Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,936
7,266
6,535
3,866
3,647
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects MFA push-bombing or authentication fatigue attacks where an adversary repeatedly triggers MFA challenge requests for a user in a short period, potentially from multiple IP addresses, culminating in a successful authentication event. This behavior is indicative of an attacker attempting to coerce a user into approving an MFA request.
This rule monitors for the addition of new credentials (secrets) to service principals or applications in an Azure/Entra ID environment. It then correlates this event with subsequent mailbox activity (such as accessing mail items, sending mail, or message binding) performed by the application within 7 days of the credential creation. This detection pattern is indicative of potential OAuth application-based persistence and mailbox data exfiltration.
Detects a suspicious sequence of events involving NetScaler ADC or Gateway appliances: anomalous account authentication, followed by the establishment of a VPN or remote access session, and subsequent unusual outbound network activity indicating potential lateral movement or C2 communication from the appliance.
This rule detects security alerts (IDS, WAF, or infrastructure logs) indicating exploitation attempts against JFrog Artifactory instances related to CVE-2026-66384, specifically involving cache poisoning techniques observed in recent threat campaigns.
Detects anomalous, high-volume data retrieval from Salesforce via OAuth-authenticated Connected Apps using SOQL or Bulk API. This behavior is indicative of a compromised integration token being used by an adversary to exfiltrate sensitive CRM data, such as User, Account, Case, or Opportunity records, by bypassing standard user interface workflows.
Detects direct prompt-injection attempts submitted to an LLM or AI gateway. The rule monitors HTTP POST requests for common adversarial techniques such as attempting to override system instructions, reassign model roles, bypass safety guidelines, or initiate jailbreak modes (e.g., DAN). It includes stateful tracking to flag users who perform multiple such attempts within a 10-minute window, increasing the risk score for persistent malicious behavior.
Detects modifications to Entra ID (formerly Azure AD) that disable security defaults, per-user MFA enforcement, or conditional access policies requiring MFA. Such actions remove tenant-wide MFA protection and are often precursors to account takeover, password spraying, or ransomware attacks.
Detects unauthorized modifications to Microsoft Entra Conditional Access (CA) policies, including deleting policies, disabling them, removing MFA requirements, or excluding specific users. These actions are common techniques used by adversaries to establish persistence or facilitate unauthorized access by weakening security controls.
Detects instances where a user grants an OAuth application consent to high-risk scopes (such as mail reading, file access, or directory reading) without administrator oversight. This behavior is a common indicator of OAuth abuse where an attacker lures a user into granting excessive permissions to a malicious application, providing the attacker persistent access to the user's data.
This rule detects scenarios where an existing SSO or Identity Provider (IdP) session is reused from a device context that differs from the one that originally performed MFA. It identifies this by joining authentication events by SessionId, specifically looking for instances where MFA occurred in one event and a subsequent non-MFA event for the same session has a different User-Agent, DeviceId, JA3 hash, or Operating System build, indicating potential session token theft or reuse.
Detects when a user registers a new multi-factor authentication (MFA) method, such as an authenticator app, phone number, or FIDO key, within 30 minutes of a sign-in event flagged as anomalous (e.g., impossible travel, new ASN, or risky sign-in score). This pattern is indicative of an adversary establishing persistence by registering their own MFA device to maintain access to a compromised account after a session hijack.
Detects MFA or security information registration, updates, or deletions within Entra ID AuditLogs that occur within two hours of a sign-in event flagged as risky, impossible travel, or involving a new device. This sequence is a common indicator of post-compromise identity persistence.
This rule correlates endpoint security alerts for popular information-stealer malware (Lumma, StealC, Vidar, RedLine, Acreed, Atomic Stealer) with subsequent successful cloud identity authentication events from the same user account. The correlation window is set to 72 hours following an endpoint infostealer detection, which suggests potential account takeover or unauthorized access facilitated by credentials stolen from a compromised endpoint.
Detects mass device management actions (e.g., remote wipe, retire, or delete) performed via the Microsoft Intune console by a user who has simultaneously exhibited risky sign-in behavior, potentially indicating a compromised administrative account.
Detects a suspected Multi-Factor Authentication (MFA) fatigue attack, characterized by a user denying three or more consecutive MFA authentication requests in a short period (10 minutes) followed by a successful authentication approval. This behavior often indicates an adversary bombarding a user with push notifications to eventually solicit an accidental or coerced approval.
Detects successful authentication attempts by the same user account from two different geographic locations within a timeframe that is physically impossible to travel between. This detection often highlights compromised accounts or session token theft, including scenarios where MFA mechanisms have been bypassed.
Detects the creation or modification of Exchange Online inbox rules that configure automatic email forwarding or redirection to an external domain. The rule specifically flags if the action also involves deleting or hiding the message, which is a common persistence and exfiltration technique used in Business Email Compromise (BEC) attacks. The detection also incorporates correlation with recent high-risk sign-in activity for the associated user account.
This rule detects potential Multi-Factor Authentication (MFA) push-bombing, also known as MFA fatigue, where an adversary floods a user with push requests in hopes that the user eventually approves one. The rule flags instances where a successful MFA push approval is preceded by five or more failed, denied, or timed-out MFA push notifications within a 15-minute rolling window for the same user.
Detects a sequence of potentially malicious local command execution (via PowerShell, cmd, or mshta) that mirrors the 'ClickFix' social engineering pattern, followed by an OAuth application consent grant or device-code authorization by the same user within a short timeframe. This behavior is indicative of an adversary attempting to bypass MFA by tricking a user into authorizing a malicious application after establishing local execution on their endpoint.
Detects potential insider threats or departing employees by correlating abnormal bulk data downloads from cloud repositories (SharePoint/OneDrive/Box/etc.) with subsequent sensitive data access and exfiltration signals. It uses baseline behavioral profiling, requires a threshold of sensitive file interactions, and mandates high-confidence exfiltration indicators (removable media usage, suspicious external domains, or multiple combined destination events) to reduce noise. Archive/staging activity is used as an optional confidence booster.
Detects potential session hijacking where an Entra ID session is reused by a non-managed/non-compliant device from a different IP and country shortly after an initial authentication from a managed device. This pattern is consistent with infostealer malware stealing session tokens and replaying them on attacker-controlled infrastructure to bypass MFA.
Page 9 of 142