Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,733 detections
Filters
Last updated
All Time
Detection languages
909
387
164
127
68
Contributors
479
417
201
177
61
Categories
20,440
11,814
5,871
5,145
4,864
1,733
Platforms
822
436
329
274
206
Products / Services
498
378
118
96
79
MITRE Techniques
433
327
225
196
196
CVEs
12
12
10
10
6
IDS Classtypes
1
1
IDS Protocols
2
Detects when a GitHub organization is transferred to another enterprise account. An adversary may attempt to transfer a GitHub organization to an enterprise account they control in order to steal data.
Detects when a GitHub repository is archived or deleted.
Detects when a secret is found in a GitHub repository. Adversaries may attempt to harvest leaked/exposed secrets to further infiltrate their target's environment, maintain access, or steal data.
This rule detects the hard deletion of an application within Entra ID (formerly Azure AD). A 'hard delete' means the application is permanently removed without a recovery option, which can indicate malicious activity such as an attacker attempting to remove traces of their presence or disrupt services by deleting critical applications.
This rule detects when an application is deleted in Entra ID (formerly Azure AD). This action is a soft delete, meaning the application can still be recovered. Detection is based on specific event types and product names within Azure AD audit logs.
Logins to Azure AD PowerShell app can have legitimate purposes, but are also abused to gain access to user information. Programatic access to Azure AD should generally be through other apps
Detects when a group is attempted to be created but fails in Office 365. This could be due to insufficient permissions or other errors
Detects a suspicious download using the BITS client from a FQDN that is unusual. Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.
Detects when a group is created in Office 365.
Detects and alerts on users bypassing Chrome Safe Browsing warnings and accessing potentially dangerous content or downloads
Delete Entra ID application. This is a soft delete, can still be recovered.
Deletion of Entra ID application with no recovery of the application.
Entra ID application was restored. This implies a soft delete was performed at some point but less than 30 days ago.
Detects when a group is deleted.
Detects instances where an attacker attempts to interact with or exploit a REDIS service running on an OpenCanary honeypot. This indicates reconnaissance or an attempt to gain unauthorized access or extract data from the emulated Redis service.
This rule detects when a Git clone request is made to a Git service running on an OpenCanary honeypot. This indicates an adversary is interacting with the honeypot, likely attempting to collect information or test access.
This rule detects when an SNMP OID request is made to an OpenCanary honeypot's SNMP service. This indicates an adversary is likely performing reconnaissance to gather information about the network or devices, potentially looking for vulnerabilities or sensitive data.
Detects instances where a TFTP service on an OpenCanary honeypot node has received a request. This indicates potential reconnaissance or attempts to interact with a seemingly vulnerable service.
This rule detects HTTP POST login attempts against an OpenCanary honeypot. OpenCanary is a honeypot designed to mimic various services to detect unauthorized access attempts. A 'logtype' of 3001 specifically indicates an HTTP service login attempt via a form POST, suggesting an adversary is trying to gain initial access or credentials by interacting with the emulated service.
Detects instances where an SMB service on an OpenCanary honeypot node has received a file open request. This indicates an adversary is interacting with the honeypot's SMB share, potentially attempting to discover or access files.
This rule detects when an OpenCanary honeypot's NTP service receives a 'monlist' request. The 'monlist' command is a deprecated feature in NTP that can be abused for amplification attacks (Network Denial of Service). Detecting this activity on a honeypot indicates an adversary is likely scanning for vulnerable NTP servers or attempting to use the honeypot in an amplification attack.
Page 78 of 83