Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,001 detections
Filters
Last updated
All Time
Detection languages
1,439
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,402
11,796
5,865
5,145
4,864
3,001
Platforms
1,199
672
622
512
218
Products / Services
879
726
311
257
229
MITRE Techniques
1,659
1,107
903
465
464
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
Detects when the secret scanning feature is disabled for a GitHub enterprise or repository. This action can indicate an attempt to evade security monitoring and hide the introduction of sensitive information into codebases.
Detects when a new identity provider is created in Okta. This activity can be a legitimate administrative action but could also indicate an attacker attempting to establish persistence or bypass authentication mechanisms by creating a rogue identity provider.
Detects attempts to export user permission data from Bitbucket, which could indicate reconnaissance or data collection activities by an adversary.
This rule detects when an MDI (Microsoft Defender for Identity) sensor is deleted. This could indicate an adversary attempting to impair defenses by removing security monitoring tools.
This rule detects attempts by an unauthorized user to trigger a full data export from Bitbucket. This activity could indicate an adversary attempting to collect sensitive information, such as source code or credentials, from the code repository.
This rule detects attempts to export user details from Bitbucket, including successful exports, failed attempts, and the initiation of such exports. This activity could indicate an adversary attempting to collect sensitive user information for further reconnaissance or data exfiltration.
This rule detects when a Multi-Factor Authentication (MFA) factor is deactivated or all MFA factors are reset for a user within Okta. This activity can indicate an adversary attempting to bypass or disable MFA to gain persistent access to an account.
Detects when an Okta Network Zone is deactivated or deleted. This activity can indicate an attempt to bypass network-based security controls, potentially allowing unauthorized access from untrusted IP ranges or locations. It could be a precursor to other malicious activities or an attempt to hinder forensic investigation.
This rule detects when an MDE offboarding package is downloaded.
This activity could indicate an attempt to remove an endpoint from security monitoring or management, potentially by an insider threat or an attacker attempting to evade detection.
This activity could indicate an attempt to remove an endpoint from security monitoring or management, potentially by an insider threat or an attacker attempting to evade detection.
Detects when an Okta application Sign-on Policy is modified or deleted. This could indicate an adversary attempting to weaken security controls to gain unauthorized access or maintain persistence.
This rule detects when an end-user within an Okta environment reports suspicious activity associated with their account. This event indicates that a user has actively flagged an action or login as potentially unauthorized or malicious, prompting further investigation.
Detects when an API access service account is granted domain authority within Google Workspace. This action can be used by an attacker to gain persistent and elevated access to an organization's Google Workspace data and services by allowing a service account to impersonate users across the domain.
In Microsoft 365 environments, administrators and certain privileged users can access mailbox content through actions such as email preview or message download. While these capabilities are often used for legitimate purposes — such as security investigations, eDiscovery, or incident response — they also represent a potential insider threat or privacy violation risk if misused.
Unauthorized access to mailbox data can expose confidential communications, sensitive attachments, or personally identifiable information (PII). Therefore, it’s crucial to continuously monitor when administrators perform actions like:
GetMailPreviewUrl – viewing an email’s content through a preview link
DownloadEMail – exporting or downloading a full email message
If these actions are not tied to a legitimate investigation or security workflow, they could indicate abuse of administrative privileges or data exfiltration attempts.
Unauthorized access to mailbox data can expose confidential communications, sensitive attachments, or personally identifiable information (PII). Therefore, it’s crucial to continuously monitor when administrators perform actions like:
GetMailPreviewUrl – viewing an email’s content through a preview link
DownloadEMail – exporting or downloading a full email message
If these actions are not tied to a legitimate investigation or security workflow, they could indicate abuse of administrative privileges or data exfiltration attempts.
Detects a high volume of emails being moved to the 'Deleted Items' folder from the 'Inbox' or 'Sent Items' folders by a single user in a short timeframe. This behavior is a known tactic used by threat actors, such as the 'Jingle Thief' group (CL-CRI-1032/Atlas Lion), to hide malicious activities like internal phishing by deleting the sent messages and any replies.
Detects when an Azure Blob Storage container's access level is changed to allow public access, or when a long-lived, highly privileged Shared Access Signature (SAS) token is created. Threat actors can use these methods for persistence and data exfiltration.
KQL Query from file: Detecting Threat Actor Storm-2657
This rule detects activities performed by the AWS root account. The root account has unrestricted access to all resources in an AWS account, making its usage a critical security event that often indicates a potential compromise, misconfiguration, or a highly privileged operation that should be closely monitored. The rule specifically looks for events where the 'userIdentity.type' is 'Root' and excludes 'AwsServiceEvent' to filter out automated AWS service activities that might legitimately use root permissions internally.
Detects the registration of a new device or MFA authentication method in Microsoft Entra ID from an IP address geolocated to Morocco or associated with specific Moroccan ASNs. This is a persistence tactic used by the Jingle Thief group (also tracked as Atlas Lion and STORM-0539).
This rule detects when a user successfully elevates their permissions to manage all Azure Subscriptions. This action grants broad access across the Azure environment and should be immediately investigated if it is not a planned administrative activity. Such an elevation could be leveraged by an attacker to gain extensive control over Azure resources.
This rule detects modifications to Active Directory user accounts that could enable an attacker to control another user's or computer's account without needing their credentials. Specifically, it looks for changes to attributes related to delegation, such as 'msDS-AllowedToDelegateTo' and 'msDS-AllowedToActOnBehalfOfOtherIdentity', or the 'servicePrincipalName' attribute for user objects, which can be abused for Kerberoasting or other delegation attacks. Event ID 4738 indicates a user account was changed, and Event ID 5136 indicates a directory service object was modified.
This rule detects attempts to read or retrieve BitLocker recovery keys from Azure audit logs. This activity can be indicative of an attacker attempting to gain access to encrypted data on compromised devices or to bypass disk encryption for persistence or defense evasion.
Page 105 of 143