Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
867 detections
Filters
Last updated
All Time
Detection languages
333
198
127
108
69
Contributors
215
147
122
95
58
Categories
20,417
11,806
5,870
5,145
4,864
867
Platforms
326
269
122
95
90
Products / Services
204
196
168
111
93
MITRE Techniques
357
351
224
111
110
CVEs
5
2
1
1
1
IDS Classtypes
14
1
IDS Protocols
10
3
1
1
Detects when PIM alerts are set to disabled.
Invalid PIM License
Sigma
Identifies when an organization doesn't have the proper license for PIM and is out of compliance.
Identifies when a privilege role assignment has taken place outside of PIM and may indicate an attack.
Identifies when a privilege role can be activated without performing mfa.
Identifies when a user has been assigned a privilege role and are not using that role.
Detects disabling of Multi Factor Authentication.
Detects when an attempt at deactivating or resetting MFA.
Detects an appx package deployment that was blocked by the local computer policy.
The following events indicate that an AppX package deployment was blocked by a policy:
- Event ID 441: The package deployment operation is blocked by the "Allow deployment operations in special profiles" policy
- Event ID 442: Deployments to non-system volumes are blocked by the "Disable deployment of Windows Store apps to non-system volumes" policy."
- Event ID 453: Package blocked by a platform policy.
- Event ID 454: Package blocked by a platform policy.
The following events indicate that an AppX package deployment was blocked by a policy:
- Event ID 441: The package deployment operation is blocked by the "Allow deployment operations in special profiles" policy
- Event ID 442: Deployments to non-system volumes are blocked by the "Disable deployment of Windows Store apps to non-system volumes" policy."
- Event ID 453: Package blocked by a platform policy.
- Event ID 454: Package blocked by a platform policy.
Detects when a all the rules have been deleted from the Windows Defender Firewall configuration
Detects WRITE_DAC access to a domain object
Detects modifications to Default Domain or Default Domain Controllers Group Policy Objects (GPOs).
Adversaries may modify these default GPOs to deploy malicious configurations across the domain.
Adversaries may modify these default GPOs to deploy malicious configurations across the domain.
Detects NetNTLM downgrade attack
Detects possible addition of shadow credentials to an active directory object.
Detects the deactivation of the SAP Security Audit Log (AUJ). This is a critical event as it stops further security logging.
Detects when a new admin role assignment is created. Which could be a sign of privilege escalation or persistence
Detects when an application Sign-on Policy is modified or deleted.
Detects unauthorized modifications to the SAP Security Audit Log configuration by monitoring specific SAP system message codes (AUE, AUF, AUI, AUJ, FU0, E05) associated with audit trail changes, excluding known administrative accounts.
Detects changes to SAP HANA audit policies (Create, Alter, Drop) which could indicate an attempt to evade logging.
Detects the deactivation of the global auditing state in SAP HANA, which stops all audit logging.
Detects unauthorized or suspicious modifications to authorization objects (via PFCG transaction) within SAP environments, specifically targeting sensitive roles. The rule correlates these changes with SAP security audit logs to identify the user's session context and ensure the action was performed by someone not listed as an authorized SAP administrator.
Detects various sensitive configuration modifications in AWS that could indicate malicious activity, such as privilege escalation, defense evasion, or data exposure. This rule looks for a curated list of API calls related to changes in IAM, EC2 security groups, S3 bucket policies, and logging configurations.
Page 30 of 42