Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,000 detections
Filters
Last updated
All Time
Detection languages
1,438
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,443
11,831
5,872
5,155
4,866
3,000
Platforms
1,197
672
622
513
218
Products / Services
879
726
311
255
229
MITRE Techniques
1,659
1,107
903
465
462
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
The analytic detects the creation of a cloud compute instance in a region that has not been previously used within the last hour. It leverages cloud infrastructure logs and compares the regions of newly created instances against a lookup file of historically used regions. This activity is significant because the creation of instances in new regions can indicate unauthorized or suspicious activity, such as an attacker attempting to evade detection or establish a foothold in a less monitored area. If confirmed malicious, this could lead to unauthorized resource usage, data exfiltration, or further compromise of the cloud environment.
This query helps reviewing admin reported email submissions
The analytic identifies potential exploitation attempts on a PaperCut NG server by analyzing its debug log data. It detects unauthorized or suspicious access attempts from public IP addresses and searches for specific URIs associated with known exploits. The detection leverages regex to parse unstructured log data, focusing on admin login activities. This activity is significant as it can indicate an active exploitation attempt on the server. If confirmed malicious, attackers could gain unauthorized access, potentially leading to data breaches or further compromise of the server.
This query helps reviewing top submitters of admin submissions
Detects attempts by an identity to enumerate its Kubernetes Role-Based Access Control (RBAC) permissions. This activity is often observed in the early stages of a breach as attackers try to understand their access within a compromised Kubernetes environment. This can be achieved by querying the Kubernetes API server's SelfSubjectRulesReview API, for example, using the "kubectl auth can-i --list" command.
This rule identifies when sensitive ClusterRoles or Roles are being modified, deleted, or when their permissions are being escalated or bound in Azure Kubernetes Service (AKS). These operations can indicate an attempt to gain elevated privileges or disrupt access within the Kubernetes cluster.
This rule detects suspicious activity following a successful login to the Azure AD PowerShell application. Specifically, it looks for a user performing multiple administrative actions within a short timeframe after logging in. These actions include adding or updating applications, adding delegated permission grants, or managing certificates and secrets for applications. This behavior is indicative of an attacker attempting to establish persistence or escalate privileges within an Entra ID environment after initial access.
Detects attempts to inject a sidecar container into a running Kubernetes deployment. This is achieved by monitoring for 'patch' operations on 'deployments' resources within the 'apps' API group. An attacker might use this technique to run their code and hide activity within a legitimate pod, rather than deploying a separate, potentially more conspicuous, pod.
Detects the modification or deletion of Kubernetes RoleBindings or ClusterRoleBindings within Azure Kubernetes Service. These actions can indicate an adversary attempting to escalate privileges, maintain persistence, or disrupt services by altering access control configurations.
Detects the creation of a "privileged" container in Kubernetes. A privileged container has root capabilities on the host, allowing it to access and modify host processes, network operations, IPC calls, file system, mount points, and SELinux configurations. This action can indicate a threat actor attempting container breakout or privilege escalation. The rule specifically looks for 'create' verbs on 'pods' resources where 'capabilities' are present, which implies elevated privileges.
This rule detects when a user is added to an administrative role within Office 365. While adding users to administrative roles is not inherently malicious, it is a sensitive action that warrants validation due to the elevated privileges granted. The rule specifically looks for the 'Add member to role.' event type within Office 365 and requires the role to be present in a predefined watchlist of sensitive roles.
Detects when an Azure Kubernetes Cluster is created or deleted. This activity can indicate significant infrastructure changes, either legitimate or malicious. Monitoring these operations is crucial for maintaining the security and integrity of containerized environments.
Detects when a Kubernetes RoleBinding or ClusterRoleBinding is created, modified, or deleted. This activity can indicate privilege escalation attempts or unauthorized access within a Kubernetes cluster.
Detects when Kubernetes Secrets are created, modified, or deleted. This activity is critical to monitor as secrets often contain sensitive information like API keys, passwords, and OAuth tokens. Unauthorized modification or deletion of these secrets could lead to credential compromise, unauthorized access, or denial of service within a Kubernetes cluster.
Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.
Once a user authenticates to the Azure AD PowerShell application, if they take multiple admin actions indicative of establishing their own persistence with an Entra ID application within a portion of the access token time, alert for additional investigation
Identifies when a Azure Kubernetes network policy is modified or deleted.
Detects when an account successfully recovers a Local Administrator Password Solution (LAPS) password from Microsoft Entra ID. This activity is logged in Azure audit logs under the 'Device' category with the activity type 'Recover device local administrator password' and additional details indicating 'Successfully recovered local credential by device id'. This event can signify an attacker attempting to gain elevated privileges or maintain persistence by obtaining local administrator credentials.
Identifies when ClusterRoles/Roles are being modified or deleted.
Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.
Identifies when a service account is modified or deleted.
Page 123 of 143