Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects when an access policy that is applied to a GCP cloud resource is deleted.
An adversary would be able to remove access policies to gain access to a GCP cloud resource.
An adversary would be able to remove access policies to gain access to a GCP cloud resource.
Detects when an application (service principal) is assigned Azure AD roles, such as global administrator, or Azure RBAC roles, such as subscription owner. This activity can indicate privilege escalation or persistence by an attacker who has compromised an application.
Detects when an app is assigned Azure AD roles, such as global administrator, or Azure RBAC roles, such as subscription owner.
Detects when S3 bucket versioning is disabled. Threat actors use this technique during AWS ransomware incidents prior to deleting S3 objects.
This rule detects activity related to AzureHound, a BloodHound data collector specifically designed for Microsoft Azure environments. It identifies AzureHound's presence by looking for its default 'User-Agent' string in Azure sign-in logs after a successful authentication (ResultType: 0). This indicates that an authenticated user or service principal is using AzureHound to enumerate Azure resources, which is often a precursor to further reconnaissance or privilege escalation within a cloud environment.
This rule identifies when a key within Azure Key Vault is modified or deleted. This includes operations such as updating, creating, importing, recovering, restoring, deleting, backing up, or purging keys. Monitoring these actions is crucial as compromise or unauthorized modification/deletion of cryptographic keys can lead to significant security incidents, including data compromise, loss of access to encrypted resources, or disruption of services relying on these keys.
This rule identifies when sensitive information is re-identified in Google Cloud Platform (GCP). The detection is based on the 'projects.content.reidentify' method name in GCP audit logs, indicating an attempt to reverse a de-identification process, potentially exposing sensitive data.
Detects changes to the security group entries for AWS RDS databases. This can indicate a misconfiguration that potentially exposes the database to the public internet, a wider audience within the VPC, or the removal of valid rules which could impact database availability for legitimate services and users. The rule specifically looks for API calls related to authorizing, creating, deleting, or revoking database security group ingress rules.
Detects when Microsoft Cloud App Security reports that an OAuth application has downloaded multiple files from Microsoft SharePoint or Microsoft OneDrive in a manner that is unusual for the user. This activity could indicate unauthorized data exfiltration by a compromised or malicious OAuth app.
This rule identifies when secrets stored in Azure Key Vaults are modified or deleted. It specifically looks for operations such as writing, deleting, backing up, purging, updating, recovering, restoring, or setting secrets within Azure Key Vaults. This activity can indicate unauthorized access to sensitive credentials or an attempt to disrupt services by removing critical secrets.
This rule identifies when a VPN Tunnel is modified or deleted within Google Cloud Platform. Adversaries may modify or delete VPN tunnels to disrupt network connectivity, reroute traffic, or hinder defensive efforts, impacting the availability or integrity of services.
This rule detects when an AWS EC2 snapshot's permissions are modified to allow access from another AWS account. This activity can indicate an attempt to exfiltrate data stored in the snapshot by sharing it with an adversary-controlled account.
Detects when Google Cloud Storage buckets are enumerated. This activity involves listing storage buckets or their channels, which can be an indicator of reconnaissance by an attacker attempting to understand the environment's data storage landscape.
This rule identifies when an Azure Application Gateway is either modified or deleted. This activity is captured through Azure Activity Logs by monitoring specific operation names related to Application Gateway write (modification) and delete operations. Detection of these events can indicate administrative changes to the network infrastructure, which could be legitimate or potentially malicious if unauthorized.
Detects when an AWS account makes changes to the ingress or egress rules of a security group. This activity can indicate an attacker attempting to open new attack vectors, exfiltrate data over the network, or allow compromised machines to contact a command and control (C2) server.
This rule identifies when an Azure Key Vault is modified or deleted. Key Vaults store sensitive information such as cryptographic keys, certificates, and secrets. Unauthorized modification or deletion of a Key Vault could indicate an attacker attempting to disrupt services, remove evidence, or gain access to sensitive credentials. The rule specifically looks for operations related to writing, deleting, deploying, or modifying access policies of Key Vaults.
This rule detects when the master password for an AWS RDS database instance is changed. This activity could be a precursor to data exfiltration or an attempt to gain unauthorized access to the database. The rule specifically looks for the 'ModifyDBInstance' event from 'rds.amazonaws.com' where the 'masterUserPassword' in 'pendingModifiedValues' is present, indicating a password change.
This detection identifies the creation or update of a server instance within an Azure AD Hybrid Health AD FS service using Azure Activity logs. An adversary might perform this action to create a new AD Health ADFS service and a fake server instance to spoof AD FS signing logs, potentially bypassing the need to compromise an on-premises AD FS server. This can be achieved programmatically via HTTP requests to Azure.
Identifies when a service principal was removed in Azure. This action could indicate an attempt to remove legitimate service accounts to hinder detection or to clean up after malicious activity.
Detects when a Google Cloud Storage bucket is modified or deleted. This includes operations such as deleting a bucket, inserting (creating) a bucket, or updating/patching a bucket's properties. Such activities can indicate unauthorized access, data manipulation, or attempts to disrupt services.
Detects changes to the security groups associated with an Elastic Load Balancer (ELB) or Application Load Balancer (ALB). This can indicate that a misconfiguration allowing more traffic into the system than required, or could indicate that an attacker is attempting to enable new connections into a VPC or subnet controlled by the account.
Page 131 of 135