Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,004 detections
Filters
Last updated
All Time
Detection languages
1,442
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,417
11,806
5,870
5,145
4,864
3,004
Platforms
1,199
673
623
512
218
Products / Services
880
726
311
257
229
MITRE Techniques
1,661
1,109
905
468
464
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
Detects when Okta identifies new activity in the Admin Console.
Detects the addition of a new module to an IIS server.
Detects when an access level is changed for a Google workspace application.
An access level is part of BeyondCorp Enterprise which is Google Workspace's way of enforcing Zero Trust model.
An adversary would be able to remove access levels to gain easier access to Google workspace resources.
An access level is part of BeyondCorp Enterprise which is Google Workspace's way of enforcing Zero Trust model.
An adversary would be able to remove access levels to gain easier access to Google workspace resources.
Detects when multi-factor authentication (MFA) is disabled.
Detects when an a role privilege is deleted in Google Workspace.
Detects when an Google Workspace user is granted admin privileges.
Detects Bitbucket global SSH access configuration changes.
Detects when a secret scanning allowlist rule is added for projects.
Detects when a user creates action secret for the organization, environment, codespaces or repository.
Detects when a PIM elevation is approved or denied. Outside of normal operations should be investigated.
Show when private keys are being exported from the device, or when new certificates are installed
Turn off logging locally or remote
Detects changes to of the IIS server configuration in order to disable/remove the ETW logging/processing option.
Detects the creation or removal of a computer. Can be used to detect attacks such as DCShadow via the creation of a new SPN.
Detects when an API access service account is granted domain authority.
Detects the creation or modification of Exchange Online inbox rules, transport rules, or mailbox settings where the rule name consists exclusively of special characters. This pattern can be indicative of malicious activity, such as an attacker attempting to hide a forwarding rule or other automated action by using an obscure name.
Detects when a GitHub repository is archived or unarchived, which may indicate unauthorized changes to repository status.
A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com.
This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected,
it should be validated from GitHub UI because the log entry may not provide full context.
This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected,
it should be validated from GitHub UI because the log entry may not provide full context.
Detects when changes are made to the SSH certificate configuration of the organization.
Detects when a configuration change is made to an applications AppID URI.
Detects when changes are made to PIM roles
Page 95 of 144