Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,004 detections
Filters
Last updated
All Time
Detection languages
1,442
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,417
11,806
5,870
5,145
4,864
3,004
Platforms
1,199
673
623
512
218
Products / Services
880
726
311
257
229
MITRE Techniques
1,661
1,109
905
468
464
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
This query uses the Machine Learning series_decompose_anomalies function to build a baseline of "normal" transport rule modification behavior. If your organization typically changes 0 rules a week, and suddenly 5 are changed at 2 AM on a Saturday, this query will catch it regardless of what the parameters are.
This rule detects anomalous logon activity for accounts containing 'your admin service account name' by comparing actual logon volumes against a dynamically generated machine learning baseline. It focuses on identifying deviations from expected behavior for these administrative service accounts over a 14-day lookback period, with a sensitivity threshold of 2.5.
This alert identifies a potential bypass of repository governance controls. It triggers when a GitHub repository's default branch is changed and then reverted or updated again within a 24-hour window. By temporarily changing the default branch to an unprotected branch, an actor can push code or merge pull requests to the primary branch (e.g., main) without satisfying mandatory status checks or peer review requirements.
This rule detects the connection of USB Network Interface Controllers (NICs) with specific Vendor and Product IDs known to be associated with suspicious devices often used in Man-in-the-Middle (MITM) implants. These include devices like the Hak5 LAN Turtle, Realtek USB GbE adapters (often found in Raspberry Pi-based implants), and D-Link USB Ethernet adapters that have been observed in modified implants. The rule specifically filters for 'PnpDeviceConnected' events where the device class is a network adapter.
Detects when a new Multi-Factor Authentication (MFA) method is registered shortly after a successful sign-in from an unfamiliar or risky location. This pattern is a strong indicator of an Adversary-in-the-Middle (AiTM) attack where the threat actor, having bypassed MFA to gain initial access, immediately adds their own authentication method to establish persistence on the account.
This rule detects instances where a SharePoint or OneDrive file/folder is shared with a guest user whose email address is identified as a threat intelligence indicator. This could indicate an attempt to exfiltrate data to a known malicious entity or an account compromise being used for data staging.
This rule detects a multi-stage attack chain starting with a high-confidence phishing email, followed by a risky sign-in from the recipient, and culminating in sensitive actions within Azure, specifically targeting IAM role assignments, storage account key access, or AKS cluster modifications. The detection correlates these events within a defined time window to identify potential compromise of cloud resources originating from a successful phishing attack.
This rule tracks and deduplicates alert emails from a Managed Security Service Provider (MSSP). It identifies emails from a specific sender, filters by subject keywords (e.g., severity levels), and groups them into sessions to prevent duplicate alerts. It also extracts case numbers from portal URLs found within the emails.
This rule will alert when a pending action is required by a Security Administrator in Defender XDR. XDR lacks integrations with common ITSM applications and can only natively email for notifications. This will allow you to create a Sentinel Incident which then you can use a logic app to alert to whatever platform you would like.
Detects interactive administration commands (exec, attach, port-forward) within a sensitive Kubernetes namespace. Such activity can be legitimate but warrants scrutiny in high-value environments as it allows direct interaction with containerized applications and data.
Detects interactive shell execution within a container in a production Kubernetes namespace. This activity can be indicative of an attacker with a compromised user account attempting to manually control a container for exploration, privilege escalation, or data staging. Legitimate debugging by administrators may also trigger this rule.
Detects interactive shell execution within a container in a production Kubernetes namespace. This activity can be indicative of an attacker with a compromised user account attempting to manually control a container for exploration, privilege escalation, or data staging. Legitimate debugging by administrators may also trigger this rule.
Esta detección identifica posibles conexiones relacionadas con el uso de VPNs dentro del entorno corporativo, correlacionando puertos asociados a protocolos VPN, dominios no habituales, procesos iniciadores y adaptadores de red virtuales o tunelizados. El objetivo es descubrir actividad de VPN no autorizada, conexiones cifradas ocultas dentro de tráfico HTTPS y el uso de extensiones de navegador que actúan como túneles tipo VPN.
La lógica de esta consulta aplica múltiples capas de filtrado para reducir falsos positivos:
- Filtra conexiones salientes hacia puertos característicos de IPsec, OpenVPN, WireGuard, L2TP y PPTP.
- Detecta túneles sobre puerto 443 cuando el proceso iniciador no corresponde a aplicaciones del sistema.
- Excluye ruido generado por procesos de Windows y dominios legítimos asociados a Microsoft, Google y servicios cloud corporativos.
- Identifica adaptadores TAP, TUN, Wintun, WireGuard, Tailscale o ZeroTier presentes en el host.
- Clasifica el tipo probable de VPN según el puerto utilizado y el proceso que inicia la conexión.
Esta detección permite encontrar:
- Clientes VPN instalados sin autorización.
- Extensiones de navegador que establecen túneles SSL-VPN encubiertos.
- Herramientas de túneles encubiertos como WireGuard stealth, Tailscale o ZeroTier.
- Actividad anómala desde navegadores que podría indicar proxies cifrados o VPNs embebidas.
La lógica de esta consulta aplica múltiples capas de filtrado para reducir falsos positivos:
- Filtra conexiones salientes hacia puertos característicos de IPsec, OpenVPN, WireGuard, L2TP y PPTP.
- Detecta túneles sobre puerto 443 cuando el proceso iniciador no corresponde a aplicaciones del sistema.
- Excluye ruido generado por procesos de Windows y dominios legítimos asociados a Microsoft, Google y servicios cloud corporativos.
- Identifica adaptadores TAP, TUN, Wintun, WireGuard, Tailscale o ZeroTier presentes en el host.
- Clasifica el tipo probable de VPN según el puerto utilizado y el proceso que inicia la conexión.
Esta detección permite encontrar:
- Clientes VPN instalados sin autorización.
- Extensiones de navegador que establecen túneles SSL-VPN encubiertos.
- Herramientas de túneles encubiertos como WireGuard stealth, Tailscale o ZeroTier.
- Actividad anómala desde navegadores que podría indicar proxies cifrados o VPNs embebidas.
This rule detects when a system configuration file is downloaded from a FortiGate device within 60 seconds of a successful SSO login from the same user and source IP. This rapid sequence of events is indicative of automated scripts used by attackers to exfiltrate device configurations immediately after gaining initial access.
This rule detects the creation of a local administrative account on a FortiGate device with a generic name commonly used by threat actors for persistence following an initial compromise. The rule specifically looks for log events indicating the addition of a new system administrator account with names like 'secadmin', 'itadmin', 'support', 'backup', 'remoteadmin', or 'audit'.
This rule detects suspicious activity related to mailbox access within Office 365. It has two main parts: 1) Identifies users accessing a high number of unique mailboxes belonging to other users. 2) Identifies users accessing a high number of unique folders within another user's mailbox. Both scenarios can indicate unauthorized access, data exfiltration attempts, or compromised accounts.
This rule detects suspicious activity related to mailbox access within Office 365. It has two main parts: 1) Identifies users accessing a high number of distinct mailboxes belonging to other users. 2) Identifies users accessing a high number of distinct folders within another user's mailbox. Both parts are designed to flag potential unauthorized access, data exfiltration, or reconnaissance activities within an Exchange Online environment.
This rule detects attempts to delete S3 bucket logging configurations originating from IP addresses not associated with AWS infrastructure. This could indicate an attacker attempting to cover their tracks by disabling logging for an S3 bucket after gaining unauthorized access.
High AWS S3 Object Deletion Count
Cortex XDR
Detects when a single IP address or identity performs a high number of S3 object or bucket deletions within a short timeframe. This could indicate an attacker attempting to destroy data, evade detection, or disrupt services.
Detects a sequence of events where an AWS IAM Role Trust Policy or a Role's managed policy is modified (UpdateAssumeRolePolicy, PutRolePolicy) and is immediately followed by a successful assumption of that role (AssumeRole, AssumeRoleWithSAML, etc.) within a 10-minute window. This behavior is characteristic of an attacker setting up a backdoor or escalating privileges by granting a new, unauthorized principal (user, service, or account) permission to assume a critical role.
This rule detects when a certificate is issued to a privileged user. It identifies privileged users by checking their group membership against a predefined list of administrative groups such as 'Domain Admins', 'Enterprise Admins', and 'Administrators'. The rule then looks for Windows Security Event ID 4886, which indicates a certificate services operation, and extracts the principal name from the Subject Alternative Name field. Finally, it joins this information with the identified privileged users to flag any certificate issuance to them.
Page 101 of 144