Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
867 detections
Filters
Last updated
All Time
Detection languages
333
198
127
108
69
Contributors
215
147
122
95
58
Categories
20,417
11,806
5,870
5,145
4,864
867
Platforms
326
269
122
95
90
Products / Services
204
196
168
111
93
MITRE Techniques
357
351
224
111
110
CVEs
5
2
1
1
1
IDS Classtypes
14
1
IDS Protocols
10
3
1
1
Modifications to a config that will serve an adversary's impacts or persistence
This KQL Query helps to keep an eye on accounts that are being excluded from Conditional Access (CA) policies which they should be blocked by it and which specific field triggered the CA detection and got them excluded.
The aim of this case is to identify:
Spot CA policies with a high number of exclusions.
Find exclusions that don’t make sense, like skipping MFA when it’s mandatory for privileged accounts.
Catch new exclusions that might not have been approved.
Check how exclusions are actually working (e.g., excluding a device is fine, but if it’s connecting from risky countries or open networks, that’s a problem—hopefully, other CA policies cover this).
Identify unexpected exclusions, which could mean an attacker got in and excluded themselves to bypass CA controls
The aim of this case is to identify:
Spot CA policies with a high number of exclusions.
Find exclusions that don’t make sense, like skipping MFA when it’s mandatory for privileged accounts.
Catch new exclusions that might not have been approved.
Check how exclusions are actually working (e.g., excluding a device is fine, but if it’s connecting from risky countries or open networks, that’s a problem—hopefully, other CA policies cover this).
Identify unexpected exclusions, which could mean an attacker got in and excluded themselves to bypass CA controls
This rule detects when a user disables critical security features within a GitHub organization or repository. This includes disabling advanced security features, OAuth app access restrictions, or two-factor authentication requirements. Such actions can significantly weaken the security posture of a GitHub environment, potentially leading to unauthorized access or compromise.
Detects when the policy allowing forks of private and internal repositories is changed (enabled or cleared) within a GitHub enterprise environment. This action can indicate an attempt to exfiltrate data by creating copies of sensitive repositories or a change in security posture.
Detects when an Okta policy is modified or deleted, which could indicate an attempt to alter security controls or bypass existing policies. This activity should be monitored closely as it can precede unauthorized access or other malicious actions.
This rule detects changes to global permissions within Bitbucket. This includes requests to grant or remove global permissions, as well as the successful granting or removal of such permissions. Monitoring these events is crucial for identifying unauthorized privilege escalation or persistence attempts within a Bitbucket instance.
Detects the addition of a new firewall policy on a Fortinet FortiGate Firewall. This activity could indicate an adversary attempting to alter network access controls for defense evasion, persistence, or to facilitate further malicious activity.
This rule detects when an Okta Policy Rule is either modified or deleted. Monitoring changes to policy rules is crucial as unauthorized modifications or deletions could indicate an attempt to bypass security controls, alter access permissions, or disrupt normal operations within the Okta environment. Such actions could lead to unauthorized access, privilege escalation, or impact the availability of services.
Detects when an Okta application Sign-on Policy is modified or deleted. This could indicate an adversary attempting to weaken security controls to gain unauthorized access or maintain persistence.
Detects the execution of 'auditctl' with the '-D' command line parameter, which deletes all configured audit rules and watches on Linux systems. This technique is commonly used by attackers to disable audit logging and cover their tracks by removing monitoring capabilities. Removal of audit rules can significantly impair detection of malicious activities on the affected system.
This rule detects when Privileged Identity Management (PIM) alerts are disabled within Azure. Disabling PIM alerts can be a defense evasion tactic, as it prevents security teams from being notified of critical activities related to privileged roles, potentially allowing an attacker to operate undetected after gaining initial access or escalating privileges.
Detects potential suspicious behavior using secedit.exe, specifically when it is used to export or configure security policies. This could indicate an adversary attempting to discover system configurations or modify them for persistence, defense evasion, or privilege escalation.
Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects. This can be used by adversaries for persistence, privilege escalation, or defense evasion.
Detects when changes are made to Privileged Identity Management (PIM) role settings within Azure Active Directory. This could indicate an attempt to alter how privileged roles are managed, potentially to facilitate unauthorized access or persistence.
This rule identifies when a privileged role assignment occurs in Azure Active Directory (now Microsoft Entra ID) without utilizing Privileged Identity Management (PIM). Such assignments bypass the just-in-time access and approval workflows provided by PIM, potentially indicating an attacker attempting to establish persistent privileged access or escalate privileges outside of established security controls.
This rule detects when a Conditional Access (CA) policy is deleted in Azure Active Directory (now Microsoft Entra ID). This activity is critical to monitor as the removal of a CA policy can significantly weaken an organization's security posture by bypassing multi-factor authentication, device compliance checks, or other access controls. The rule specifically looks for the 'Delete conditional access policy' message in the Azure Audit Logs. While the rule's title suggests identifying actions by 'non-approved actors', the current detection logic only identifies the deletion event itself, not the actor's approval status. Further enrichment or correlation would be needed to determine if the actor is unauthorized.
This rule detects attempts to backdoor a domain object by granting DCSync rights to a regular user or machine account. This is achieved by modifying the 'ntSecurityDescriptor' attribute in Active Directory, specifically looking for GUIDs associated with DCSync extended rights. Such a modification allows the designated account to perform DCSync attacks, enabling the retrieval of password hashes for any user or computer in the domain.
This rule detects the addition of a new conditional access policy within an Azure environment. Conditional Access policies are critical security controls that determine when and how users can access resources. Unauthorized or unexpected changes to these policies could indicate an attacker attempting to establish persistence, bypass existing security controls (like MFA), or gain unauthorized access by modifying access conditions.
This rule detects when a Conditional Access policy is updated within an Azure environment. It aims to identify unauthorized or suspicious modifications to these critical security policies, which could lead to privilege escalation, credential access, or defense evasion. The rule specifically looks for the message 'Update conditional access policy' in audit logs. Further investigation would involve checking if the actor initiating the change is approved and comparing the old versus new policy values.
Detects the creation or modification of scheduled tasks via Group Policy Objects (GPO), which can be used by adversaries for persistence, execution, and lateral movement, often seen in ransomware deployment scenarios. The rule specifically looks for Event ID 5136 (Directory Service Changes) indicating modifications to GPO attributes related to machine or user extension names, and Event ID 5145 (Detailed File Share) indicating write access to ScheduledTasks.xml within the SYSVOL share.
Detects modifications to Group Policy Object (GPO) attributes, specifically 'gPCMachineExtensionNames', that are indicative of adding privileges to user accounts or adding users as local administrators. This is identified by the presence of specific GUIDs ('827D319E-6EAC-11D2-A4EA-00C04F79F83A' or '803E14A0-B4FB-11D0-A0D0-00A0C90F574B') within the 'AttributeValue' field of EventID 5136. These GUIDs are associated with Group Policy extensions that can be abused for privilege escalation.
Page 32 of 42