Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detect when GCP Workload identity pools are disabled or deleted. Disabling or deleting a pool will prevent any connected identities from accessing all GCP resources.
Identifies when an external user account is added to a group in Google Workspace. Security teams can monitor for unexpected user accounts being added to Google Workspace groups to prevent unauthorized access to data.
Identifies when a Google Workspace user transfers the ownership of a file.
Identifies when a Google Workspace user shares a file on Google Drive after a suspicious login event occurred.
Detect an AWS account attempting to leave or being removed from an AWS organization.
Detects when an insecure SSL policy is configured for an AWS Application Load Balancer.
AWS Backup Plan Deleted
YARA-L
Detects when AWS Backup Plan is deleted.
Detects when an insecure SSL policy is configured for an AWS CloudFront distribution.
Detects when AWS Config Service is updated, stopped or deleted.
AWS Delete VPC Flow Logs
YARA-L
Detects when AWS VPC FLow Logs are deleted.
Detects when an Amazon EC2 AMI or Snapshot is shared publicly.
Detect when an EC2 instance makes high number of API calls.
Detect modifications to user data script on an EC2 instance.
Detects excessive successful events within a 5 minute timeframe from an IAM User.
AWS GuardDuty Disabled
YARA-L
Detects when a GuardDuty Detector is disabled or suspended.
Detects when AWS IAM Access Analyzer is deleted.
Detect AWS IAM activities associated with the S3 Browser utility.
Detect AWS IAM activities made by AWS EC2 instances to retain access or escalate privileges.
Detects when AWS IAM AdministratorAccess policy is attached to a user, group or role which can be used for privilege escalation.
Detect when a KMS (Key Management Service) key is disabled or scheduled for deletion.
Detects an IAM user attempting to update/modify AWS lambda code.
Page 129 of 135