Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,001 detections
Filters
Last updated
All Time
Detection languages
1,439
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,402
11,796
5,865
5,145
4,864
3,001
Platforms
1,199
672
622
512
218
Products / Services
879
726
311
257
229
MITRE Techniques
1,659
1,107
903
465
464
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.
This rule detects instances where PowerShell (powershell.exe or pwsh.exe) spawns 'node.exe' with command-line arguments containing '-e' and the process path is located within the 'AppData\Roaming' or 'AppData\Local' directories. This behavior can be indicative of malicious activity, such as the execution of Node.js-based scripts or malware by PowerShell, potentially for persistence or further execution within user-specific application data folders.
Detects various sensitive configuration modifications in AWS that could indicate malicious activity, such as privilege escalation, defense evasion, or data exposure. This rule looks for a curated list of API calls related to changes in IAM, EC2 security groups, S3 bucket policies, and logging configurations.
This rule detects new device registrations in Azure Active Directory (AAD) that originate from an IP address not previously associated with the user's account within the last 29 days. It filters out registrations from corporate IP ranges and common mobile operating systems (iOS, Android) to reduce noise. The rule categorizes the risk level of the IP address based on historical sign-in counts, focusing on 'High Risk - New IP' events. It then enriches these events with additional sign-in details like device name, risk level during sign-in, country, and city.
Detects attempts to exploit the Triofox authentication bypass vulnerability (CVE-2025-12480) by sending a request with a 'localhost' Host header from an external IP address to access administrative pages. This allows an attacker to create a new administrative account.
This detection looks for administrative activity that creates or updates Cross-Tenant Access Settings or Cross-Tenant Identity Synchronization Settings in Microsoft Entra ID (Azure AD). These settings control how identities, claims, and trust relationships are shared between Microsoft Entra tenants.
ET WEB_SPECIFIC_APPS TVT queryDevInfo Information Disclosure (CVE-2024-7339)
See what commands are being input into the device by other people, full credentials can be in the history
Modifications to a config that will serve an adversary's impacts or persistence
Cisco Stage Data
Sigma
Various protocols maybe used to put data on the device for exfil or infil
Cisco Sniffing
Sigma
Show when a monitor or a span/rspan is setup or modified
Detects the Installation of a Exchange Transport Agent
This rule detects the presence of 'activeMQConnectionURL' and 'tcp://' within HTTP response bodies, which is indicative of a Commvault server exposing its hostname or connection details. This information could be leveraged by attackers for reconnaissance or to identify vulnerable Commvault instances.
Detects the creation of a new administrator account on a Fortinet FortiGate Firewall. This activity could indicate an attacker establishing persistence or escalating privileges within the network infrastructure.
Detects when a new administrator role assignment is created within Okta. This activity can indicate privilege escalation, where an attacker gains higher-level permissions, or persistence, where an attacker establishes a way to maintain access to the system over time.
This rule detects when GitHub's push protection feature is disabled. This feature helps prevent sensitive information, such as secrets, from being accidentally committed to repositories. Disabling it could indicate an attempt to bypass security controls, potentially allowing secrets to be exposed in code.
Detects when an administrator role is assigned to a user or group within Okta. This could indicate privilege escalation or persistence by an attacker, or a legitimate administrative action.
Detects when a full data export is initiated in Bitbucket. This event indicates that a complete backup or export of all data within the Bitbucket instance has been triggered. This could be a legitimate administrative action but also a precursor to data exfiltration by an attacker who has gained administrative access to the Bitbucket server.
Detects when a new member is added or invited to a GitHub organization. This activity could indicate an attempt by an adversary to gain persistence within an organization's GitHub environment by adding a controlled account or inviting a malicious user.
This rule detects when a user disables critical security features within a GitHub organization or repository. This includes disabling advanced security features, OAuth app access restrictions, or two-factor authentication requirements. Such actions can significantly weaken the security posture of a GitHub environment, potentially leading to unauthorized access or compromise.
Detects when an organization member or an outside collaborator is added to or removed from a project board or has their permission level changed or when an owner removes an outside collaborator from an organization or when two-factor authentication is required in an organization and an outside collaborator does not use 2FA or disables 2FA.
Page 103 of 143