Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
867 detections
Filters
Last updated
All Time
Detection languages
333
198
127
108
69
Contributors
215
147
122
95
58
Categories
20,417
11,806
5,870
5,145
4,864
867
Platforms
326
269
122
95
90
Products / Services
204
196
168
111
93
MITRE Techniques
357
351
224
111
110
CVEs
5
2
1
1
1
IDS Classtypes
14
1
IDS Protocols
10
3
1
1
This detection monitors the addition of dangerous Access Control Lists (ACLs) to an Active Directory user object. Specifically, it looks for modifications that grant "Full control", "All extended rights", "All validated writes", "Create all child objects", "Delete all child objects", "Delete subtree", "Delete", "Modify permissions", "Modify owner", or "Write all properties" to a user object. Such modifications can indicate potential privilege escalation or malicious activity within the Active Directory environment. Immediate investigation is recommended upon alert.
The following analytic detects when a user disables audit log event streaming in GitHub Enterprise. The detection monitors GitHub Enterprise audit logs for configuration changes that disable the audit log streaming functionality, which is used to send audit events to security monitoring platforms. This behavior could indicate an attacker attempting to prevent their malicious activities from being logged and detected by disabling the audit trail. For a SOC, identifying the disabling of audit logging is critical as it may be a precursor to other attacks where adversaries want to operate undetected. The impact could be severe as organizations lose visibility into user actions, configuration changes, and security events within their GitHub Enterprise environment, potentially allowing attackers to perform malicious activities without detection. This creates a significant blind spot in security monitoring and incident response capabilities.
The following analytic detects the deletion of an IAM policy in AWS. It leverages AWS CloudTrail logs to identify `DeletePolicy` events, excluding those from AWS internal services. This activity is significant as unauthorized policy deletions can disrupt access controls and weaken security postures. If confirmed malicious, an attacker could remove critical security policies, potentially leading to privilege escalation, unauthorized access, or data exfiltration. Monitoring this behavior helps ensure that only authorized changes are made to IAM policies, maintaining the integrity and security of the AWS environment.
The following analytic detects when classic branch protection rules are disabled in GitHub Enterprise. The detection monitors GitHub Enterprise audit logs for branch protection removal events by tracking actor details, repository information, and associated metadata. For a SOC, identifying disabled branch protection is critical as it could indicate attempts to bypass code review requirements and security controls. Branch protection rules are essential security controls that enforce code review, prevent force pushes, and maintain code quality. Disabling these protections could allow malicious actors to directly push unauthorized code changes or backdoors to protected branches. The impact of disabled branch protection includes potential code tampering, bypass of security reviews, introduction of vulnerabilities or malicious code, and compromise of software supply chain integrity. This activity could be part of a larger attack chain where an adversary first disables security controls before attempting to inject malicious code.
This rule detects the deletion of Access Control List (ACL) entries on the domain root object within Active Directory. Such an action is a significant change with high impact, as it can alter fundamental security permissions for the entire domain. Microsoft guidance suggests that all changes at this level should be reviewed. The rule extracts details about the old and new ACL values, the operation type, the affected object, and the user performing the action. It also attempts to resolve SIDs to user or group names for better context.
The following analytic identifies the execution of `auditpol.exe` with the "/set", "/option" and "/value:disable" command-line arguments used to disable specific auditing options of the audit policy. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity can be significant as it indicates potential defense evasion by adversaries or Red Teams, aiming to limit data that can be leveraged for detections and audits. If confirmed malicious, this behavior could allow attackers to bypass defenses, and plan further attacks, potentially leading to full machine compromise or lateral movement.
The analytic detects the disabling of important audit policies by leveraging EventCode 4719 from Windows Security Event Logs. This event indicates changes where success or failure auditing is removed for specific subcategories. Such activity suggests an attacker may be attempting to evade detection by tampering with audit policies, potentially after gaining access to a system, including a domain controller. If confirmed malicious, this could lead to severe consequences, including data theft, privilege escalation, and full network compromise. Immediate investigation is required to determine the source and intent of the change.
The following analytic detects when a user pauses audit log event streaming in GitHub Enterprise. The detection monitors GitHub Enterprise audit logs for configuration changes that temporarily suspend the audit log streaming functionality, which is used to send audit events to security monitoring platforms. This behavior could indicate an attacker attempting to prevent their malicious activities from being logged and detected by temporarily disabling the audit trail. For a SOC, identifying the pausing of audit logging is critical as it may be a precursor to other attacks where adversaries want to operate undetected during the pause window. The impact could be severe as organizations temporarily lose visibility into user actions, configuration changes, and security events within their GitHub Enterprise environment, potentially allowing attackers to perform malicious activities without detection during the pause period. This creates a temporary blind spot in security monitoring and incident response capabilities.
The following analytic detects the disabling of audit policies on a domain controller. It leverages EventCode 4719 from Windows Security Event Logs to identify changes where success or failure auditing is removed. This activity is significant as it suggests an attacker may have gained access to the domain controller and is attempting to evade detection by tampering with audit policies. If confirmed malicious, this could lead to severe consequences, including data theft, privilege escalation, and full network compromise. Immediate investigation is required to determine the source and intent of the change.
This detection identifies when an Active Directory Group Policy Object (GPO) is disabled. Adversaries may disable GPOs to impair defenses, remove security policies, or facilitate other malicious activities within the domain. The rule specifically looks for EventCode 5136 with AttributeLDAPDisplayName 'flags' and an AttributeValue indicating the GPO is disabled (values 1, 2, or 3). It then joins this with Active Directory monitoring data to get the display name of the GPO.
The following analytic identifies the execution of `auditpol.exe` with the "/clear" command-line argument used to clears the audit policy. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity can be significant as it indicates potential defense evasion by adversaries or Red Teams, aiming to limit data that can be leveraged for detections and audits. If confirmed malicious, this behavior could allow attackers to bypass defenses, and plan further attacks, potentially leading to full machine compromise or lateral movement.
The following analytic identifies the execution of `auditpol.exe` with the "/set" command-line argument in order to disable a specific category or sub-category from the audit policy. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity can be significant as it indicates potential defense evasion by adversaries or Red Teams, aiming to limit data that can be leveraged for detections and audits. If confirmed malicious, this behavior could allow attackers to bypass defenses, and plan further attacks, potentially leading to full machine compromise or lateral movement.
This detection identifies instances where a Windows Firewall rule is added by monitoring Event ID 4946 in the Windows Security Event Log. Firewall rule modifications can indicate legitimate administrative actions, but they may also signal unauthorized changes, misconfigurations, or malicious activity such as attackers allowing traffic for backdoors or persistence mechanisms. By analyzing fields like RuleName, RuleId, Computer, and ProfileChanged, security teams can determine whether the change aligns with expected behavior. Correlating with user activity and process execution can help distinguish false positives from real threats, ensuring better visibility into potential security risks.
The analytic identifies the execution of `auditpol.exe` with the "/resourceSACL" flag, and either the "/clear" or "/remove" command-line arguments used to remove or clear the global object access audit policy. This activity can be significant as it indicates potential defense evasion by adversaries or Red Teams, aiming to limit data that can be leveraged for detections and audits. If confirmed malicious, this behavior could allow attackers to bypass defenses, and plan further attacks, potentially leading to full machine compromise or lateral movement.
The following analytic identifies the execution of the legacy `auditpol.exe` included with the Windows 2000 Resource Kit Tools, with the "/disable" command-line argument or one of the allowed category flags and the "none" option, in order to disable a specific logging category from the audit policy. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity can be significant as it indicates potential defense evasion by adversaries or Red Teams, aiming to limit data that can be leveraged for detections and audits. If confirmed malicious, this behavior could allow attackers to bypass defenses, and plan further attacks, potentially leading to full machine compromise or lateral movement.
The following analytic identifies the execution of `auditpol.exe` with the "/restore" command-line argument used to restore the audit policy from a file. This activity can be significant as it indicates potential defense evasion by adversaries or Red Teams, aiming to limit data that can be leveraged for detections and audits. Attackers can provide an audit policy file that disables certain or all audit policy configuration. If confirmed malicious, this behavior could allow attackers to bypass defenses, and plan further attacks, potentially leading to full machine compromise or lateral movement.
The following analytic identifies the execution of `auditpol.exe` with the "/set" flag, and "/sd" command-line arguments used to modify the security descriptor of the audit policy. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity can be significant as it indicates potential defense evasion by adversaries or Red Teams, aiming to limit data that can be leveraged for detections and audits. An attacker, can disable certain policy categories from logging and then change the security descriptor in order to restrict access to certain users or application from reverting their changes. If confirmed malicious, this behavior could allow attackers to bypass defenses, and plan further attacks, potentially leading to full machine compromise or lateral movement.
The following analytic detects modifications to default Group Policy Objects (GPOs) using the Group Policy Management Editor (GPME). It leverages the Endpoint data model to identify processes where `mmc.exe` executes `gpme.msc` with specific GUIDs related to default GPOs. This activity is significant because default GPOs, such as the `Default Domain Controllers Policy` and `Default Domain Policy`, are critical for enforcing security policies across the domain. If malicious, such modifications could allow an attacker to gain further access, establish persistence, or deploy malware across numerous hosts, severely compromising the network's security.
The analytic identifies the execution of `auditpol.exe` with the "/set" and "/exclude" command-line arguments. This indicates that a user's per-user policy will suppress auditing regardless of the system audit policy. This activity can be significant as it indicates potential defense evasion by adversaries or Red Teams, aiming to exclude specific user events from log data. If confirmed malicious, this behavior could allow attackers to bypass defenses and plan further attacks, potentially leading to full machine compromise or lateral movement.
This rule detects when an Entra ID (formerly Azure Active Directory) conditional access policy has been modified. It specifically looks for 'USER_RESOURCE_UPDATE_CONTENT' events within Office 365, targeting the 'AzureActiveDirectory' application, where the 'extendedAuditEventCategory' is 'Policy' and the 'product_event_type' is 'Update policy.'. This indicates a change to a conditional access policy, which could be a legitimate administrative action or a malicious attempt to alter security controls.
This rule detects when the Unified Audit Log (UAL) is disabled in Office 365. This is identified by monitoring for the 'Set-AdminAuditLogConfig' product event type where the 'UnifiedAuditLogIngestionEnabled' field is set to 'False'. Disabling the UAL can indicate an adversary attempting to impair defenses and avoid detection by preventing their actions from being logged.
Page 38 of 42