Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
This rule looks for exposed pairs of credentials used for GitHub cloud identity federation in logs or artifacts. Leaked pairs let attackers mint tokens as your pipeline. Rotate federation settings and audit recent workflow runs.
This rule detects when a Key Vault item is deleted in Azure. Monitoring deletions of sensitive items like those in Key Vaults is crucial for detecting potential data exfiltration, sabotage, or unauthorized access attempts by adversaries.
This rule detects reconnaissance activity targeting sensitive employee information within Microsoft Graph. Specifically, it looks for 'Directory.Read.All' actions in Microsoft Graph events where the raw event data contains keywords like 'jobTitle' or 'displayName' and also includes terms such as 'payroll', 'hr', 'finance', or 'admin'. This combination suggests an attacker is attempting to enumerate or collect information about employees in sensitive departments, potentially for purposes like payroll hijacking or social engineering.
This rule detects reconnaissance activity targeting sensitive employee information within Microsoft Graph. Specifically, it looks for 'Directory.Read.All' actions in Microsoft Graph events where the raw event data contains keywords like 'jobTitle' or 'displayName' and also includes terms such as 'payroll', 'hr', 'finance', or 'admin'. This combination suggests an attacker is attempting to enumerate or collect information about employees in sensitive departments, potentially for purposes like payroll hijacking or social engineering.
This rule detects when a GitHub workflow branch is deleted shortly after build artifacts were downloaded. This behavior can indicate an attacker attempting to hide their tracks after exfiltrating secrets or sensitive information from build artifacts. It is crucial to preserve logs and investigate who deleted the branch. Further investigation should include questioning the user about recent software installations or clicked links, and involving the security team if the answers are unclear.
Detects creation of additional IAM access keys for cloud account persistence
Detects deletion of cloud security group rules to weaken network security
This rule detects anomalous access to cloud services, specifically Salesforce, Drift, Salesloft, HubSpot, and Marketo, that may indicate OAuth token abuse. It identifies scenarios where a high volume of actions (8 or more) occur within a short timeframe (3 hours or less) from a single IP address but with multiple unique user agents (2 or more). The detection is further refined by looking for actions related to 'Add delegated permission grant' or 'Create service principal', which are indicative of an attacker attempting to establish persistence or escalate privileges after gaining access through a compromised OAuth token.
Detects bulk AWS API calls for cloud infrastructure discovery
Detects bulk Azure AD group membership enumeration via Graph API
Detects known joke or malicious commit messages previously observed from the Miasma threat actor when manipulating repositories. The rule specifically looks for the strings "OhNoWhatsGoingOnWithGitHub", "DontRevokeOrItGoesBoom", "thebeautifulmarchoftime", and "firedalazer" within Git commit messages.
This rule detects repeated successful operations related to public access or firewall configuration changes within Azure Activity Logs. A high count (3 or more) of such operations by the same caller within an hour could indicate malicious activity, such as an attacker attempting to open up network access to compromised resources or exfiltrate data.
Detects the creation of multiple service principals with administrative or sensitive keywords in their names within a short timeframe, potentially indicating an attempt to establish persistence or escalate privileges in a cloud environment. The rule specifically looks for service principals containing 'admin', 'sync', 'backup', or 'audit' in their display names, created by users outside of Microsoft's internal domains.
Detects suspicious AWS STS AssumeRole calls for temporary elevated access
Detects abuse of the microsoft.Web/sites/publishxml/action operation to retrieve application publishing profiles and basic auth credentials.
This rule detects when a Key Vault item is deleted in Azure. Monitoring deletions of sensitive items like those in Key Vaults is crucial for detecting potential data exfiltration, sabotage, or unauthorized access attempts by adversaries.
Detects suspicious AWS Lambda function invocations
Detects bulk AWS API calls for cloud infrastructure discovery
Detects API access to VPS providers for spinning up attack infrastructure
Detects when a Network Security Group (NSG) rule is successfully deleted in Azure. This could indicate an attempt to bypass network access controls, potentially to enable unauthorized access or exfiltration.
This rule detects attempts to disable AWS CloudTrail logging via the AWS API. It specifically looks for HTTP requests to 'cloudtrail.amazonaws.com' with 'StopLogging' in the URI, indicating an attempt to stop CloudTrail from recording API activity.
Page 95 of 135