Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,733 detections
Filters
Last updated
All Time
Detection languages
909
387
164
127
68
Contributors
479
417
201
177
61
Categories
20,440
11,814
5,871
5,145
4,864
1,733
Platforms
822
436
329
274
206
Products / Services
498
378
118
96
79
MITRE Techniques
433
327
225
196
196
CVEs
12
12
10
10
6
IDS Classtypes
1
1
IDS Protocols
2
Detects instances where an HTTPPROXY service on an OpenCanary node has had an attempt to proxy another page.
Detects suspicious rules that delete or move messages or folders are set on a user's inbox.
Audit CVE Event
Sigma
Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited.
MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability.
Unfortunately, that is about the only instance of CVEs being written to this log.
MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability.
Unfortunately, that is about the only instance of CVEs being written to this log.
Detects an appx package deployment / installation with the error code "0x80073cff" which indicates that the package didn't meet the signing requirements.
Detects an appx package that was added to the pipeline of the "to be processed" packages that is located in a known folder often used as a staging directory.
Detects potential installation or installation attempts of known malicious appx packages
Detects an appx package deployment that was blocked by the local computer policy.
The following events indicate that an AppX package deployment was blocked by a policy:
- Event ID 441: The package deployment operation is blocked by the "Allow deployment operations in special profiles" policy
- Event ID 442: Deployments to non-system volumes are blocked by the "Disable deployment of Windows Store apps to non-system volumes" policy."
- Event ID 453: Package blocked by a platform policy.
- Event ID 454: Package blocked by a platform policy.
The following events indicate that an AppX package deployment was blocked by a policy:
- Event ID 441: The package deployment operation is blocked by the "Allow deployment operations in special profiles" policy
- Event ID 442: Deployments to non-system volumes are blocked by the "Disable deployment of Windows Store apps to non-system volumes" policy."
- Event ID 453: Package blocked by a platform policy.
- Event ID 454: Package blocked by a platform policy.
Detects new BITS transfer job where the LocalName/Saved file is stored in a potentially suspicious location
Detects a DNS server error in which a specified plugin DLL (in registry) could not be loaded
Detects removal of an exported Exchange mailbox which could be to cover tracks from ProxyShell exploit
Detects code integrity failures such as missing page hashes or corrupted drivers due unauthorized modification. This could be a sign of tampered binaries.
Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.
Detects application popup reporting a failure of the Sysmon service
Detects denied requests by Active Directory Certificate Services.
Example of these requests denial include issues with permissions on the certificate template or invalid signatures.
Example of these requests denial include issues with permissions on the certificate template or invalid signatures.
This rule detects a DHCP server in which a specified Callout DLL (in registry) was loaded
Detects issues with Windows Defender Real-Time Protection features
KQL Query from file: Admin consent for M365 Connector for Claude
Detects the deactivation of the SAP Security Audit Log (AUJ). This is a critical event as it stops further security logging.
Detects when an security threat is detected in Okta.
Detects TCP connections to ports commonly associated with reverse shells,
C2 frameworks, and attacker tooling, as observed by Tetragon eBPF kernel-level
network monitoring. After initial container compromise, attackers establish
outbound connections on non-standard ports to maintain command and control.
Tetragon provides full process context (binary, pod, namespace, parent process)
tied to the network event, enabling high-fidelity correlation.
C2 frameworks, and attacker tooling, as observed by Tetragon eBPF kernel-level
network monitoring. After initial container compromise, attackers establish
outbound connections on non-standard ports to maintain command and control.
Tetragon provides full process context (binary, pod, namespace, parent process)
tied to the network event, enabling high-fidelity correlation.
This rule monitors SAP environments by correlating Change Documents (PFCG) with Security Audit logs to detect when a high-privilege role is assigned to a user. It specifically looks for additions to the AGR_USERS table and correlates this activity with security audit events to attribute the action to a specific source IP and user.
Page 67 of 83