Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,001 detections
Filters
Last updated
All Time
Detection languages
1,439
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,402
11,796
5,865
5,145
4,864
3,001
Platforms
1,199
672
622
512
218
Products / Services
879
726
311
257
229
MITRE Techniques
1,659
1,107
903
465
464
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
Detects when a user creates a new secret within GitHub for an organization, environment, codespace, or repository. This activity is critical to monitor as secrets often contain sensitive credentials (e.g., API keys, tokens) that, if compromised or misused, can lead to unauthorized access, privilege escalation, or persistence within the GitHub environment. The rule specifically looks for audit log actions indicating the creation of these secrets.
Detects the modification of a user group on a Fortinet FortiGate Firewall. This activity could be used by an attacker to grant themselves or other malicious accounts VPN access to a network, facilitating persistence or privilege escalation.
Detects when the policy allowing forks of private and internal repositories is changed (enabled or cleared) within a GitHub enterprise environment. This action can indicate an attempt to exfiltrate data by creating copies of sensitive repositories or a change in security posture.
Detects when changes are made to the SSH certificate configuration of a GitHub organization, specifically the creation of an SSH certificate authority or the disabling of the requirement for members to use SSH certificates.
Detects when a GitHub Pages site of a repository is made public. This action, while potentially part of a legitimate publishing process, could also indicate an adversary attempting to expose sensitive information or code publicly. Monitoring this activity helps identify potential unauthorized data exposure.
This rule detects attempts to access Okta administrative functions when the request is routed through a proxy. This could indicate an adversary attempting to bypass security controls or obscure their origin when performing administrative actions within Okta.
This rule detects changes to global permissions within Bitbucket. This includes requests to grant or remove global permissions, as well as the successful granting or removal of such permissions. Monitoring these events is crucial for identifying unauthorized privilege escalation or persistence attempts within a Bitbucket instance.
Detects the addition of a new VPN SSL Web Portal on a Fortinet FortiGate Firewall. This activity can be an indicator of an adversary establishing persistence or initial access, especially when observed in conjunction with other modifications to VPN SSL settings. Attackers might add new web portals to maintain access to the network or to create new entry points.
This rule detects when an organization owner disables Dependabot alerts for private repositories or Dependabot security updates for all repositories within GitHub. Dependabot performs scans to detect insecure dependencies and sends alerts, so disabling these features can increase an organization's exposure to vulnerabilities.
Detects delete actions within GitHub audit logs related to codespaces, environments, projects, and repositories. This can indicate an attempt to remove critical development infrastructure or source code.
This rule detects changes to self-hosted GitHub Actions runner configurations. These changes include actions such as removing a self-hosted runner from an organization or repository, creating or removing runner groups, and adding, removing, or updating runners within a runner group. Such modifications can indicate administrative actions related to CI/CD infrastructure, which should be validated for legitimacy.
This rule detects when a user is added to the local 'admin' group on a macOS system using either the `dscl` or `dseditgroup` command-line utilities. It specifically looks for command-line arguments indicative of adding a user to the 'admin' group. There is a whitelist for legitimate MDM solutions like 'jamfmanager' to reduce false positives.
This rule detects when a repository within Bitbucket is configured to be exempt from secret scanning. This action could indicate an attempt to bypass security controls and hide sensitive information or malicious code within the repository without detection.
Detects when a user bypasses the push protection on a secret detected by secret scanning in GitHub. This indicates an attempt to commit code containing sensitive information despite automated safeguards.
Detects when a GitHub repository is archived or unarchived, which may indicate unauthorized changes to repository status. This action can be used by adversaries for various purposes, including defense evasion by hiding malicious repositories, persistence by making a repository less likely to be deleted, or impact by disrupting access to legitimate codebases.
Detects when the global SSH access configuration is changed within Bitbucket. This could indicate an attempt to enable or modify SSH access for malicious purposes, potentially for lateral movement or persistence.
This rule detects when Okta identifies new or unusual activity within the Admin Console. It specifically looks for 'policy.evaluate_sign_on' events targeting the 'Okta Admin Console' where Okta's internal heuristics (debugcontext.debugdata.behaviors or debugcontext.debugdata.logonlysecuritydata) flag the activity as 'POSITIVE' for unusual behavior. This can indicate an adversary attempting to gain or maintain access to administrative functions, or an administrator performing actions that are outside their typical patterns.
Detects when a global secret scanning rule is deleted in Bitbucket. This activity could indicate an adversary attempting to disable security controls to prevent detection of sensitive information exposure.
Detects when a secret scanning allowlist rule is added for projects in Bitbucket. This could indicate an attempt to bypass security controls by allowing certain secrets to be ignored by the scanning mechanism.
This rule detects when a secret scanning rule is deleted within Bitbucket for either a project or a repository. This action could indicate an attempt to bypass security controls by disabling mechanisms designed to detect sensitive information in code.
Detects when a GitHub repository or an organization is transferred to another location. This activity can indicate an attempt to exfiltrate sensitive data, establish persistence in a new location, or disrupt operations by moving critical assets. The rule specifically monitors GitHub audit logs for actions such as 'migration.create' (creation of a migration file for data transfer), 'org.transfer_outgoing' or 'org.transfer' (transfer of an organization between enterprise accounts), and 'repo.transfer_outgoing' (transfer of a repository to another network).
Page 104 of 143