Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
867 detections
Filters
Last updated
All Time
Detection languages
333
198
127
108
69
Contributors
215
147
122
95
58
Categories
20,417
11,806
5,870
5,145
4,864
867
Platforms
326
269
122
95
90
Products / Services
204
196
168
111
93
MITRE Techniques
357
351
224
111
110
CVEs
5
2
1
1
1
IDS Classtypes
14
1
IDS Protocols
10
3
1
1
This rule detects when the Unified Audit Log is enabled in Office 365. This event is triggered when the 'Set-AdminAuditLogConfig' cmdlet is used to set 'UnifiedAuditLogIngestionEnabled' to 'True'. While enabling logging is generally a positive security action, this rule is designed to alert if logging was previously disabled and is now being re-enabled, which could indicate an adversary attempting to cover their tracks after a period of operating without logging, or to restore logging after intentionally disabling it.
Adding users to administrative roles is needed but due to sensitivity of these roles, validation should occur when this occurs
Detect when the Unified Audit Log is disabled
Detects when an Entra ID conditional access policy has been modified
Detect when the Unified Audit Log is enabled
This rule detects when changes are made to a GitHub organization's fine-grained Personal Access Token (PAT) approval policy. Specifically, it triggers on events related to enabling or disabling the auto-approval of PAT requests, or enabling or disabling the forbidding of auto-approval for PAT requests. Such changes could indicate an attempt to weaken security controls around PATs, potentially allowing for easier creation of tokens that could be used for unauthorized access.
Detects when branch protection rules are disabled for a GitHub repository. This action can indicate an adversary attempting to bypass security controls to push malicious code or make unauthorized changes to a codebase.
This rule detects when vulnerability alerts are disabled for GitHub Dependabot. Disabling these alerts can prevent developers from being notified about security vulnerabilities in their dependencies, potentially leading to unpatched systems and increased risk. This action could be an attempt by an attacker to impair defenses and hide their activities or to prevent the organization from identifying and remediating vulnerabilities.
This rule detects when GitHub secret scanning components are disabled or bypassed at the enterprise, organization, or repository level. This includes disabling secret scanning entirely, disabling it for new repositories, or bypassing push protection for custom patterns or generic secrets. Such actions can significantly reduce the security posture by allowing sensitive information to be committed to repositories without detection.
Detects when two-factor authentication requirements are disabled for a GitHub enterprise or organization. This could indicate an attacker attempting to weaken security controls to facilitate unauthorized access or maintain persistence.
Detects when third-party application access restrictions are disabled for a GitHub organization.
Detects when components of GitHub secret scanning is disabled for an enterprise or organization.
Detects when two-factor authentication requirements are disabled for a GitHub enterprise or organization.
Detects when vulnerability alerts are disabled for GitHub Dependabot.
Detects when a GitHub audit log stream is destroyed. An adversary may attempt to destroy audit logs to erase their tracks.
Detects when changes are made to a GitHub organization's fine-grained Personal Access Token approval policy.
Detects when changes are made to a GitHub enterprise or organization's Single Sign-On (SSO) configuration.
Detects when Google Cloud Audit logs are removed from all services at either the project or organization level. This action can indicate an adversary attempting to impair defenses by disabling logging to hide their activities.
This rule detects when a Google Cloud Platform (GCP) BigQuery dataset's access policy is modified to include 'allUsers' or 'allAuthenticatedUsers'. This action effectively makes the dataset publicly accessible, which can lead to unauthorized data exposure and potential data exfiltration. The rule specifically looks for 'IAMPolicy.SetIamPolicy' events on BigQuery resources where a binding delta adds a role (e.g., 'roles/bigquery.dataViewer') to either 'allUsers' or 'allAuthenticatedUsers'.
This rule detects when a Google Cloud Platform (GCP) Identity and Access Management (IAM) Organization Policy is either updated or deleted. Such actions can indicate an attempt to modify security controls, potentially to facilitate persistence or privilege escalation within the GCP environment. Monitoring these changes is crucial for maintaining the security posture of an organization's cloud resources.
This rule identifies when multi-factor authentication (MFA) is disabled for a Google Workspace organization. This change can weaken the organization's security posture by removing an important layer of defense against unauthorized access. Security teams should monitor for such changes to prevent potential account compromise.
Page 39 of 42