Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,004 detections
Filters
Last updated
All Time
Detection languages
1,442
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,417
11,806
5,870
5,145
4,864
3,004
Platforms
1,199
673
623
512
218
Products / Services
880
726
311
257
229
MITRE Techniques
1,661
1,109
905
468
464
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
This detection rule identifies the execution of the Purple Knight tool, a free Active Directory security assessment utility developed by Semperis. Purple Knight is designed to scan for AD vulnerabilities, misconfigurations, and common attack paths. While it is a legitimate tool used by defenders, its execution in production environments may also indicate red team activity or unauthorized reconnaissance by adversaries attempting to map domain weaknesses.
Detects when the Landlock Linux Security Module (LSM) denies an access request from a sandboxed application. This indicates that a process is attempting to perform an action that violates its predefined security policy, which can be a sign of misconfiguration or malicious activity such as exploitation.
This detects events in Okta where there is the eventType of "user.session.impersonation.grant".
This grants access in the context of the user. This could be high privilege admin access.
This grants access in the context of the user. This could be high privilege admin access.
Detects attempts to tamper with AWS CloudTrail or GuardDuty logging configurations by monitoring specific API calls that can disable, modify, or delete logging mechanisms. This includes actions like stopping logging, deleting trails, updating trails, disassociating from master accounts, archiving findings, stopping member monitoring, and deleting or updating detectors. Successful execution of these actions without an error indicates potential malicious activity aimed at evading detection.
Detects events in Okta where there is the eventType of ~'policy.lifecycle' and the policy of 'OktaSignOn'.
This will capture when new signon policies are created or updated. This could allow users to authenticate to Okta where the current policy does not apply. (i.e: enforcing MFA)
This will capture when new signon policies are created or updated. This could allow users to authenticate to Okta where the current policy does not apply. (i.e: enforcing MFA)
Detects events in Okta where there is the eventType of "user.session.impersonation.grant".
This grants access in the context of the user. This could be high privilege admin access.
This grants access in the context of the user. This could be high privilege admin access.
Detects suspicious email inbox rule creation indicative of account compromise. Focuses on rules with randomly-generated names or rules that move emails to low-visibility folders combined with hiding actions (mark as read, delete, stop processing).
Detects a successful SSO administrative login followed by a system configuration download from the same user and source IP address within 5 minutes. This sequence is a strong indicator of compromise related to CVE-2025-59718 and CVE-2025-59719.
This rule detects successful administrative logins to Fortinet devices (FortiGate, FortiWeb, FortiProxy, FortiSwitchManager) that leverage the FortiCloud SSO mechanism from an IP address not on an allowlist. This could indicate exploitation of CVE-2025-59718 and CVE-2025-59719, which allow for an authentication bypass.
Detects the silent installation and configuration of AnyDesk from the command line. This technique was observed being used by actors deploying DeadLock ransomware to establish persistence.
Detects AWS IAM roles whose trust policies were newly created or updated to allow cross account AWS principals to assume the role without any confused deputy protections in place.
Detects privilege escalation attempts used by the Shai-Hulud malware. This includes checking for passwordless sudo ('sudo -n true') and exploiting Docker to modify the 'sudoers.d' file to grant root privileges.
Detects the creation or modification of an IAM Role trust policy that grants assume-role permissions to an AWS account that is not part of the organization. This action creates a backdoor for an external entity to gain persistent access to your environment, often used by attackers to maintain unauthorized access. This rule relies on an `aws_org_accounts.csv` lookup table to identify accounts belonging to the organization. If this lookup is not established, manual filtering of AWS accounts will be required.
Service Accounts may need to be filtered.
Service Accounts may need to be filtered.
Detects attempts to exploit a path traversal vulnerability (CVE-2025-64446) in FortiWeb. Attackers send a crafted POST request to create a new administrative user by targeting a specific URI and including keywords in the request body indicative of new admin creation.
Detects the creation of a new administrative account with 'prof_admin' privileges on a FortiWeb device from an unknown IP address. This activity is highly suspicious if not performed by a known administrator and could indicate post-exploitation activity, potentially related to CVE-2025-64446.
Detects the creation of a new domain user account that is immediately added to a high-privilege group, such as Domain Admins. This pattern is a strong indicator of persistence and privilege escalation, as observed in the Lynx Ransomware campaign.
Detects when a Microsoft Teams messaging policy is modified to allow users to send B2B invitations to external users ('UseB2BInvitesToAddExternalUsers' set to 'True'). While this can be a legitimate administrative change, it can also be an indicator of misconfiguration or malicious activity to enable phishing attacks by luring users to malicious external tenants where organizational security controls do not apply.
Detects the execution of legitimate or dual-use tools commonly used by the CL-CRI-1040/Storm-2603 actor for post-exploitation activities like credential dumping, reconnaissance, and lateral movement. The rule attempts to reduce false positives by looking for execution from unusual paths or by suspicious parent processes.
Detects a user account creation event followed by that same account being added to a privileged administrative group within a short timeframe (e.g., 40 minutes). This behavior is a key tactic of threat actors like Muddled Libra (Scattered Spider), who are known to rapidly escalate privileges after gaining initial access. This detection requires a SIEM to correlate the user identity between the creation event and the group addition event.
Detects when an administrator or help desk agent resets a user's password or deactivates/resets their MFA factors. This activity, while often legitimate, is a key tactic used by social engineering groups like Muddled Libra (aka Scattered Spider) who are known to 'vishing' (voice-phishing) IT help desks to take over accounts.
Detects a user account creation event in Azure AD followed by that same account being added to a privileged administrative role within a short timeframe (e.g., 40 minutes). This behavior is a key tactic of threat actors like Muddled Libra (Scattered Spider), who are known to rapidly escalate privileges after gaining initial access. This detection requires a SIEM to correlate the user identity between the creation event and the role addition event.
Page 102 of 144