
438
406
MITRE Techniques
1,889
1,392
913
814
727
CVEs
12
5
4
3
2
IDS Classtypes
10
7
6
6
5
IDS Protocols
37
2
1
Detects multiple multi-factor authentication (MFA) attempts that are denied or ignored by a user beyond a defined threshold within a specific lookback window. This behavior is indicative of an MFA fatigue attack, where an adversary repeatedly sends MFA requests to a user in hopes they will eventually approve one to stop the annoyance.
This rule detects two related scenarios: 1. Device Code Phishing: Correlates successful device code authentications with subsequent device registrations for the same user within a short time frame. This can indicate an attacker using a phished device code to register a new device. 2. Primary Refresh Token (PRT) Device Registration: Identifies device registrations that occur after an authentication to the Device Registration Service using a Primary Refresh Token. This pattern is indicative of an attacker minting a PRT and then using it to register or join a device, potentially bypassing conditional access policies.
KQL Query from file: KQL Detection for MDI Password Protection Insight
https://blog.checkpoint.com/research/iran-nexus-password-spray-campaign-targeting-cloud-environments-with-a-focus-on-the-middle-east/
This rule detects multiple failed sign-in attempts using the 'Device Code' authentication flow from various IP addresses or locations for a single user. This behavior can indicate an adversary attempting to bypass multi-factor authentication (MFA) or gain unauthorized access through device code phishing or brute-force attacks against the device code flow. The rule specifically looks for more than 3 attempts from more than 2 distinct IP addresses or locations, targeting common Microsoft applications like Office, Teams, Azure Portal, or Graph.
Detects unauthorized processes attempting to access or interact with the dynamically generated Azure Arc identity token .key files. These files reside in a protected directory and are limited to SYSTEM-level ARC agent processes
This rule detects activity associated with TruffleHog, an open-source tool used for finding credentials and sensitive data, within cloud audit logs. It specifically looks for the 'trufflehog' string in the user_agent field, indicating that the tool was used to interact with cloud resources.
Detects network activity consistent with a user attempting to download or install OpenClaw or a known variant — an open-source AI agent family classified as a Potentially Unwanted Application (PUA). Monitors for access to OpenClaw distribution URLs including GitHub releases, the install script endpoint, raw GitHub content, and npm registry paths for known variants. Also detects variant names appearing in process command lines at the time of a network connection, covering alternative package managers and runtimes such as Bun, pnpm, Yarn, and Deno in addition to traditional browsers and shell tools. Covers 33 known variants of the OpenClaw family including Clawdbot, Moltbot, Ironclaw, MalClaw, and others.
Detects Azure AD application registrations with redirect URIs pointing to known tunneling, reverse proxy, or attacker interaction/callback infrastructure. This can indicate an adversary attempting to establish persistence or exfiltrate data.
This rule detects sign-in attempts to Azure AD where the User-Agent string contains 'TruffleHog'. TruffleHog is an open-source tool used for finding sensitive data like credentials in various data sources, including code repositories. Its presence in sign-in logs could indicate an adversary or security researcher attempting to verify leaked credentials or discover exposed secrets related to Azure AD service principals.
Detects when an external user is invited to the Entra ID tenant. This could indicate legitimate collaboration or an attempt by an attacker to gain initial access or establish persistence by inviting a malicious external account.
Detects installation and post-installation activity associated with OpenClaw and its known variants — an open-source AI agent family classified as a Potentially Unwanted Application (PUA). Monitors for npm global install commands, execution of shell installer scripts, OpenClaw-related binary or package files written to disk, and outbound network activity originating from known OpenClaw agent processes. Covers 33 known variants of the OpenClaw family including Clawdbot, Moltbot, Ironclaw, MalClaw, and others.
Azure Suspicious Redirect URI Detection
Cortex XDR
This rule detects the modification or addition of redirect URIs for Azure Active Directory applications or service principals that point to suspicious domains. These suspicious domains include known reverse proxy/tunneling services (e.g., ngrok, cloudflare tunnel), callback infrastructure (e.g., burpcollaborator, interact.sh), or localhost/loopback addresses. Such modifications can indicate an adversary attempting to establish persistence, exfiltrate data, or redirect authentication flows to attacker-controlled infrastructure.
This rule detects inbound emails from 'azure-noreply@microsoft.com' that are delivered to the inbox, are the first contact from this sender, and contain specific keywords in the subject line such as 'severity', 'activated', 'deactivated', 'alert', 'invoice', 'payment', 'order', or 'fund'. This could indicate phishing attempts or social engineering using a spoofed Microsoft sender to deliver urgent or financially-themed messages.
This rule detects suspicious device registration activity in Microsoft 365. It correlates users who have recently visited Microsoft device login or OAuth2 device authentication URLs with subsequent device registration events in Azure AD. This could indicate an adversary attempting to register a new device to bypass MFA or gain persistent access, potentially through device code phishing.
This rule identifies Azure Arc-enabled machines running agent versions older than 1.61, which are potentially vulnerable to CVE-2026-26117. It queries Azure Activity logs to extract agent versions and flags machines with outdated agents.
This rule detects unusual modifications to Azure Arc machine identities or Role-Based Access Control (RBAC) assignments following local activity. It specifically looks for 'Write', 'Update', or 'Assign' operations on resources within the 'Microsoft.HybridCompute' resource provider where the properties include 'identity' or 'roleAssignment'. This could indicate an attempt to establish persistence or escalate privileges on hybrid machines.
Detects programmatic token refresh activity using the BAV2ROPC user agent originating from Railway IP space. This indicates automated persistent token cycling mechanisms used by the EvilTokens Phishing-as-a-Service (PhaaS) campaign to maintain access to compromised Microsoft 365 accounts.
This rule detects successful device registrations to the 'Device Registration Service' in Azure Entra. It specifically looks for sign-in events where the ResourceDisplayName is 'Device Registration Service', the ErrorCode is '0' (indicating success), and the ConditionalAccessStatus is not '1' (which typically means that conditional access did not block the authentication flow for device registration). The rule is pivotal for hunting devices registered for persistence, post-successful phishing campaign execution, where >= 1 accounts were compromised.
Detects attempts to exploit CVE-2026-21962, a header spoofing vulnerability in Oracle WebLogic Server. The rule identifies suspicious requests where 'wl-proxy-client-ip' or 'x-forwarded-for' headers contain localhost/loopback addresses or command injection keywords, combined with URI paths related to 'weblogic' or 'proxy'.
Detects exploitation attempts of CVE-2026-21962 (Critical - CVSS 10.0) in Oracle WebLogic Server Proxy Plug-in. The vulnerability allows unauthenticated attackers to bypass access controls via path traversal (patterns like /_proxy/ or /wl_proxy/ + weblogic/..; + ProxyServlet) and header spoofing (WL-Proxy-Client-IP pointing to localhost/127.0.0.1). Successful exploitation can lead to unauthorized access, data modification or full compromise of the backend WebLogic Server.
Page 138 of 185