Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
507 detections
Filters
Last updated
All Time
Detection languages
247
92
78
48
19
Contributors
141
113
53
46
41
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
210
138
110
82
78
Products / Services
147
74
62
41
28
MITRE Techniques
243
128
69
68
55
CVEs
10
9
5
5
5
IDS Classtypes
4
IDS Protocols
4
Detects when a user attached a Lambda layer to an existing Lambda function.
A malicious Lambda layer could execute arbitrary code in the context of the function's IAM role.
This would give an adversary access to resources that the function has access to.
A malicious Lambda layer could execute arbitrary code in the context of the function's IAM role.
This would give an adversary access to resources that the function has access to.
Secrets added to applications have legitimate purposes, but can also be a method of persistence.
Detect when the Unified Audit Log is enabled
Secrets added to applications have legitimate purposes, but can also be a method of persistence. This alert will trigger on creation, modification or delete of a client secret
This rule detects when a GitHub application is installed within an organization. The detection is based on the `integration_installation.create` event in GitHub audit logs. An untrusted application, if installed, could be granted permissions to access sensitive data within the GitHub organization, posing a security risk.
This rule detects when changes are made to a GitHub enterprise or organization's Single Sign-On (SSO) configuration. This includes disabling SAML, updating SAML provider settings, disabling OIDC, and managing credential authorizations (deauthorize, grant, revoke). Such modifications can indicate an attempt to bypass or alter security controls, potentially for unauthorized access or defense evasion.
Detects when a GitHub audit log stream is modified (e.g. paused, enabled, or disabled). An adversary may attempt to interrupt audit logging to erase their tracks.
Detects when third-party application access restrictions are disabled for a GitHub organization.
Detects when branch protection rules are disabled for a GitHub repository.
Detects when components of GitHub secret scanning is disabled for an enterprise or organization.
This rule detects when an excessive number of permissions are changed for an application within Microsoft Entra ID (formerly Azure AD). While adding permissions is a normal activity, a sudden increase in the number of permissions granted to an application, exceeding a defined threshold (currently 5), could indicate malicious activity such as an attacker attempting to escalate privileges or broaden access for a compromised application. The rule specifically looks for 'Update application' events in Azure AD Directory Audit logs where the 'RequiredResourceAccess' attribute changes significantly.
Detects when vulnerability alerts are disabled for GitHub Dependabot.
Detects when an SSH deploy key is added or modified in a GitHub repository. A compromised or unauthorized deploy key could allow malicious actors to push unauthorized changes into production environments, potentially bypassing code reviews and testing procedures. This could lead to the introduction of backdoors, malware, or the exfiltration of sensitive data.
Detects when the visibility for a GitHub repository is changed to public.
This rule detects when an application in Entra ID (formerly Azure AD) is restored. This action implies that the application was previously soft-deleted and is now being recovered. This could be an administrative action to recover a mistakenly deleted application or could indicate an attempt to restore a malicious application that was previously removed.
Adding permissions to an application is expected, however if excessive permissions are changed at one time over a defined threshold, it may be worth validating.
This rule identifies changes to SAML (Security Assertion Markup Language) provider configurations within Google Workspace. Monitoring these changes is crucial for security teams as modifications to SAML configurations can potentially weaken an organization's security posture, leading to unauthorized access or other security incidents. The rule specifically looks for events categorized as 'SAML2_SERVICE_PROVIDER_CONFIG_SETTINGS' or with product event types matching 'SAML2_SERVICE_PROVIDER_CONFIG'.
This rule identifies when a new application from the Google Workspace Marketplace is added to a Google Workspace organization. Installing certain third-party applications can introduce security risks such as data exfiltration, data leakage, or an expanded attack surface for the organization.
This rule detects when an Entra ID application has a significant increase in the number of assigned permissions within a short timeframe (5 minutes). This could indicate a "greedy permission grab" by an attacker attempting to escalate privileges or gain broader access to resources. The rule specifically looks for an increase of more than 8 permissions compared to the previous state. It does not compare the specific permissions, only the count.
This rule identifies when the Google Workspace Marketplace allowlist is configured to allow users to install and run any applications from the Marketplace. This configuration may increase an organization's risk of data exfiltration/leakage and expand its attack surface by permitting the use of potentially malicious or unapproved third-party applications.
Detects when an AWS Application Load Balancer (ALB) listener is created or modified to use an insecure SSL policy. Insecure SSL policies can expose communication to vulnerabilities such as weak ciphers or outdated TLS versions, potentially allowing attackers to decrypt sensitive data or perform downgrade attacks. The rule specifically looks for the use of several known insecure or deprecated ELBSecurityPolicy versions during 'ModifyListener' or 'CreateListener' CloudTrail events.
Page 23 of 25