Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
597 detections
Filters
Last updated
All Time
Detection languages
285
97
95
69
31
Contributors
186
88
47
47
44
Categories
20,401
11,795
5,864
5,145
4,864
597
Platforms
300
161
158
103
25
Products / Services
221
148
147
132
88
MITRE Techniques
536
265
233
226
98
CVEs
5
5
5
5
4
IDS Classtypes
1
IDS Protocols
1
This rule detects a sequence of events where a new user account is created in Entra ID (formerly Azure AD) and then, shortly after, that same user is assigned an administrative-level role. This behavior can indicate an attacker establishing persistence or escalating privileges by creating a new account and immediately granting it high-level access.
Detect users who are newly created and then immediately assigned administrator level roles
Adding users to roles is expected but if it occurs outside of PIM, validation should occur
Detects when a user is created in Entra ID and assigned roles within a defined time window.
Detects when an Okta user's password is reset and MFA factor(s) are deactivated or reset within a 30-minute time window. This activity may indicate that the user account has been compromised, as an attacker might reset the password and then disable MFA to maintain access.
This rule detects when a user is blocked from accessing repositories within a GitHub organization. This event is captured from GitHub's audit logs and specifically looks for the 'org.block_user' event type. The rule identifies both the actor who performed the blocking action and the target user who was blocked.
Detects when an Okta user's password is reset and MFA factor(s) are deactivated or reset within a 30 minute time window. This activity may indicate that the user account has been compromised.
This rule detects the successful creation of a new group within Microsoft Graph API. It specifically looks for HTTP POST requests to the `/v1.0/groups` endpoint that result in a 201 (Created) HTTP response code. The rule's description indicates it can be triggered by the `Invoke-SecurityGroupCloner` function from the GraphRunner tool, which is used for cloning security groups.
This rule detects when a user is successfully removed from a group within Office 365. It specifically looks for 'GROUP_MODIFICATION' events with the product event type 'Remove member from group.' from Microsoft Office 365, where the action was allowed.
Detects when a user is blocked from accessing repositories within a GitHub organization.
Detects when a user is unblocked from accessing repositories within a GitHub organization.
This rule detects when highly privileged administrative roles, specifically 'Owner' or 'Editor', are assigned to a service account within Google Cloud Platform. This activity is significant because service accounts with such elevated permissions can be leveraged by attackers for persistence, privilege escalation, and to perform a wide range of actions within the GCP environment, potentially leading to compromise of cloud resources.
This rule identifies when a Google Workspace user account is moved between Organizational Units (OUs). This activity can be a legitimate administrative action, but it can also be used by an attacker to move a compromised account to an OU with different policies, potentially granting them more privileges or evading existing security controls. For example, an attacker might move an account to an OU with less stringent multi-factor authentication requirements or different access policies to sensitive data.
This rule identifies when a user account is unsuspended within Google Workspace. Unsuspending an account can be a legitimate administrative action, but it can also indicate an adversary reactivating a previously disabled account to regain access or enable further malicious activity. Monitoring this activity is crucial for detecting potential account takeover or persistence mechanisms.
This rule detects when free Google email addresses (gmail.com, googlemail.com, or googlegroups.com) are added to an IAM policy in Google Cloud Platform. This activity is suspicious as it could indicate an attempt by an attacker to establish persistence or escalate privileges by granting access to an external, potentially untraceable, account.
Detects AWS IAM activities originating from an EC2 instance that could be used to retain access or escalate privileges. This includes actions like creating users, attaching policies, creating/updating login profiles, creating access keys, creating groups, and creating roles.
Identifies when a user account is unsuspended in Google Workspace.
Detects when a user is assigned super user privileges.
Identifies when an administrator role is assigned to a user account in Google Workspace. Security teams can monitor for the malicious or accidental assignment of administrator privileges to prevent unauthorized access to data.
Identifies when a Google Workspace user account is moved between Organizational Units.
This rule detects the creation or activation of new user accounts in Okta with specific display names, such as 'svc_network_backup', which were identified as indicators of compromise during the Okta Support System 2023 breach. It aims to flag suspicious account activity that could indicate unauthorized access or persistence by an attacker. The rule can be improved by filtering out legitimate usernames if 'svc_network_backup' is a known and authorized account in the environment.
Page 28 of 29