Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,088 detections
Filters
Last updated
All Time
Detection languages
619
191
113
86
47
Contributors
302
211
112
88
54
Categories
481
416
353
192
164
Platforms
726
348
216
136
57
Products / Services
518
292
197
124
88
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,088
CVEs
5
5
5
5
4
IDS Classtypes
3
2
1
1
IDS Protocols
3
Detects successful AWS console logins that were performed without Multi-Factor Authentication (MFA).
This alert can be used to identify potential unauthorized access attempts, as logging in without MFA can indicate compromised credentials or misconfigured security settings.
This alert can be used to identify potential unauthorized access attempts, as logging in without MFA can indicate compromised credentials or misconfigured security settings.
Detects the deletion of an AWS SAML provider, potentially indicating malicious intent to disrupt administrative or security team access.
An attacker can remove the SAML provider for the information security team or a team of system administrators, to make it difficult for them to work and investigate at the time of the attack and after it.
An attacker can remove the SAML provider for the information security team or a team of system administrators, to make it difficult for them to work and investigate at the time of the attack and after it.
Detect failed attempts to sign in to disabled accounts.
Detects when Okta identifies new activity in the Admin Console.
Detects when a user creates action secret for the organization, environment, codespaces or repository.
Detects when a PIM elevation is approved or denied. Outside of normal operations should be investigated.
Detects when a temporary access pass (TAP) is added to an account. TAPs added to priv accounts should be investigated
Detects successful authentication from potential clients using legacy authentication via user agent strings. This could be a sign of MFA bypass using a password spray attack.
Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.
Detect access has been blocked by Conditional Access policies.
The access policy does not allow token issuance which might be sights≈ of unauthorizeed login to valid accounts.
The access policy does not allow token issuance which might be sights≈ of unauthorizeed login to valid accounts.
This rule detects and monitors sign-in attempts to third-party Artificial Intelligence (AI) applications within an organization's environment. It identifies sign-ins to known AI vendors and tools by matching keywords in application display names and resource display names from Entra ID (formerly Azure AD) sign-in logs. The rule specifically excludes Microsoft's own Copilot products to focus on 'shadow AI' usage. It aggregates sign-in attempts, successes, failures, unique users, and common failure reasons to provide insights into the adoption and potential risks associated with unsanctioned AI tool usage.
Detects user authentication failure events.
Please note that this rule can be noisy and it is recommended to use with correlation based on "author.name" field.
Please note that this rule can be noisy and it is recommended to use with correlation based on "author.name" field.
A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com.
This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected,
it should be validated from GitHub UI because the log entry may not provide full context.
This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected,
it should be validated from GitHub UI because the log entry may not provide full context.
Detects when changes are made to the SSH certificate configuration of the organization.
Detects S3 Browser utility performing reconnaissance looking for existing IAM Users without a LoginProfile defined then (when found) creating a LoginProfile.
Detects S3 browser utility creating Inline IAM policy containing default S3 bucket name placeholder value of "<YOUR-BUCKET-NAME>".
Detects S3 Browser utility creating IAM User or AccessKey.
Detects when a user has been elevated to manage all Azure Subscriptions.
This change should be investigated immediately if it isn't planned.
This setting could allow an attacker access to Azure subscriptions in your environment.
This change should be investigated immediately if it isn't planned.
This setting could allow an attacker access to Azure subscriptions in your environment.
Monitor and alert for Bitlocker key retrieval.
Monitor and alert for users added to device admin roles.
Detects when a configuration change is made to an applications AppID URI.
Page 38 of 52