Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detect when Google Cloud Storage buckets are opened to public by adding allUsers or allAuthenticatedUsers to the access policy.
Detects API Calls from AWS accounts that are not part of the organization.
Detects when AWS API Gateway keys are accessed.
Detects when a CloudWatch log group is deleted.
Detects when a GuardDuty Detector's publishing destination has been deleted which will prevent the exporting of findings.
Detects when a GuardDuty Detector's trusted or threat intel IP lists are deleted or disabled.
Detects when an Amazon RDS Snapshot is shared publicly.
Detect when GCP BigQuery datasets are opened to public by adding allUsers or allAuthenticatedUsers to the access policy.
Detect when GCP Cloud Audit logs are exempted for principals in all services at project or organization level. Audit logging helps organizations maintain security and minimize risk.
Detect when free Google Email addressess are added to IAM Policy such as gmail.com, googlemail.com or googlegroups.com.
Detects when CloudTrail logging is updated, stopped or deleted.
Detects a successful attempt to retrieve the encrypted Administrator password for a Windows EC2 instance.
Detects excessive AccessDenied events within an hour timeframe from an IAM User
Detect when the AWS managed policy AWSCompromisedKeyQuarantine has been attached to a user, role, or group. It is applied by the AWS team in the event that the credentials of an IAM user has been compromised or publicly exposed.
Detects create, update or delete events of a SAML provider in AWS.
Detect when the Amazon Simple Email Service (SES) has been modified where an attacker can modify Amazon SES service to propagate phishing emails campaigns.
Detect when admin privileged roles such as Owner or Editor are added to a Service Account.
Detect a user downloads GCP BigQuery results from multiple tables which might indicate data exfiltration activity.
Detect when GCP IAM Organization Policy is updated or deleted.
Detect when multiple KMS crypto key versions are disabled or destroyed from GCP Cloud KMS.
Detect when GCP Security Command Center services are disabled.
Page 128 of 135