Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
153 detections
Filters
Last updated
All Time
Detection languages
92
19
14
13
6
Contributors
74
30
9
9
8
Categories
20,402
11,796
5,865
5,145
4,864
Platforms
95
47
19
11
5
Products / Services
65
31
31
19
13
MITRE Techniques
54
52
24
19
17
CVEs
16
1
IDS Classtypes
2
1
IDS Protocols
2
1
Connection to ADFS via named pipes that are not using specific Windows ADFS processes may be indicative of user attempting to access ADFS for suspicious purposes
Detects when a stored procedure in MSSQL is configured for automatic execution upon SQL Server startup using `sp_procoption`. This can be used by adversaries to establish persistence.
Detects when an attacker attempts to establish persistence or escalate privileges on an MSSQL server by adding a new or existing account to the 'sysadmin' fixed server role. This action grants the account full administrative control over the SQL Server instance.
Detects when a Google Cloud SQL database instance or its user accounts are created, deleted, or modified. This can indicate malicious activity such as data destruction, unauthorized access attempts, or attempts to disrupt services.
Detect when a Cloud SQL DB has been modified or deleted.
Detects when an attacker tries to backdoor the MSSQL server by adding a backdoor account to the sysadmin fixed server role
Page 8 of 8