Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Identifies when DNS zone is modified or deleted.
Identifies when a Keyvault Key is modified or deleted in Azure.
Identifies when secrets are modified or deleted in Azure.
Identifies when a Azure Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate.
Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs.
An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.
Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs.
An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.
Identifies the deletion of Azure Kubernetes Pods.
Identifies when a Firewall Rule Configuration is Modified or Deleted.
Identifies when a Point-to-site VPN is Modified or Deleted.
Identifies when a virtual network device is being modified or deleted.
This can be a network interface, network virtual appliance, virtual hub, or virtual router.
This can be a network interface, network virtual appliance, virtual hub, or virtual router.
Identifies when a new cloudshell is created inside of Azure portal.
Identifies when a suppression rule is created in Azure. Adversary's could attempt this to evade detection.
Identifies when a Virtual Network is modified or deleted in Azure.
Detects when highly privileged delegated permissions are granted on behalf of all users
Detects when a new owner is added to an application. This gives that account privileges to make modifications and configuration changes to the application.
Detects when storage bucket is enumerated in Google Cloud.
Identifies potential full network packet capture in gcp. This feature can potentially be abused to read sensitive data from unencrypted internal traffic.
Detect when a Cloud SQL DB has been modified or deleted.
Detects when a Microsoft Cloud App Security reported when an app downloads multiple files from Microsoft SharePoint or Microsoft OneDrive in a manner that is unusual for the user.
Page 135 of 135