Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,004 detections
Filters
Last updated
All Time
Detection languages
1,442
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,417
11,806
5,870
5,145
4,864
3,004
Platforms
1,199
673
623
512
218
Products / Services
880
726
311
257
229
MITRE Techniques
1,661
1,109
905
468
464
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
This rule detects suspicious sign-in activity for a specific user principal name (UPN) within the last 7 days, immediately preceding a device wipe event. It focuses on identifying the actor's initial access or activity before initiating a mass device wipe.
Detects the creation or modification of Power Automate flows that connect to external services commonly used for data exfiltration or command and control, such as webhooks, Gmail, Dropbox, Google Drive, Slack, RSS feeds, custom connectors, or generic HTTP requests/webhooks. This could indicate an adversary attempting to establish persistence or exfiltrate data from the Power Platform environment.
This rule detects attempts to stop or disable critical system services and security mechanisms on Linux systems,.Adversaries may attempt to disable these services to impair defenses, remove logging capabilities, or bypass security controls.
Detects the creation of new connectors in Power Automate (formerly Microsoft Flow) that establish connections to external services. This activity is identified by monitoring 'PutConnection' operations within PowerPlatform or MicrosoftFlow audit logs. Such an event could indicate an adversary attempting to integrate malicious services or exfiltrate data.
Detects suspicious modifications to Power Automate flow permissions, including sharing flows or changing role assignments. This could indicate a compromised account attempting to gain unauthorized access or persistence within the Power Platform environment.
Detects the removal of system firewall rules. Adversaries may only delete or modify a specific system firewall rule to bypass controls limiting network usage or access.
Detection rules that match only on the disabling of firewalls will miss this.
Detection rules that match only on the disabling of firewalls will miss this.
KQL Query from file: Detection for ShadowHound
Detects if the push protection feature is disabled for an organization, enterprise, repositories or custom pattern rules.
Identifies when a firewall is created, modified, or deleted.
Detects when an a role is modified or deleted in Google Workspace.
Detects the creation or modification of inbox rules that move messages to rarely checked folders like Archive, RSS Subscriptions, Conversation History, Junk Email, or Deleted Items. This is a common post-exploitation technique used to hide fraudulent communications (BEC, payroll fraud) or suppress security alerts, MFA notifications, and password reset emails from the victim. Approximately 10% of compromised accounts have malicious mailbox rules created shortly after initial access.
This rule analyzes historical logon, process, and network activity for a specified device over a configurable lookback period. It aims to validate whether a device, potentially flagged as decommissioned or stale, exhibits a pattern of sporadic, legitimate use (e.g., executive laptops, break-glass machines) rather than continuous or unauthorized activity. The output provides a daily timeline of activity, helping to differentiate between truly dormant assets and those with intermittent, legitimate usage.
Detects Bitbucket global secret scanning rule deletion activity.
Detects if the secret scanning feature is disabled for an enterprise or repository.
AWS Root Credentials
Sigma
Detects AWS root account usage
Detects when a firewall rule is modified or deleted in Google Cloud Platform (GCP).
Cisco Dot1x Disabled
Sigma
Detects the manual disablement of IEEE 802.1X (dot1x) on a Cisco network device interface.
Disabling dot1x bypasses Network Access Control (NAC) mechanisms, potentially allowing unauthorized devices to gain access to the internal network.
This activity is a common technique used by attackers or malicious insiders to establish persistence or perform lateral movement via rogue devices.
Disabling dot1x bypasses Network Access Control (NAC) mechanisms, potentially allowing unauthorized devices to gain access to the internal network.
This activity is a common technique used by attackers or malicious insiders to establish persistence or perform lateral movement via rogue devices.
Detects when an attacker calls the "ALTER SERVER AUDIT" or "DROP SERVER AUDIT" transaction in order to delete or disable audit logs on the server
Detects when an an application is removed from Google Workspace.
Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities.
Upon deletion, GuardDuty stops monitoring the environment and all existing findings are lost.
Verify with the user identity that this activity is legitimate.
Upon deletion, GuardDuty stops monitoring the environment and all existing findings are lost.
Verify with the user identity that this activity is legitimate.
Identifies an event where there are there are too many accounts assigned the Global Administrator role.
Page 94 of 144