Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
507 detections
Filters
Last updated
All Time
Detection languages
247
92
78
48
19
Contributors
141
113
53
46
41
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
210
138
110
82
78
Products / Services
147
74
62
41
28
MITRE Techniques
243
128
69
68
55
CVEs
10
9
5
5
5
IDS Classtypes
4
IDS Protocols
4
This rule detects when a permission on a pre-defined watchlist is applied to an Entra ID application. It specifically looks for 'Update application.' events in Office 365 logs where the 'NewValue_EntitlementId-' or 'OldValue_EntitlementId-' labels indicate a change in application permissions. The rule leverages a watchlist named 'msgraph_watchlist_permissions' to identify sensitive or suspicious permission changes.
Detects when an excessive number of permissions are assigned to an Entra ID application within a short time window, calculated as a percentage increase from existing permissions. This could indicate a "greedy permission grab" by an attacker attempting to escalate privileges or gain broader access within the Entra ID environment. The rule specifically looks for updates to application permissions where the percentage increase of new permissions over old permissions exceeds a 70% threshold.
Detects when an excessive number of permissions are assigned to an Entra ID application within a time window, potentially indicating a greedy permission grab, as a numeric value comparing old permissions to new permissions
Identifies when Google Workspace password policy is changed. Security teams can monitor for changes to password policy configuration that may weaken the organization's security posture.
Detects when a CloudWatch log group is deleted.
Detects when an excessive number of permissions are assigned to an Entra ID application within a time window, potentially indicating a greedy permission grab, as a percentage from old permissions to new permissions
Identifies when a Marketplace app is added in a Google Workspace organization. Installing certain apps may increase the organization's risk of data exfiltration/leakage and increase its attack surface.
Identifies when the Google Workspace Marketplace allowlist is configured to allow users to install and run any apps from the Marketplace. Allowing users to install and run any apps may increase the organization's risk of data exfiltration/leakage and increase its attack surface.
Identifies SAML provider configuration changes in Google Workspace. Security teams can monitor for changes to SAML provider configuration that may weaken the organization's security posture.
Alerts when a permission on the watchlist is applied to an Entra ID application.
Identifies when a domain is added to the list of trusted domains in Google Workspace. An adversary may attempt to manipulate sharing settings for trusted domains to gain unauthorized access to sensitive files and folders within an organization.
Detects changes to the security group entries for AWS RDS databases. This can indicate a misconfiguration that potentially exposes the database to the public internet, a wider audience within the VPC, or the removal of valid rules which could impact database availability for legitimate services and users. The rule specifically looks for API calls related to authorizing, creating, deleting, or revoking database security group ingress rules.
Detects changes to the security groups associated with an Elastic Load Balancer (ELB) or Application Load Balancer (ALB). This can indicate that a misconfiguration allowing more traffic into the system than required, or could indicate that an attacker is attempting to enable new connections into a VPC or subnet controlled by the account.
Detects when the MSSQL "xp_cmdshell" stored procedure setting is changed. This change is often a precursor to adversaries executing operating system commands via SQL Server.
Detects when a new owner is added to an application in Azure AD. This action grants the newly added account privileges to modify and configure the application, which could be abused by an attacker to maintain persistence, elevate privileges, or access sensitive data.
Identifies when an EKS cluster is created or deleted.
Identifies when a key vault is modified or deleted.
Detects when administrator grants either application permissions (app roles) or highly privileged delegated permissions
Detects changes to the security group entries for RDS databases.
This can indicate that a misconfiguration has occurred which potentially exposes the database to the public internet, a wider audience within the VPC or that removal of valid rules has occurred which could impact the availability of the database to legitimate services and users.
This can indicate that a misconfiguration has occurred which potentially exposes the database to the public internet, a wider audience within the VPC or that removal of valid rules has occurred which could impact the availability of the database to legitimate services and users.
Detects the change of database master password. It may be a part of data exfiltration.
Detects when a new owner is added to an application. This gives that account privileges to make modifications and configuration changes to the application.
Page 24 of 25