Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,004 detections
Filters
Last updated
All Time
Detection languages
1,442
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,417
11,806
5,870
5,145
4,864
3,004
Platforms
1,199
673
623
512
218
Products / Services
880
726
311
257
229
MITRE Techniques
1,661
1,109
905
468
464
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
Detects the creation or modification of Exchange inbox rules used by Kali365 designed to suppress security alerts by moving, deleting, or marking as read emails containing specific keywords. This technique is often used by adversaries to hide their activities or prevent detection.
This rule detects suspicious GitHub workflow modifications or pushes originating from multiple distinct IP addresses within a short time frame (1 hour). It specifically looks for 'WorkflowCreated', 'WorkflowUpdated', or 'Push' actions on GitHub, and triggers if more than one such event and more than one distinct IP address are observed for a given account within an hour. This could indicate compromised credentials or unauthorized access to a GitHub account being used to manipulate CI/CD pipelines.
Identifies bursts or requests to high-value Microsoft Graph API discovery endpoints. Tycoon 2FA operators frequently perform automated burst reconnaissance against these endpoints post-compromise to map out roles, tenant relationships, mailbox settings, and contacts.
This rule detects attempts to grant consent to OAuth applications, which could indicate an illicit consent grant attack. It specifically looks for successful operations related to consenting to applications, adding app role assignments to service principals, adding delegated permission grants, or adding OAuth2PermissionGrants within audit logs. The rule extracts details such as the target application, the user who consented, their initiating IP address, and the permissions granted.
This rule detects attempts to create a new local user account on a system via a remote Server Message Block (SMB) connection. It specifically looks for the string "NetUserAdd" (case-insensitive) within TCP traffic destined for port 445, which is commonly used by SMB. This activity is indicative of an attacker attempting to establish persistence or gain further access by creating new accounts.
This rule detects the creation of a cluster role binding in a Kubernetes environment, specifically looking for HTTP POST requests to the Kubernetes API server's rbac.authorization.k8s.io endpoint for 'rolebindings'. This activity can indicate an attempt to establish persistence within the cluster by granting specific permissions to an identity.
This rule detects when an AWS IAM user policy is attached, specifically looking for the 'AttachUserPolicy' action on 'iam.amazonaws.com'. This could indicate an attempt to escalate privileges or grant new permissions to a compromised account.
This rule detects when a credential (password) is added to an Azure Service Principal. This activity is identified by monitoring HTTP traffic for requests to 'graph.microsoft.com' containing 'addPassword' in the URI. This could indicate an attacker establishing persistence by adding new credentials to an existing service principal.
This rule detects attempts to disable Conditional Access Policies in Microsoft 365 via the Microsoft Graph API. It specifically looks for HTTP PATCH requests to 'graph.microsoft.com' targeting the 'conditionalAccess/policies' endpoint. Such activity could indicate an attacker attempting to bypass security controls for persistence or privilege escalation.
This rule detects attempts to modify or delete Multi-Factor Authentication (MFA) provider configurations via the Microsoft Graph API. Specifically, it looks for HTTP DELETE requests to 'graph.microsoft.com' with a URI containing 'authentication'. This activity could indicate an attacker attempting to disable or alter MFA settings to gain unauthorized access or maintain persistence.
This rule detects attempts to perform a mass device wipe or deletion using Microsoft Intune. It identifies devices that have been wiped or deleted within the last 24 hours and enriches this information with device details such as name, user, OS, and ownership. This can indicate a destructive attack or an attempt to remove evidence.
This rule detects when a user adds mailbox permissions to three or more mailboxes within a one-hour window in Exchange Online. This behavior can indicate an adversary attempting to gain persistent access to multiple mailboxes, often for data exfiltration or further compromise.
This rule detects suspicious activity involving API key rotation followed by high usage. It correlates audit logs for API key operations (rotate, update, create) with cloud application events showing API requests or token usage. Specifically, it looks for instances where an API key is rotated, updated, or created, and then subsequently used more than 50 times within a day by the same actor. This could indicate an adversary gaining access to an API key and then rapidly utilizing it for malicious purposes.
This rule detects suspicious device enrollment attempts via Microsoft Intune Company Portal from a country not previously observed in a user's 7-day sign-in history. It identifies two primary patterns: sustained successful sign-ins from a new country, indicating a potential active session and successful device enrollment (High Severity), or Conditional Access Policy (CAP) blocked attempts from a new country, suggesting an attacker probing with stolen credentials (Medium Severity). The detection aims to identify identity theft leading to unauthorized device enrollment.
This rule detects Wake-on-LAN (WoL) magic packets. WoL is a network standard that allows a computer to be turned on or woken up by a network message. While legitimate, adversaries can use WoL to activate compromised systems (implants) for command and control or other malicious activities, especially if the system was previously shut down to evade detection.
Remote AT Scheduled Job Creation
Suricata
This rule detects attempts to create scheduled jobs remotely using the 'atsvc' service, typically associated with the Windows Task Scheduler. It specifically looks for TCP traffic on port 445 (SMB) containing the string 'atsvc' in an established flow to the home network. This activity can be indicative of an adversary establishing persistence or executing code remotely.
This rule detects attempts to modify user accounts via LDAP. It specifically looks for TCP traffic on port 389 (LDAP) containing the hexadecimal representation of '0' (likely part of an LDAP message structure) and the case-insensitive string 'modify'. A threshold of 5 such events within 60 seconds from the same source IP triggers the alert, indicating potential malicious activity related to account manipulation.
Detects the creation of email forwarding rules in Google Workspace that direct emails to external domains. This activity can indicate potential Business Email Compromise (BEC) for persistence or insider data exfiltration.
Detects suspicious activity involving multiple password resets for different users initiated by a single user within a one-hour timeframe in Azure AD. This could indicate an attacker attempting to gain control over multiple accounts.
This rule detects when an 'Agent ID Administrator' role adds an owner to a service principal in Azure Active Directory. This activity could indicate an attempt to escalate privileges or maintain persistence within the Azure environment by granting control over service principals to potentially unauthorized entities.
Flags Intune assignments to “All Devices” or “All Users,” which attackers may abuse for mass deployment.
Page 91 of 144