Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
507 detections
Filters
Last updated
All Time
Detection languages
247
92
78
48
19
Contributors
141
113
53
46
41
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
210
138
110
82
78
Products / Services
147
74
62
41
28
MITRE Techniques
243
128
69
68
55
CVEs
10
9
5
5
5
IDS Classtypes
4
IDS Protocols
4
Detects unauthorized modifications to the SAP Security Audit Log configuration by monitoring specific SAP system message codes (AUE, AUF, AUI, AUJ, FU0, E05) associated with audit trail changes, excluding known administrative accounts.
Detects the modification of sensitive authorization objects (CD1251) within a role. This identifies potential 'backdoor' privilege escalation where a standard role is granted administrative powers (e.g., Debugging or System Table access) via PFCG.
Detects unauthorized or suspicious modifications to authorization objects (via PFCG transaction) within SAP environments, specifically targeting sensitive roles. The rule correlates these changes with SAP security audit logs to identify the user's session context and ensure the action was performed by someone not listed as an authorized SAP administrator.
Detects changes to either Global System Changeability (EU1) or Client-Specific Configuration (EU2/SCC4).
Azure Suspicious Redirect URI Detection
Cortex XDR
This rule detects the modification or addition of redirect URIs for Azure Active Directory applications or service principals that point to suspicious domains. These suspicious domains include known reverse proxy/tunneling services (e.g., ngrok, cloudflare tunnel), callback infrastructure (e.g., burpcollaborator, interact.sh), or localhost/loopback addresses. Such modifications can indicate an adversary attempting to establish persistence, exfiltrate data, or redirect authentication flows to attacker-controlled infrastructure.
This alert identifies a potential bypass of repository governance controls. It triggers when a GitHub repository's default branch is changed and then reverted or updated again within a 24-hour window. By temporarily changing the default branch to an unprotected branch, an actor can push code or merge pull requests to the primary branch (e.g., main) without satisfying mandatory status checks or peer review requirements.
Detects the addition of firewall address objects on a Fortinet FortiGate Firewall. This activity could indicate an adversary attempting to modify network access controls to facilitate command and control, data exfiltration, or to bypass existing security policies.
Detects changes to the Bitbucket audit log configuration. This could indicate an adversary attempting to disable or modify logging to evade detection.
This rule detects when an application within the Okta environment is either modified or deleted. This activity can indicate administrative changes, potential misconfigurations, or malicious activity aimed at disrupting services or altering access controls.
Detects when an Okta application Sign-on Policy is modified or deleted. This could indicate an adversary attempting to weaken security controls to gain unauthorized access or maintain persistence.
Detects when new credentials (certificates or secrets) are added to an existing application or service principal within Azure/Entra ID. This activity, if not part of expected workflows, could indicate a malicious actor establishing persistence or escalating privileges by adding their own credentials to an application.
This rule detects modifications to Cisco device configurations that could be used by an adversary for persistence, privilege escalation, or to impact system availability. Specifically, it looks for commands related to enabling HTTP/HTTPS servers, configuring Kron jobs (scheduled tasks), modifying access lists, archiving configurations, and setting NTP servers. These commands, if used maliciously, can allow an attacker to maintain access, execute arbitrary commands, control network access, or disrupt time synchronization.
Detects when a configuration change is made to an application's AppID URI in Azure Active Directory (now Microsoft Entra ID). This change can be indicative of an adversary attempting to modify an application's identity to facilitate malicious activities such as phishing, unauthorized access, or maintaining persistence.
This rule detects changes to an application's Uniform Resource Identifier (URI) configuration within Azure. Such changes can include modifications to domain names, protocol usage (e.g., switching from HTTPS), the introduction of wildcards, or URIs pointing to uncontrolled domains. These types of modifications can be indicative of an attacker attempting to redirect traffic, establish persistence, or facilitate other malicious activities by altering how an application is accessed or interacts with external resources.
Dependabot performs a scan to detect insecure dependencies, and sends Dependabot alerts.
This rule detects when an organization owner disables Dependabot alerts private repositories or Dependabot security updates for all repositories.
This rule detects when an organization owner disables Dependabot alerts private repositories or Dependabot security updates for all repositories.
Detects changes to payment or bank account information in Workday. This activity is associated with 'payroll pirate' attacks by threat actor Storm-2657, who modify payroll details to divert salary payments after compromising an account.
Detects the addition of a new module to an IIS server. Adversaries may install malicious IIS modules to observe and/or modify traffic, execute commands on compromised machines, or proxy command and control traffic. This can be used to establish persistence or for defense evasion.
Detects changes to the IIS server configuration to disable HTTP logging for successful requests. This can be an indicator of an adversary attempting to hide their activity on a compromised web server.
Detects changes to the IIS server configuration to disable or remove the ETW (Event Tracing for Windows) logging/processing option. This could indicate an adversary attempting to evade detection by reducing the logging capabilities of the web server.
This detection identifies when the xp_cmdshell configuration is modified in SQL Server. The xp_cmdshell extended stored procedure allows execution of operating system commands and programs from SQL Server, making it a high-risk feature commonly abused by attackers for privilege escalation and lateral movement.
The following analytic detects the addition of new IIS modules on a Windows IIS server. It leverages the Windows Event log - Microsoft-IIS-Configuration/Operational, specifically EventCode 29, to identify this activity. This behavior is significant because IIS modules are rarely added to production servers, and unauthorized modules could indicate malicious activity. If confirmed malicious, an attacker could use these modules to execute arbitrary code, escalate privileges, or maintain persistence within the environment, potentially compromising the server and sensitive data.
Page 20 of 25