Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,931
7,261
6,535
3,864
3,642
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects when a user is added to a group in Office 365.
Detects when a group GUID in Office 365 has more users added to it by the same user than a defined thresold.
Detects when a user is removed from a group in Office 365.
Detect mail items accessed via API through an unapproved Entra ID application.
Detects when a user is removed from a group in Microsoft Teams.
Detects and alerts on users bypassing Chrome Safe Browsing warnings and accessing potentially dangerous content or downloads
Identify the use of the application API call to collect a listing of applications in Entra ID. This can be chatty due to other commands calling this single API.
Identify enumeration of inboxes across the Entra ID tenant. This detection is based on the Invoke-GraphOpenInboxFinder in GraphRunner but the concepts are applicable to other tools that scan for accessible inboxes.
Detects when a group is deleted.
This rule identifies changes to SAML (Security Assertion Markup Language) provider configurations within Google Workspace. Monitoring these changes is crucial for security teams as modifications to SAML configurations can potentially weaken an organization's security posture, leading to unauthorized access or other security incidents. The rule specifically looks for events categorized as 'SAML2_SERVICE_PROVIDER_CONFIG_SETTINGS' or with product event types matching 'SAML2_SERVICE_PROVIDER_CONFIG'.
Detects when an Okta user rejects more than 2 Push notifications in a 10 minute window. This behavior can indicate an attacker attempting to gain access to an account by repeatedly sending MFA push notifications, hoping the user will eventually accept one (MFA fatigue).
This rule detects a successful Okta login that occurs after multiple failed MFA push notifications within a 15-minute window. It correlates 'system.push.send_factor_verify_push' events (representing MFA push attempts) with a subsequent 'user.authentication.auth_via_mfa' event (representing a successful MFA authentication and login). The rule specifically looks for more than 4 MFA push attempts followed by a successful login, indicating a potential MFA brute-force or push fatigue attack.
Detects successfully authenticated user logins to Okta based on Okta's Behavior Detection pattern analysis, specifically looking for high-risk indicators such as new geo-location, new device, new IP, new city, new state, new country, or velocity anomalies. It also flags logins originating from unauthorized target geographies like Cuba, Iran, North Korea, Russia, and Syria. The rule only applies to existing users, not newly created ones.
This rule detects failed authentication attempts in Okta where the security result indicates a "FastPass declined phishing attempt." This specifically targets real-time Adversary-in-the-Middle (AiTM) phishing proxy attacks against users enrolled in Okta FastPass, which is designed to prevent such attacks by checking the origin of the authentication request.
This rule identifies when a single user downloads multiple files from Google Drive within a one-hour window. This behavior can be indicative of data exfiltration attempts, where an attacker or malicious insider is trying to extract sensitive information from the organization's Google Drive storage. The rule specifically looks for 'download' events from the 'Google Workspace' vendor and 'drive' product, and triggers an alert if more than 10 distinct files are downloaded by the same user within the specified timeframe.
Detects when a user's account in Okta is locked out or has reached the lockout limit, indicating potential brute-force attempts or suspicious login activity. The rule specifically looks for 'user.account.lock.limit' or 'user.account.lock' events where the security result action is 'BLOCK'.
This rule identifies when a new application from the Google Workspace Marketplace is added to a Google Workspace organization. Installing certain third-party applications can introduce security risks such as data exfiltration, data leakage, or an expanded attack surface for the organization.
This rule identifies a suspicious sequence of events within Google Workspace. Specifically, it triggers when a user successfully logs in under suspicious circumstances (indicated by the 'is_suspicious' label) and subsequently downloads a file from Google Drive. The rule correlates these two events by the user ID and ensures the download occurs after the suspicious login, within a 1-hour window.
This rule identifies when an external user account is added to a group within Google Workspace. This detection helps security teams monitor for unauthorized or unexpected additions of external users to internal groups, which could lead to unauthorized access to sensitive data or resources. The rule works by comparing the domain of the group with the domain of the user being added; if they differ, it indicates an external user is being added.
This rule identifies potential data exfiltration attempts where a user sends multiple files (more than 10) from Google Drive as email attachments to free email domains (e.g., gmail.com, aol.com, hotmail.com, outlook.com, icloud.com) within a one-hour window. This behavior can indicate an adversary attempting to move sensitive data out of the organization's controlled environment.
This rule identifies when a Google Workspace user account is moved between Organizational Units (OUs). This activity can be a legitimate administrative action, but it can also be used by an attacker to move a compromised account to an OU with different policies, potentially granting them more privileges or evading existing security controls. For example, an attacker might move an account to an OU with less stringent multi-factor authentication requirements or different access policies to sensitive data.
Page 138 of 142