Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,733 detections
Filters
Last updated
All Time
Detection languages
909
387
164
127
68
Contributors
479
417
201
177
61
Categories
20,440
11,814
5,871
5,145
4,864
1,733
Platforms
822
436
329
274
206
Products / Services
498
378
118
96
79
MITRE Techniques
433
327
225
196
196
CVEs
12
12
10
10
6
IDS Classtypes
1
1
IDS Protocols
2
This rule detects when an OpenCanary honeypot receives a Session Initiation Protocol (SIP) request. OpenCanary is a honeypot designed to detect unauthorized activity by mimicking vulnerable services. A SIP request to an OpenCanary node indicates that an attacker or scanner has interacted with the emulated SIP service, which is typically an indicator of reconnaissance or an attempted attack against voice-over-IP (VoIP) infrastructure.
This rule detects the creation of new applications within Microsoft Entra ID (formerly Azure AD). While application creation is a legitimate administrative activity, it does not occur frequently. Monitoring this event can help identify unauthorized or suspicious application registrations that could be used for persistence, privilege escalation, or other malicious activities within the cloud environment.
Detects instances where an HTTP service on an OpenCanary node has received a GET request.
Detects instances where a REDIS service on an OpenCanary node has had an action command attempted.
Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using SQLAuth.
Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using Windows Authentication.
Detects instances where an SMB service on an OpenCanary node has had a file open request.
Detects instances where an SNMP service on an OpenCanary node has had an OID request.
An Okta user reports suspicious activity in response to an end user security notification.
Generates alerts based on Google Workspace alerts center and aggregates them based on severity.
Identifies when a Marketplace app is added in a Google Workspace organization. Installing certain apps may increase the organization's risk of data exfiltration/leakage and increase its attack surface.
Detects instances where a GIT service on an OpenCanary node has had Git Clone request.
Detects instances where an HTTP service on an OpenCanary node has had login attempt via Form POST.
Detects instances where a MySQL service on an OpenCanary node has had a login attempt.
Detects instances where an NTP service on an OpenCanary node has had a NTP monlist request.
Detects instances where an SIP service on an OpenCanary node has had a SIP request.
Detects instances where a TFTP service on an OpenCanary node has had a request.
Detects instances where a VNC service on an OpenCanary node has had a connection attempt.
Detects multiple failed requests to access applications
Detect when multiple secrets or secret versions are deleted from GCP Secret Manager.
Detects when files are transferred using the ScreenConnect Remote Monitoring and Management (RMM) tool. This activity can indicate an adversary using legitimate tools for data exfiltration or staging.
Page 79 of 83