Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
25 detections
Filters
Last updated
All Time
Detection languages
22
2
1
Contributors
19
1
1
1
1
Categories
18
11
5
3
3
Platforms
18
3
3
1
1
Products / Services
12
9
5
3
2
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Endpoint Health with AV information
List all the scan types and device name of those scansg
The analytic identifies threats blocked by the Zscaler proxy based on behavior analysis. It leverages web proxy logs to detect entries where actions are blocked and threat names and classes are specified. This detection is significant as it highlights potential malicious activities that were intercepted by Zscaler's behavior analysis, providing early indicators of threats. If confirmed malicious, these blocked threats could indicate attempted breaches or malware infections, helping security teams to understand and mitigate potential risks in their environment.
Detects when Windows Defender's Antimalware Scan Interface (AMSI) triggers an alert, indicating that it has detected malware or other potentially unwanted software. This rule specifically looks for Event ID 1116 with the SourceName 'AMSI' from the Windows Defender log source.
Page 2 of 2