Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,235 detections
Filters
Last updated
All Time
Detection languages
734
214
105
78
51
Contributors
206
187
159
111
90
Categories
396
296
264
260
247
Platforms
492
314
281
204
110
Products / Services
379
234
152
109
106
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,235
CVEs
9
9
4
4
4
IDS Classtypes
11
6
4
2
1
IDS Protocols
10
5
3
This rule detects when user accounts are created or deleted in Azure Active Directory by users who are not on an approved list. It specifically looks for 'Add user' or 'Delete user' messages in the audit logs with a 'Success' status, and then filters out actions initiated by known, approved administrators.
This rule detects when a user is added to an administrator's role within Azure Active Directory. This is a critical event as it grants elevated privileges to the user, which could be abused for malicious purposes such as persistence, privilege escalation, or initial access. The detection specifically looks for 'Add member to role.' operations in AzureActiveDirectory workload where the new role value ends with 'Admins' or 'Administrator'.
Detects the creation of suspicious files associated with Proof-of-Concept (PoC) exploits targeting the Windows Print Spooler Remote Code Execution Vulnerabilities, specifically CVE-2021-34527 (PrinterNightmare) and CVE-2021-1675. The rule looks for file creations within the ':\Windows\System32\spool\drivers\x64\' directory, which is a known location for files dropped by these exploits.
This rule detects interactive console logons (LogonType 2) to server systems and domain controllers. It specifically looks for successful (EventID 528, 4624) and failed (EventID 529, 4625) interactive logon attempts. The rule filters out events where the logon process name is 'Advapi' and the computer is a workstation, aiming to reduce false positives from legitimate workstation activities.
This rule detects when Privileged Identity Management (PIM) alerts are disabled within Azure. Disabling PIM alerts can be a defense evasion tactic, as it prevents security teams from being notified of critical activities related to privileged roles, potentially allowing an attacker to operate undetected after gaining initial access or escalating privileges.
Detects when a modification (create, update, replace, delete, or patch) action is taken that affects mutating or validating webhook configurations in Kubernetes. Adversaries can abuse these configurations to achieve persistence, exfiltrate credentials, or escalate privileges within the cluster.
Detects successful sign-ins by privileged role accounts that occur outside of normal business hours or from unusual geographic locations. This rule is designed to flag potentially suspicious activity that could indicate compromised credentials or insider threat activity, especially for administrative accounts.
This rule detects successful sign-in attempts to Azure AD from devices that are not registered in Active Directory (non-compliant devices) and where Multi-Factor Authentication (MFA) was not required. The sign-in is also flagged as 'atRisk' by Azure AD. This scenario can indicate an adversary attempting to gain initial access or maintain persistence using compromised credentials from an unregistered device, bypassing stronger authentication controls.
This rule identifies a critical security misconfiguration or bypass scenario within Azure Privileged Identity Management (PIM) where a privileged role can be activated without requiring multi-factor authentication (MFA). This can significantly increase the risk of unauthorized access and privilege escalation if an attacker compromises credentials for an account with PIM roles.
Identifies when an admission controller is executed in GCP Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.
Detects successful RDP logons originating from public IP addresses. This can indicate an exposed RDP port being accessed externally, potentially by an attacker.
Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access to instances. This activity could lead to initial access, persistence, or privilege escalation, potentially compromising sensitive data and operations.
This rule identifies when a user or application modifies the federation settings on a domain within Azure Active Directory. Such modifications can impact how users authenticate and can be leveraged by attackers for persistence, privilege escalation, or defense evasion by altering trust relationships.
This rule identifies when a privileged role assignment occurs in Azure Active Directory (now Microsoft Entra ID) without utilizing Privileged Identity Management (PIM). Such assignments bypass the just-in-time access and approval workflows provided by PIM, potentially indicating an attacker attempting to establish persistent privileged access or escalate privileges outside of established security controls.
This rule detects attempts to enable the guest account on macOS systems using the `sysadminctl` utility. Adversaries may enable the guest account to establish persistence, evade defenses, or gain initial access by leveraging a default, often less monitored, account.
This rule detects a measurable increase of successful authentications, specifically when the count of successful sign-ins increases by 10% or greater. This could indicate an adversary attempting to gain access through brute-force, password spraying, or credential stuffing attacks, or potentially an increase in legitimate user activity that needs to be baselined.
Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.
Detects a failed logon attempt from a public IP address on a Windows system. This can indicate an attempt to gain unauthorized access, potentially through brute-force attacks or credential stuffing, especially if the system is not intended to be exposed to the internet for direct login.
Detects the creation or modification of a computer account or user account with a suspicious name pattern 'SAMTHEADMIN-X$' (where X is a number) which is known to be generated by a hacktool exploiting CVE-2021-42287 and CVE-2021-42278. This pattern is associated with the 'Sam the Admin' vulnerability exploitation.
This rule detects suspicious sign-in activities that occur shortly after a network connection to an IP address associated with 'Lab539 Clickfix'. It correlates risky sign-in events from Azure Active Directory (AAD) with network connection logs from devices. Specifically, it looks for AAD sign-ins with a risk level of 30 or higher, from non-guest, non-compliant, and non-managed devices, where the IP address has not been seen for that user in the last 30 days. This is then joined with network connection events to IP addresses found in the 'Lab539 Clickfix' external data, ensuring the sign-in occurs after the network connection within a short timeframe. The 'Lab539 Clickfix' reference suggests a connection to a known threat or campaign, possibly related to phishing or credential compromise.
Detects instances where an SSH service on an OpenCanary honeypot node has had a login attempt. This indicates an adversary attempting to gain unauthorized access to a system, likely through brute-force or credential stuffing attacks against the honeypot.
Page 43 of 59