Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
867 detections
Filters
Last updated
All Time
Detection languages
333
198
127
108
69
Contributors
215
147
122
95
58
Categories
20,417
11,806
5,870
5,145
4,864
867
Platforms
326
269
122
95
90
Products / Services
204
196
168
111
93
MITRE Techniques
357
351
224
111
110
CVEs
5
2
1
1
1
IDS Classtypes
14
1
IDS Protocols
10
3
1
1
This rule detects an unusually high number of firewall rule changes (Event ID 4948) occurring on a single computer within a one-hour window. A sudden surge in firewall modifications can indicate malicious activity, such as an attacker attempting to establish persistence, bypass security controls, or facilitate lateral movement by opening new ports or disabling existing rules.
This rule detects potential abuse of Group Policy Objects (GPOs) by identifying multiple changes (3 or more) to GPO-related objects within a short timeframe. It specifically looks for Event ID 5136 (Directory Service Changes) where the ObjectClass is either 'groupPolicyContainer' or 'gPCFileSysPath'. This could indicate an adversary modifying GPOs to achieve persistence, privilege escalation, or other malicious objectives.
This rule detects suspicious changes to account delegation settings by monitoring Security Event ID 5136 for modifications to the 'msDS-AllowedToDelegateTo' attribute. It specifically looks for instances where an account's delegation settings are changed two or more times within an hour, which could indicate an adversary attempting to establish persistence or elevate privileges through constrained delegation.
This rule detects suspicious activity related to Azure Active Directory service principals. It specifically looks for a service principal performing multiple (5 or more within an hour) 'Add service principal', 'Add owner to application', or 'Add permission grant' operations. This pattern could indicate an attacker attempting to escalate privileges or establish persistence within an Azure AD environment by manipulating service principals and application permissions.
This rule detects suspicious activity related to Azure Active Directory service principals. It specifically looks for a service principal performing multiple (5 or more within an hour) 'Add service principal', 'Add owner to application', or 'Add permission grant' operations. This pattern could indicate an attacker attempting to escalate privileges or establish persistence within an Azure AD environment by manipulating service principals and application permissions.
Detects the creation or modification of Kubernetes ClusterRoles, ClusterRoleBindings, and RoleBindings, which can be used for privilege escalation within a Kubernetes cluster. The rule specifically flags activities related to 'cluster-admin' roles as critical and other administrative roles as high severity.
Detects failed attempts to change the system audit policy. This could indicate an adversary attempting to disable or modify security monitoring to evade detection.
This rule detects an unusually high number of firewall rule changes (Event ID 4948) occurring on a single computer within a one-hour window. A sudden surge in firewall modifications can indicate malicious activity, such as an attacker attempting to establish persistence, bypass security controls, or facilitate lateral movement by opening new ports or disabling existing rules.
This rule detects potential tampering with Conditional Access Policies in Azure Active Directory by monitoring for multiple update, delete, or add operations on policies containing 'Conditional Access' in their display name within a one-hour window. This could indicate an adversary attempting to weaken security controls to maintain access or bypass MFA.
This rule detects HTTP traffic where the client body contains the terms "rdp" and "buy" (case-insensitive). This combination suggests a potential attempt to purchase RDP access, possibly on an underground forum, which is a policy violation.
Cortex Policy or Rule Modification
Cortex XDR
This rule detects modifications to Cortex prevention policies or detection rules. Specifically, it looks for creation, editing, or deletion of policy profiles, and editing, reordering, or reverting of prevention policy rules. Authorized personnel can be added to the email filter and this rule can serve as a detection for unauthorized tampering.
This rule detects when a network device disables hardware crypto acceleration. It specifically looks for TCP traffic on port 22 (SSH) from any source to the home network, containing the case-insensitive string "no crypto engine". This could indicate a policy violation or an attempt to degrade cryptographic performance, potentially for evasion or to facilitate other attacks.
This rule detects the negotiation of a weak cipher, specifically 'arcfour', during an SSH session. It monitors TCP traffic flowing to the home network on port 22 (SSH) and triggers an alert if the string 'arcfour' is found in the established session, ignoring case.
This rule detects attempts to disable Conditional Access Policies in Microsoft 365 via the Microsoft Graph API. It specifically looks for HTTP PATCH requests to 'graph.microsoft.com' targeting the 'conditionalAccess/policies' endpoint. Such activity could indicate an attacker attempting to bypass security controls for persistence or privilege escalation.
This rule detects outbound TCP connections to port 9050, which is commonly used by Tor proxies. The rule specifically looks for the initial SYN packet (flags:S) of a TCP connection from the home network to any destination on port 9050. This activity is flagged as a policy violation, indicating the use of a Tor proxy for accessing closed source resources.
This rule detects large data exfiltration attempts over SMTP Submission (port 587). It triggers an alert if more than 50,000 bytes of data are sent from a single source IP address to a server via SMTP Submission, with a threshold of 5 such events within a 300-second window. This indicates a potential policy violation related to data exfiltration.
Flags Intune assignments to “All Devices” or “All Users,” which attackers may abuse for mass deployment.
This rule detects the assignment of highly privileged roles such as 'Global Administrator', 'Intune Administrator', or 'Cloud Device Administrator' within Azure Active Directory. This activity is often a precursor to significant malicious actions, including mass device wipes, as highlighted by the referenced threat intelligence. Monitoring these assignments helps identify potential privilege escalation or unauthorized administrative access.
Detects attempts to disable or tamper with PowerShell logging mechanisms (Script Block Logging, Module Logging, Transcription) by modifying or deleting specific registry keys or setting their values to disable logging. This activity is often performed by adversaries to evade detection.
Detects attempts to disable or tamper with PowerShell logging mechanisms (Script Block Logging, Module Logging, Transcription) by modifying or deleting specific registry keys or setting their values to disable logging. This activity is often performed by adversaries to evade detection.
Smartcard Disabled Event Detected
Cortex XDR
This rule detects when a smartcard is disabled, indicated by a specific change code (2060) in Windows raw event data. Disabling smartcards can be a tactic used by adversaries to bypass multi-factor authentication or other security controls.
Page 27 of 42