Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,004 detections
Filters
Last updated
All Time
Detection languages
1,442
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,417
11,806
5,870
5,145
4,864
3,004
Platforms
1,199
673
623
512
218
Products / Services
880
726
311
257
229
MITRE Techniques
1,661
1,109
905
468
464
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
This rule detects HTTP POST requests to graph.microsoft.com with the URI containing 'roleAssignmentScheduleRequests'. This pattern is indicative of an Azure PIM (Privileged Identity Management) Just-in-Time role activation request, which is a mechanism for users to temporarily elevate their privileges within Azure AD. While a legitimate administrative action, it can also be used by attackers for privilege escalation.
This rule detects attempts to modify domain trust relationships via LDAP write operations. It specifically looks for TCP traffic on port 389 (LDAP) to the home network, containing the case-insensitive strings "trustType" and "trustDirection". This activity could indicate an attacker attempting to establish or alter trust relationships between domains for privilege escalation or lateral movement.
This rule detects attempts to register a new OAuth application within Azure Active Directory by monitoring HTTP POST requests to the Microsoft Graph API endpoint '/applications' on 'graph.microsoft.com'. This activity can be indicative of an attacker establishing persistence or gaining unauthorized access to cloud resources by creating a malicious application.
This rule detects when Azure Monitor Diagnostic Settings are deleted. It specifically looks for HTTP DELETE requests to 'management.azure.com' with 'diagnosticSettings' in the URI. This activity could indicate an attacker attempting to evade detection by removing logging configurations.
This rule detects attempts to clear Windows network connection history remotely over SMB (port 445). It specifically looks for traffic containing the strings "NetworkList" and "delete" (case-insensitive) within TCP sessions directed to the HOME_NET on port 445. This activity could indicate an attacker attempting to remove forensic evidence of their network presence.
This rule detects the deployment of a new privileged container via the Docker API. It specifically looks for HTTP requests to the '/containers/create' endpoint with 'Privileged' in the client body, indicating an attempt to create a container with elevated privileges. This activity can be indicative of an attacker attempting to gain higher access or persistence within a compromised system by deploying a malicious container.
This rule detects an attempt to access the ESXi direct SSH shell by looking for the 'vim-cmd' string in TCP traffic directed to port 22 (SSH) on the home network. This indicates an administrative command being executed directly on an ESXi host via SSH.
This rule detects attempts to enable the ESXi Host Shell via the vCenter Web API. It specifically looks for HTTP requests to the '/api/vcenter/host' URI containing the word 'shell' in the client body, indicating a potential administrative action to enable shell access on an ESXi host.
This rule detects network traffic destined for TCP port 902 on the home network, which is commonly used for ESXi vSphere management. The rule specifically looks for established TCP connections to this port and triggers an alert if five such connections are observed from the same source within a 30-second window. This could indicate management activity or potential reconnaissance/attack against ESXi hosts.
This rule detects attempts to exploit the Zerologon (CVE-2020-1472) vulnerability, a critical privilege escalation flaw in Microsoft's Netlogon Remote Protocol. It specifically looks for network traffic on TCP port 445 (SMB) containing the 'NetrServerAuthenticate3' function call with a specific sequence of null bytes, which is indicative of an unauthenticated Netlogon session setup without signing and sealing, a key characteristic of the Zerologon exploit.
This rule detects the creation (EventID 4720) or deletion (EventID 4726) of user accounts within the Security Event logs. It summarizes these activities by the subject user name and time generated, providing an hourly count of account management actions.
This rule detects the creation (EventID 4720) or deletion (EventID 4726) of user accounts within the Security Event logs. It summarizes these activities by the subject user name and time generated, providing an hourly count of account management actions.
This rule detects a high volume of group membership changes (additions or removals) by a single user within a one-hour window. Event IDs 4728 (A member was added to a security-enabled global group), 4729 (A member was removed from a security-enabled global group), and 4730 (A member was removed from a security-enabled universal group) are monitored. A count of 5 or more such events by the same user within an hour is flagged as suspicious, potentially indicating malicious account manipulation or privilege escalation attempts.
Detects addition of email delegate permissions for mailbox access persistence
This rule detects potential abuse of Group Policy Objects (GPOs) by identifying multiple changes (3 or more) to GPO-related objects within a short timeframe. It specifically looks for Event ID 5136 (Directory Service Changes) where the ObjectClass is either 'groupPolicyContainer' or 'gPCFileSysPath'. This could indicate an adversary modifying GPOs to achieve persistence, privilege escalation, or other malicious objectives.
Detects when five or more user accounts are deleted within a one-hour period by a single user. This activity can indicate malicious intent to disrupt operations or cover tracks.
Detects when a single user principal name (UPN) performs two or more Azure AD admin role assignments within an hour. This could indicate an attempt to escalate privileges or establish persistence by assigning administrative roles to multiple accounts or to the same account multiple times.
This rule detects suspicious access patterns to Windows administrative shares (C$, D$, E$, IPC$, ADMIN$). It specifically looks for multiple access attempts (10 or more within an hour) involving read or write operations (AccessMask contains '0x0001' or '0x0002') from a single source IP address and account. This behavior can indicate lateral movement, data exfiltration, or other malicious activity.
Detects the creation or modification of inbox rules that forward or redirect emails to another recipient. This can be an indicator of an adversary attempting to exfiltrate emails or maintain persistence.
This rule identifies accounts that create or modify 10 or more files, each larger than 200MB, within a one-hour period. This behavior can be indicative of data exfiltration, staging of large files, or other suspicious bulk file operations.
This rule detects the creation of new transport rules within Exchange Online. Adversaries may create malicious transport rules to forward emails, bypass security controls, or exfiltrate data. Monitoring the creation of new transport rules can help identify suspicious activity.
Page 87 of 144