Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
867 detections
Filters
Last updated
All Time
Detection languages
333
198
127
108
69
Contributors
215
147
122
95
58
Categories
20,417
11,806
5,870
5,145
4,864
867
Platforms
326
269
122
95
90
Products / Services
204
196
168
111
93
MITRE Techniques
357
351
224
111
110
CVEs
5
2
1
1
1
IDS Classtypes
14
1
IDS Protocols
10
3
1
1
Detects various sensitive configuration modifications in AWS that could indicate malicious activity, such as privilege escalation, defense evasion, or data exposure. This rule looks for a curated list of API calls related to changes in IAM, EC2 security groups, S3 bucket policies, and logging configurations.
Detects when a registered security product on a Windows system has been turned off or snoozed, indicated by Windows Security Center Event ID 15 with specific states.
Detects Windows Security Center Event ID 15 indicating that a registered security product, such as Windows Defender or VIPRE, has been turned off or snoozed. Attackers actively uninstall or disable endpoint security agents immediately prior to deploying ransomware to ensure successful encryption without interference.
Detects modifications to AWS EC2 security groups that allow SSH (port 22) or RDP (port 3389) access from any IP address (0.0.0.0/0) to instances. This configuration significantly increases the attack surface and can be an indicator of unauthorized access attempts, misconfigurations, or malicious activity.
Detects when a new federation identity provider (SAML or OpenID Connect) is created or updated in AWS Identity and Access Management (IAM). This could indicate an attempt to establish new trust relationships for federated access.
Detects attempts to modify the PowerShell execution policy using 'Set-ExecutionPolicy'. This command can be used by adversaries to lower security restrictions and enable the execution of unsigned or malicious PowerShell scripts.
Detects when a repository's branch protection, specifically the 'allow force pushes' enforcement level, is updated or disabled. This rule explicitly excludes events originating from automation scripts to reduce false positives.
Detects PowerShell commands used by Prometei to add Microsoft Defender exclusions for its staging and configuration directories ('C:\Windows\Dell' or 'Intel\Support'). This is a common defense evasion tactic.
Detects critical permission changes in Azure DevOps, specifically focusing on 'allow' changes to sensitive permissions like 'Edit build pipeline', 'Manage permissions', 'Queue builds', 'Administer build', and 'Bypass policies when completing' within key namespaces such as 'Git Repositories', 'ReleaseManagement', 'PipelinesPrivileges', and 'Project-level Permissions'. This rule aims to identify potential privilege escalation or unauthorized access attempts within Azure DevOps environments.
Detects action of Repo branch protection being disabled. This would mean no PR or review process is needed for that repo and an actor (Insider or attacker) could push arbitrary code. Bypassing usual Security controls.
Detects action of SSH ertificate Auth being disabled. This would mean password auth is allowed.
This could indicate an Authentication downgrade attack, disabling Security controls.
This could indicate an Authentication downgrade attack, disabling Security controls.
Detects a sequence of events where an AWS IAM Policy is modified or created and then immediately attached to a principal (user, role, or group) within a short time window (10 minutes). This behavior is highly suspicious and often indicates a rapid privilege escalation attempt or a lateral movement step where an attacker grants themselves new permissions for immediate use.
This rule detects configuration changes to Fortinet FortiGate firewall policies that occur outside of standard business hours (before 8 AM or after 5 PM NZDT). It specifically looks for actions like 'Move', 'Add', 'Enable', 'Delete', or 'Edit' on firewall policies. This can indicate unauthorized access or malicious activity, as legitimate changes are typically performed during business hours.
Detects the modification of Microsoft Office Trust Center settings to weaken macro security policies. This is a common technique used by attackers to enable malicious macros in documents, bypassing default security controls.
Detects modification of an AWS IAM role's trust policy to include a principal from an unknown or untrusted AWS account. This is a common persistence technique used by attackers to maintain access to a compromised environment by allowing their external account to assume the role.
Detects modifications to critical registry settings that weaken security controls related to NTLM authentication, Restricted Admin mode, and RDP security. The rule specifically looks for disabling NTLM traffic restrictions (RestrictSendingNTLMTraffic set to 0), disabling Restricted Admin mode (DisableRestrictedAdmin set to 0), or weakening RDP security by setting the SecurityLayer to '1'. An alert is generated if two or more such modifications occur within a 7-day timeframe.
Detects AWS IAM roles whose trust policies were newly created or updated to allow cross account AWS principals to assume the role without any confused deputy protections in place.
Detects when a Microsoft Teams messaging policy is modified to allow users to send B2B invitations to external users ('UseB2BInvitesToAddExternalUsers' set to 'True'). While this can be a legitimate administrative change, it can also be an indicator of misconfiguration or malicious activity to enable phishing attacks by luring users to malicious external tenants where organizational security controls do not apply.
Detects modifications to DNS records in Active Directory where the Distinguished Name (DN) contains a base64-encoded blob
matching the pattern "1UWhRCAAAAA...BAAAA". This pattern corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure,
commonly used in Kerberos coercion attacks. Adversaries may exploit this to coerce victim systems into authenticating to
attacker-controlled hosts by spoofing SPNs via DNS. It is one of the strong indicators of a Kerberos coercion attack,.
where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.
Please investigate the user account that made the changes, as it is likely a low-privileged account that has been compromised.
matching the pattern "1UWhRCAAAAA...BAAAA". This pattern corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure,
commonly used in Kerberos coercion attacks. Adversaries may exploit this to coerce victim systems into authenticating to
attacker-controlled hosts by spoofing SPNs via DNS. It is one of the strong indicators of a Kerberos coercion attack,.
where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.
Please investigate the user account that made the changes, as it is likely a low-privileged account that has been compromised.
Detects various sensitive configuration modifications in AWS that could indicate malicious activity, such as privilege escalation, defense evasion, or data exposure. This rule looks for a curated list of API calls related to changes in IAM, EC2 security groups, S3 bucket policies, and logging configurations.
This detection looks for administrative activity that creates or updates Cross-Tenant Access Settings or Cross-Tenant Identity Synchronization Settings in Microsoft Entra ID (Azure AD). These settings control how identities, claims, and trust relationships are shared between Microsoft Entra tenants.
Page 31 of 42