Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
867 detections
Filters
Last updated
All Time
Detection languages
333
198
127
108
69
Contributors
215
147
122
95
58
Categories
20,417
11,806
5,870
5,145
4,864
867
Platforms
326
269
122
95
90
Products / Services
204
196
168
111
93
MITRE Techniques
357
351
224
111
110
CVEs
5
2
1
1
1
IDS Classtypes
14
1
IDS Protocols
10
3
1
1
Detects unexpected DACL modifications on critical policy keys (CloudFiles or System Policies). Relaxing these DACLs allows unprivileged actors to write values like DisableLockWorkstation, maintaining exploit persistence.
Smartcard Disabled Event Detected
Cortex XDR
This rule detects when a smartcard is disabled, indicated by a specific change code (2060) in Windows raw event data. Disabling smartcards can be a tactic used by adversaries to bypass multi-factor authentication or other security controls.
This rule detects the creation, patching, or updating of Kubernetes ClusterRoleBindings, RoleBindings, or Roles within the 'prod', 'production', or 'default' namespaces. It specifically excludes actions performed by the 'system:clusterrole-aggregation-controller' to reduce noise from legitimate system operations. This activity can indicate an attempt to manipulate access controls within the Kubernetes cluster, potentially for privilege escalation or persistence.
This rule detects the assignment of highly privileged roles such as 'Global Administrator', 'Intune Administrator', or 'Cloud Device Administrator' within Azure Active Directory. This activity is often a precursor to significant malicious actions, including mass device wipes, as highlighted by the referenced threat intelligence. Monitoring these assignments helps identify potential privilege escalation or unauthorized administrative access.
Detects suspicious modifications to Power Automate flow permissions, including sharing flows or changing role assignments. This could indicate a compromised account attempting to gain unauthorized access or persistence within the Power Platform environment.
This rule detects the use of PowerShell to re-enable the Server Message Block version 1 (SMB1) protocol on Windows systems. SMB1 is a deprecated and insecure protocol, and its re-enablement often indicates an attempt to support legacy systems or could be exploited by adversaries for lateral movement or data access.
Detects activity when the settings of the Windows firewall have been changed
Detects AWS Config Service disabling
Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including:
- Use of the `personality` syscall with the ADDR_NO_RANDOMIZE flag (0x0040000)
- Modification of the /proc/sys/kernel/randomize_va_space file
- Execution of the `sysctl` command to set `kernel.randomize_va_space=0`
Disabling ASLR is often used by attackers during exploit development or to bypass memory protection mechanisms.
A successful use of these methods can reduce the effectiveness of ASLR and make memory corruption attacks more reliable.
- Use of the `personality` syscall with the ADDR_NO_RANDOMIZE flag (0x0040000)
- Modification of the /proc/sys/kernel/randomize_va_space file
- Execution of the `sysctl` command to set `kernel.randomize_va_space=0`
Disabling ASLR is often used by attackers during exploit development or to bypass memory protection mechanisms.
A successful use of these methods can reduce the effectiveness of ASLR and make memory corruption attacks more reliable.
Detects if the push protection feature is disabled for an organization, enterprise, repositories or custom pattern rules.
Detects when an a role is modified or deleted in Google Workspace.
Detects when a user disables a critical security feature for an organization.
Detects when certificate based authentication has been enabled in an Azure Active Directory tenant.
Cisco Dot1x Disabled
Sigma
Detects the manual disablement of IEEE 802.1X (dot1x) on a Cisco network device interface.
Disabling dot1x bypasses Network Access Control (NAC) mechanisms, potentially allowing unauthorized devices to gain access to the internal network.
This activity is a common technique used by attackers or malicious insiders to establish persistence or perform lateral movement via rogue devices.
Disabling dot1x bypasses Network Access Control (NAC) mechanisms, potentially allowing unauthorized devices to gain access to the internal network.
This activity is a common technique used by attackers or malicious insiders to establish persistence or perform lateral movement via rogue devices.
Detects when an attacker calls the "ALTER SERVER AUDIT" or "DROP SERVER AUDIT" transaction in order to delete or disable audit logs on the server
Detects scenario where weak encryption is enabled for a user profile which could be used for hash/password cracking.
Detects the modification of the findings on SecurityHub.
Identifies an event where there are there are too many accounts assigned the Global Administrator role.
Detects execution of EDRSilencer, a tool that abuses the Windows Filtering Platform (WFP) to block the outbound traffic of running EDR agents based on specific hardcoded filter names.
Detects when someone is adding or removing applications or folders from exploit guard "ProtectedFolders" or "AllowedApplications"
Detects disabling of the Windows Defender feature of scanning for malware and other potentially unwanted software
Page 28 of 42