Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
867 detections
Filters
Last updated
All Time
Detection languages
333
198
127
108
69
Contributors
215
147
122
95
58
Categories
20,417
11,806
5,870
5,145
4,864
867
Platforms
326
269
122
95
90
Products / Services
204
196
168
111
93
MITRE Techniques
357
351
224
111
110
CVEs
5
2
1
1
1
IDS Classtypes
14
1
IDS Protocols
10
3
1
1
This rule detects when a user is added to a group that has permissions to modify Conditional Access (CA) policies within Azure Active Directory. Such an action could indicate an attempt to escalate privileges, bypass existing security controls, or establish persistence by altering authentication processes.
Detects when certificate-based authentication has been enabled in an Azure Active Directory tenant. This change can be an indicator of an adversary establishing a new authentication method for persistence or privilege escalation, or preparing for such activities.
Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology for IPv6 transition, unexpected or unauthorized ISATAP router configurations could indicate a potential IPv6 DNS Takeover attack using tools like mitm6. In such attacks, adversaries advertise themselves as DHCPv6 servers and set malicious ISATAP routers to intercept traffic. This detection should be correlated with network baselines and known legitimate ISATAP deployments in your environment.
Detects when the 'SeEnableDelegationPrivilege' user right is assigned in Active Directory. This privilege allows a user to control other Active Directory user objects, which can be abused for privilege escalation and persistence within a domain.
This rule detects the creation of a new trust relationship to a domain, indicated by Windows Event ID 4706. The addition of domain trusts is an infrequent administrative action and should be carefully verified for legitimacy, as unauthorized trust relationships could be used for privilege escalation or persistence within an Active Directory environment.
This rule identifies an event where the number of accounts assigned the Global Administrator role in Azure Active Directory (now Microsoft Entra ID) exceeds a predefined threshold. This is detected by monitoring the 'tooManyGlobalAdminsAssignedToTenantAlertIncident' risk event type from Azure PIM (Privileged Identity Management). A high number of Global Administrators can increase the attack surface and risk of privilege abuse or compromise.
Dependabot performs a scan to detect insecure dependencies, and sends Dependabot alerts.
This rule detects when an organization owner disables Dependabot alerts private repositories or Dependabot security updates for all repositories.
This rule detects when an organization owner disables Dependabot alerts private repositories or Dependabot security updates for all repositories.
Detects when the policy allowing forks of private and internal repositories is changed (enabled or cleared).
This analytic detects the use of PowerShell commands to add or set exclusions in Windows Defender. It specifically looks for command-line executions containing "Add-MpPreference" or "Set-MpPreference" along with exclusion parameters such as "-Exclusion*", "-ControlledFolderAccessAllowedApplications*", or "-AttackSurfaceReductionOnlyExclusions*". Adversaries commonly use this technique to bypass Windows Defender's protections, allowing malicious code to execute undetected, maintain persistence, and perform further malicious activities without interference from the antivirus.
Detect when a user creates a new Discretionary Access Control List (DACL) in Active Directory for their own AD object. This can be an indicator of an adversary attempting to maintain persistence or escalate privileges by modifying permissions on their own account to grant themselves additional rights or to prevent other users from modifying their account.
Detects PowerShell being used to modify Group Policy Objects (GPOs) to disable Windows Defender security features. This technique is used by threat actors like Storm-2603 for defense evasion.
Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.
Backdooring domain object to grant the rights associated with DCSync to a regular user or machine account using Powerview\Add-DomainObjectAcl DCSync Extended Right cmdlet, will allow to re-obtain the pwd hashes of any user/computer
Detects the creation or update of an Azure Sentinel analytics rule. This can indicate administrative activity related to security monitoring configuration. Monitoring these changes is crucial for detecting potential tampering with detection capabilities or the introduction of malicious rules.
Detects when a user is removed from a privileged role. Bulk changes should be investigated.
Detects scenario where if a user is assigned the SeEnableDelegationPrivilege right in Active Directory it would allow control of other AD user objects.
Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale
Addition of domains is seldom and should be verified for legitimacy.
Detects potential attempts made to set the Directory Services Restore Mode administrator password.
The Directory Service Restore Mode (DSRM) account is a local administrator account on Domain Controllers.
Attackers may change the password in order to obtain persistence.
The Directory Service Restore Mode (DSRM) account is a local administrator account on Domain Controllers.
Attackers may change the password in order to obtain persistence.
Detects changes to the IIS server configuration to disable or remove the ETW (Event Tracing for Windows) logging/processing option. This could indicate an adversary attempting to evade detection by reducing the logging capabilities of the web server.
Detects modification of an AWS IAM role's trust policy to include a principal from an unknown or untrusted AWS account. This is a common persistence technique used by attackers to maintain access to a compromised environment by allowing their external account to assume the role.
Page 33 of 42