Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,000 detections
Filters
Last updated
All Time
Detection languages
1,438
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,443
11,831
5,872
5,155
4,866
3,000
Platforms
1,197
672
622
513
218
Products / Services
879
726
311
255
229
MITRE Techniques
1,659
1,107
903
465
462
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
Delete Entra ID application. This is a soft delete, can still be recovered.
Deletion of Entra ID application with no recovery of the application.
Entra ID application was restored. This implies a soft delete was performed at some point but less than 30 days ago.
Adding permissions to an application is expected, however if excessive permissions are changed at one time over a defined threshold, it may be worth validating.
Detects when a group is deleted.
Identify the use of the application API call to collect a listing of applications in Entra ID. This can be chatty due to other commands calling this single API.
Identify a 400 bad request to the groups endpoint in the MS Graph API. GraphRunner's Invoke-SecurityGroupCloner function will trigger this if it fails to duplicate a group.
Identify a successful group creation. Triggered through the use of GraphRunner's Invoke-SecurityGroupCloner function.
Identify enumeration of inboxes across the Entra ID tenant. This detection is based on the Invoke-GraphOpenInboxFinder in GraphRunner but the concepts are applicable to other tools that scan for accessible inboxes.
Identify the enumeration of both the users and members of groups in the Entra ID tenant. While these are two separate functions in GraphRunner, they are often run in support of one another.
Detects when a group is deleted.
This rule identifies changes to SAML (Security Assertion Markup Language) provider configurations within Google Workspace. Monitoring these changes is crucial for security teams as modifications to SAML configurations can potentially weaken an organization's security posture, leading to unauthorized access or other security incidents. The rule specifically looks for events categorized as 'SAML2_SERVICE_PROVIDER_CONFIG_SETTINGS' or with product event types matching 'SAML2_SERVICE_PROVIDER_CONFIG'.
This rule detects when highly privileged administrative roles, specifically 'Owner' or 'Editor', are assigned to a service account within Google Cloud Platform. This activity is significant because service accounts with such elevated permissions can be leveraged by attackers for persistence, privilege escalation, and to perform a wide range of actions within the GCP environment, potentially leading to compromise of cloud resources.
This rule identifies when a new domain is added to the list of trusted domains within Google Workspace. An adversary might leverage this capability to establish trusted relationships, potentially manipulating sharing settings to gain unauthorized access to sensitive organizational files and folders.
This rule detects when multiple HMAC (Hash-based Message Authentication Code) authentication keys are deleted from Google Cloud Storage settings within a one-hour window by the same user. HMAC keys are used for programmatic access to Cloud Storage, and their deletion can indicate an attempt to disrupt legitimate access, cover tracks, or impact service availability.
This rule detects when a single user generates an excessive number of 'Permission Denied' events within a one-hour timeframe in Google Cloud Platform (GCP). Specifically, it looks for more than 5 'BLOCK' actions with a severity of 'ERROR' and a status code of '7' (which typically indicates 'Permission Denied' in GCP API errors) from a single user. Additionally, it requires these events to span across more than one target application and more than one product event type, which helps to reduce false positives by indicating broader activity rather than a single, isolated error.
Detects when a user deletes multiple secrets or secret versions from Google Cloud Platform (GCP) Secret Manager within a one-hour period. This activity could indicate an attempt to destroy critical data or disrupt services.
This rule detects when an AWS Config Service is modified, stopped, or deleted. Specifically, it looks for CloudTrail events indicating actions such as stopping or deleting a configuration recorder, deleting a delivery channel, or putting (creating/updating) a delivery channel or configuration recorder. These actions can be indicative of an adversary attempting to impair defenses by disabling or modifying cloud logging capabilities.
This rule identifies when a custom administrator role is created within Google Workspace. Monitoring such events is crucial for security teams to detect and prevent unauthorized access to data that could result from malicious or accidental configuration of administrator privileges.
This rule detects when an AWS account attempts to leave an AWS organization or is removed from an AWS organization. This activity can indicate an adversary attempting to evade detection or disrupt cloud infrastructure by isolating an account from central management and security policies.
This rule identifies when a new application from the Google Workspace Marketplace is added to a Google Workspace organization. Installing certain third-party applications can introduce security risks such as data exfiltration, data leakage, or an expanded attack surface for the organization.
Page 136 of 143