Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,004 detections
Filters
Last updated
All Time
Detection languages
1,442
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,417
11,806
5,870
5,145
4,864
3,004
Platforms
1,199
673
623
512
218
Products / Services
880
726
311
257
229
MITRE Techniques
1,661
1,109
905
468
464
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
Identifies when an account hasn't signed in during the past n number of days.
Identifies when a privilege role assignment has taken place outside of PIM and may indicate an attack.
Identifies when the same privilege role has multiple activations by the same user.
Identifies when a privilege role can be activated without performing mfa.
Identifies when a user has been assigned a privilege role and are not using that role.
Cisco Clear Logs
Sigma
Clear command history in network OS which is used for defense evasion
Cisco File Deletion
Sigma
See what files are being deleted from flash file systems
Detects removal of an exported Exchange mailbox which could be to cover tracks from ProxyShell exploit
Detects modifications to Default Domain or Default Domain Controllers Group Policy Objects (GPOs).
Adversaries may modify these default GPOs to deploy malicious configurations across the domain.
Adversaries may modify these default GPOs to deploy malicious configurations across the domain.
An attacker can use the SID history attribute to gain additional privileges.
KQL Query from file: Admin consent for M365 Connector for Claude
Detects when a new admin role assignment is created. Which could be a sign of privilege escalation or persistence
Detects when an Network Zone is Deactivated or Deleted.
This rule detects the presence of newly exposed risky web components, such as administrative panels or development tools, that have been discovered by Microsoft Defender External Attack Surface Management (EASM). The rule identifies components from a predefined list of 'risky_components' that have been seen for the first time within the last 7 days, indicating a recent exposure that could increase the attack surface.
KQL Query
Detects unauthorized modifications to the SAP Security Audit Log configuration by monitoring specific SAP system message codes (AUE, AUF, AUI, AUJ, FU0, E05) associated with audit trail changes, excluding known administrative accounts.
Detects early-stage collection and reconnaissance activities targeting sensitive email data prior to exfiltration via Exchange cmdlets. This rule identifies the use of 'New-MailboxSearch' and 'Get-Recipient' cmdlets, which can be leveraged by adversaries to discover and collect email-related information. Detection covers both endpoint PowerShell execution and cloud audit logs for Microsoft Exchange Online.
This rule monitors SAP environments by correlating Change Documents (PFCG) with Security Audit logs to detect when a high-privilege role is assigned to a user. It specifically looks for additions to the AGR_USERS table and correlates this activity with security audit events to attribute the action to a specific source IP and user.
Detects administrative user management (Create/Alter/Drop) and schema deletion within SAP HANA DB.
Detects the modification of sensitive authorization objects (CD1251) within a role. This identifies potential 'backdoor' privilege escalation where a standard role is granted administrative powers (e.g., Debugging or System Table access) via PFCG.
Detects the assignment of administrative privileges or roles within SAP HANA DB.
Page 96 of 144