Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,000 detections
Filters
Last updated
All Time
Detection languages
1,438
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,443
11,831
5,872
5,155
4,866
3,000
Platforms
1,197
672
622
513
218
Products / Services
879
726
311
255
229
MITRE Techniques
1,659
1,107
903
465
462
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
Detects the creation, deletion, or update of AWS Glue Development Endpoints. This activity can be indicative of privilege escalation attempts or unauthorized resource manipulation within an AWS environment, as development endpoints provide an interactive environment for data processing.
This rule detects when an application is granted delegated or app role permissions within Microsoft Graph, Exchange, SharePoint, or Azure AD. This activity can indicate an adversary attempting to establish persistence or elevate privileges by giving a malicious application access to sensitive resources.
Detects when the Microsoft 365 Security Compliance Center restricts a user from sending email because they exceeded service sending limits. This could indicate a compromised account being used for spamming or other malicious activities, or a legitimate user exceeding limits due to unusual activity.
Detects attempts to modify the Discretionary Access Control List (DACL) of Active Directory objects, specifically looking for WRITE_DAC access (0x40000). This can indicate an adversary attempting to gain control over Active Directory objects, potentially for privilege escalation or persistence.
This rule detects the execution of the PowerShell cmdlet 'Remove-ADGroupMember' with parameters '-Identity' and '-Members'. This cmdlet is used to remove one or more members from an Active Directory group. In the context of this rule, it specifically targets the removal of an account from the 'Domain Admins' group, which could be an adversary's attempt to inhibit access to critical accounts or to clean up their tracks after gaining access.
Detects when an AWS ElastiCache security group has been created. This action can be used by adversaries to establish persistence or modify network access to ElastiCache resources.
This rule identifies when Azure Firewall Rule Collections (Application, NAT, and Network) are either modified or deleted. This activity can indicate an attempt to bypass network controls, potentially allowing unauthorized access or data exfiltration. Monitoring these operations is crucial for maintaining network security posture in Azure environments.
This rule identifies when an Azure Virtual Network or Virtual Network Gateway is modified or deleted. This activity is captured through Azure Activity Logs, specifically looking for 'MICROSOFT.NETWORK/VIRTUALNETWORKGATEWAYS/' or 'MICROSOFT.NETWORK/VIRTUALNETWORKS/' operations that end with '/WRITE' or '/DELETE'. Such actions can indicate unauthorized changes to network infrastructure, potentially leading to denial of service, network segmentation bypass, or other security incidents.
Identifies when a service account is disabled or deleted in Google Cloud. This activity can indicate an attempt to remove access for legitimate services or users, potentially as part of an impact or defense evasion strategy.
This rule detects attempts to modify the 'ExternalUrl' property of an Exchange OabVirtualDirectory to include script-related keywords. This activity can indicate an adversary attempting to establish persistence or execute malicious code by injecting a web shell or similar mechanism into the Exchange server's Outlook Web Access (OWA) configuration.
This rule identifies when a virtual network device in Azure, such as a network interface, network virtual appliance, virtual hub, or virtual router, is either modified or deleted. Monitoring these operations can help detect unauthorized changes or disruptions to network infrastructure.
Detects when a new owner is added to an application in Azure AD. This action grants the newly added account privileges to modify and configure the application, which could be abused by an attacker to maintain persistence, elevate privileges, or access sensitive data.
Detects when an administrator grants an application either application permissions (app roles) or highly privileged delegated permissions within an Azure environment. This action is logged in the Azure audit logs as 'Add app role assignment to service principal'. Such assignments can lead to persistence or privilege escalation if abused.
Identifies when a service account is modified, created, updated, enabled, or undeleted in Google Cloud. This rule specifically looks for API calls related to service account management, which could indicate an attacker establishing persistence, escalating privileges, or otherwise manipulating cloud resources.
Identifies when a Point-to-site VPN is Modified or Deleted in Azure. This could indicate an attacker attempting to disrupt network access or cover their tracks by removing or altering VPN configurations.
This rule identifies when a suppression rule is created in Azure. Adversaries might create suppression rules to evade detection by preventing security alerts from being generated or displayed for their malicious activities.
Detects when highly privileged delegated permissions are granted on behalf of all users in Azure Active Directory. This can indicate an attempt to gain broad access to resources by an application.
This rule detects the use of the 'Get-AdGroup' PowerShell cmdlet with the '-Filter' parameter to enumerate groups within Active Directory. This activity is often performed by attackers during the discovery phase to identify privileged groups and users.
Identifies when a application security group is modified or deleted.
Cisco Discovery
Sigma
Find information about network devices that is not stored in config files
Detect standard users login that are part of high privileged groups such as the Administrator group
Page 142 of 143