Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
867 detections
Filters
Last updated
All Time
Detection languages
333
198
127
108
69
Contributors
215
147
122
95
58
Categories
20,417
11,806
5,870
5,145
4,864
867
Platforms
326
269
122
95
90
Products / Services
204
196
168
111
93
MITRE Techniques
357
351
224
111
110
CVEs
5
2
1
1
1
IDS Classtypes
14
1
IDS Protocols
10
3
1
1
Detects when AWS Config Service is updated, stopped or deleted.
AWS GuardDuty Disabled
YARA-L
Detects when a GuardDuty Detector is disabled or suspended.
Detects when AWS IAM AdministratorAccess policy is attached to a user, group or role which can be used for privilege escalation.
Detects when an existing password policy is updated or deleted in an AWS account.
Identifies when multi-factor authentication (MFA) is disabled for a Google Workspace organization. Security teams can monitor for changes to MFA configuration that may weaken the organization's security posture.
Detects the execution of EDRSilencer, a tool that manipulates the Windows Filtering Platform (WFP) to block outbound network traffic from EDR agents. This is identified by monitoring Windows Security Event IDs 5441 (A Windows Filtering Platform filter has been added) or 5447 (A Windows Filtering Platform filter has been changed) in conjunction with the specific filter name 'Custom Outbound Filter' used by EDRSilencer.
Detects when an access policy that is applied to a GCP cloud resource is deleted.
An adversary would be able to remove access policies to gain access to a GCP cloud resource.
An adversary would be able to remove access policies to gain access to a GCP cloud resource.
This rule detects when a single rule or all rules have been deleted from the Windows Defender Firewall exception list. This activity can indicate an adversary attempting to impair defenses by removing firewall restrictions to facilitate command and control, lateral movement, or data exfiltration.
This rule detects attempts to tamper with Windows audit policies using the `auditpol.exe` utility. Threat actors often modify audit policies to impair detection capabilities by disabling, clearing, removing, or restoring specific audit policies, thereby reducing the logging of their malicious activities.
This rule detects changes to the device registration policy within Azure. Such modifications can be used by adversaries to evade defenses, escalate privileges, or enable unauthorized device registrations, potentially leading to broader access to the environment. The detection specifically looks for 'Set device registration policies' activity within the 'Policy' category of Azure Audit Logs.
Detects when the password policy is enumerated on a Windows system. This activity is logged as Event ID 4661, specifically looking for access rights related to 'ReadPasswordParameters' on objects within the 'Security Account Manager'. This can indicate an adversary attempting to gather information about password requirements to aid in further attacks like password guessing or brute-forcing.
Identifies when an Azure Network Firewall Policy is modified or deleted. This could indicate an attempt to bypass security controls or disrupt network segmentation.
Detects scenarios where system auditing (i.e.: Windows event log auditing) is disabled. This may be used in a scenario where an entity would want to bypass local logging to evade detection when Windows event logging is enabled and reviewed. It is recommended to turn off "Local Group Policy Object Processing" via GPO to ensure Active Directory GPOs take precedence over local/edited computer policies.
Detects an attempt to install a device that is forbidden by the system policy, indicated by Windows Security Event ID 6423. This event signifies that a device installation was blocked due to a configured policy.
Detects attempts to modify Group Policy settings related to system behavior or security features by analyzing PowerShell script block logs. This rule specifically looks for modifications to registry paths associated with Group Policy settings, such as refresh times or SmartScreen configurations, which could indicate an adversary attempting to establish persistence, evade defenses, or escalate privileges.
Detects when settings of the Windows firewall have been changed, indicated by specific Event IDs from the Windows Defender Firewall with Advanced Security log. This can be an indicator of an adversary attempting to bypass network controls.
Detects when an attempt is made to add or remove applications or folders from Windows Defender Exploit Guard's "ProtectedFolders" or "AllowedApplications" configurations. This could indicate an adversary trying to bypass Controlled Folder Access protections.
Detects when the 'Automatic Sample Submission' feature of Windows Defender is disabled. This is indicated by a change in the antimalware platform configuration, specifically setting the 'SubmitSamplesConsent' registry value to '0x0'. Adversaries may disable this feature to prevent security products from submitting malicious samples for analysis, thereby hindering detection and analysis efforts.
This rule detects attempts to tamper with Windows audit policies using an older version of the `auditpol` binary, specifically from the NT resource kit. Adversaries may use this method to disable or remove certain audit policies, or restore a custom policy, thereby impairing detection capabilities by limiting the logging of security-relevant events.
Detects attempts to change the PowerShell script execution policy to a less secure level (Unrestricted or Bypass) using the `Set-ExecutionPolicy` cmdlet. This action can allow unsigned or untrusted scripts to run, increasing the risk of malicious code execution.
Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region.
Disabling default encryption does not change the encryption status of your existing volumes.
Disabling default encryption does not change the encryption status of your existing volumes.
Page 41 of 42