Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,000 detections
Filters
Last updated
All Time
Detection languages
1,438
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,443
11,831
5,872
5,155
4,866
3,000
Platforms
1,197
672
622
513
218
Products / Services
879
726
311
255
229
MITRE Techniques
1,659
1,107
903
465
462
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
This rule identifies when an Azure Firewall resource is created, modified, or deleted within an Azure subscription. This activity is captured through Azure Activity Logs, specifically looking for 'MICROSOFT.NETWORK/AZUREFIREWALLS/WRITE' (for creation/modification) and 'MICROSOFT.NETWORK/AZUREFIREWALLS/DELETE' operations. Such changes can indicate legitimate administrative actions or potentially malicious attempts to alter network defenses.
This rule detects activity related to AzureHound, a BloodHound data collector specifically designed for Microsoft Azure environments. It identifies AzureHound's presence by looking for its default 'User-Agent' string in Azure sign-in logs after a successful authentication (ResultType: 0). This indicates that an authenticated user or service principal is using AzureHound to enumerate Azure resources, which is often a precursor to further reconnaissance or privilege escalation within a cloud environment.
Detects the creation or update of Active Directory Certificate Services (AD CS) certificate templates that are configured with risky Extended Key Usages (EKUs) and allow the enrollee to supply the subject. This combination can be exploited for privilege escalation and credential access, as described in the 'Certified Pre-Owned' whitepaper, by allowing an attacker to request certificates with arbitrary subject names, potentially impersonating privileged accounts.
This rule detects when a user performs an eDiscovery search or exports a PST file from such a search within Microsoft 365. PST files often contain sensitive information, including email body content, making this activity a potential indicator of data exfiltration or unauthorized access to sensitive communications.
Detects read access to a domain user object from a non-machine account, which can indicate user enumeration activity within Active Directory. The rule specifically looks for Event ID 4662 (An operation was performed on an object) where the ObjectType corresponds to a user object and the AccessMask includes read property permissions. It filters out activity from machine accounts and specific Microsoft Online (MSOL) accounts to reduce false positives.
Detects when a role privilege is deleted in Google Workspace. This could indicate an attempt to remove or modify administrative access, potentially as part of a privilege de-escalation by an attacker to avoid detection, or to clean up after an attack.
Detects when an application is removed from Google Workspace, which could indicate an attempt to disrupt services or remove security controls. This includes both direct application removal and removal from a whitelist.
This rule identifies when a VPN Tunnel is modified or deleted within Google Cloud Platform. Adversaries may modify or delete VPN tunnels to disrupt network connectivity, reroute traffic, or hinder defensive efforts, impacting the availability or integrity of services.
This rule identifies when an owner is removed from an application or service principal within Azure Active Directory. This activity could indicate an attempt to remove legitimate administrative access or to obscure malicious activity by removing an owner who might detect it.
Detects when an end user's consent to an application is blocked by Azure AD due to risk-based consent policies. This indicates that Azure AD has identified a risky application or a risky consent request, preventing the user from granting permissions to it. This can be a proactive measure against consent phishing or malicious applications attempting to gain access to user data.
This rule identifies when an Azure Application Gateway is either modified or deleted. This activity is captured through Azure Activity Logs by monitoring specific operation names related to Application Gateway write (modification) and delete operations. Detection of these events can indicate administrative changes to the network infrastructure, which could be legitimate or potentially malicious if unauthorized.
This rule identifies when a device registered in Azure Active Directory (now Microsoft Entra ID) transitions to a state where it is no longer considered managed or compliant. This could indicate a change in device policy, a device being unenrolled, or a security posture degradation.
Detects when a role is modified or deleted in Google Workspace. This could indicate an attacker attempting to escalate privileges, maintain persistence, or disrupt services by altering administrative roles.
Detects the creation, modification, or deletion of Kubernetes RoleBindings and ClusterRoleBindings in Google Cloud. These actions can indicate an adversary attempting to escalate privileges or maintain persistence within a Kubernetes cluster by granting themselves or other accounts additional roles and permissions.
This rule identifies when an Azure Key Vault is modified or deleted. Key Vaults store sensitive information such as cryptographic keys, certificates, and secrets. Unauthorized modification or deletion of a Key Vault could indicate an attacker attempting to disrupt services, remove evidence, or gain access to sensitive credentials. The rule specifically looks for operations related to writing, deleting, deploying, or modifying access policies of Key Vaults.
This rule identifies when an Azure VPN connection is either modified or deleted. This activity is captured through Azure Activity Logs, specifically looking for 'MICROSOFT.NETWORK/VPNGATEWAYS/VPNCONNECTIONS/WRITE' (modification) or 'MICROSOFT.NETWORK/VPNGATEWAYS/VPNCONNECTIONS/DELETE' (deletion) operations. Such actions can indicate an attempt to disrupt network connectivity or reconfigure access to cloud resources, potentially as part of an impact-oriented attack or unauthorized access.
Detects the addition of a new Federated Domain in Microsoft Exchange. This event can be indicative of credential abuse or the establishment of a backdoor via federated identities, potentially in the context of a Golden SAML attack.
This rule detects when the master password for an AWS RDS database instance is changed. This activity could be a precursor to data exfiltration or an attempt to gain unauthorized access to the database. The rule specifically looks for the 'ModifyDBInstance' event from 'rds.amazonaws.com' where the 'masterUserPassword' in 'pendingModifiedValues' is present, indicating a password change.
This detection identifies the creation or update of a server instance within an Azure AD Hybrid Health AD FS service using Azure Activity logs. An adversary might perform this action to create a new AD Health ADFS service and a fake server instance to spoof AD FS signing logs, potentially bypassing the need to compromise an on-premises AD FS server. This can be achieved programmatically via HTTP requests to Azure.
Identifies when a service principal was removed in Azure. This action could indicate an attempt to remove legitimate service accounts to hinder detection or to clean up after malicious activity.
This rule detects commands executed on Cisco network devices related to the export of private keys or the import/management of PKI certificates. Specifically, it looks for the commands 'crypto pki export', 'crypto pki import', and 'crypto pki trustpoint'. These actions can indicate an attempt to exfiltrate sensitive cryptographic material (private keys) or to establish new trusted certificates, which could be used for defense evasion or to facilitate man-in-the-middle attacks.
Page 140 of 143