Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,088 detections
Filters
Last updated
All Time
Detection languages
619
191
113
86
47
Contributors
302
211
112
88
54
Categories
481
416
353
192
164
Platforms
726
348
216
136
57
Products / Services
518
292
197
124
88
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,088
CVEs
5
5
5
5
4
IDS Classtypes
3
2
1
1
IDS Protocols
3
This rule identifies when the HTTP DELETE method is used within the Microsoft Graph API. This can indicate administrative activities such as deleting users, groups, or other resources. The rule specifically looks for network HTTP events where the product event type is 'Microsoft Graph Activity' and the HTTP method is 'DELETE'. It excludes IP addresses within a specific Azure CIDR range (20.151.0.0/16) to reduce noise from internal Azure operations. Further tuning can be applied to target specific API endpoints or user agents.
This rule detects successful group deletion events within Microsoft Entra ID (formerly Azure AD). It specifically looks for audit logs where the event type is 'GROUP_DELETION', the product event type is 'Delete group', the product is 'Azure AD Directory Audit', the vendor is 'Microsoft', and the security result indicates the action was 'ALLOW'. The rule also groups these events by user over a 5-minute window.
This rule detects when a user is successfully removed from a group within Office 365. It specifically looks for 'GROUP_MODIFICATION' events with the product event type 'Remove member from group.' from Microsoft Office 365, where the action was allowed.
Detects when a GitHub application is installed within an organization. An untrusted application can be installed and granted permissions to access data within a GitHub organization.
This rule detects the hard deletion of an application within Entra ID (formerly Azure AD). A 'hard delete' means the application is permanently removed without a recovery option, which can indicate malicious activity such as an attacker attempting to remove traces of their presence or disrupt services by deleting critical applications.
Detects when a group is successfully deleted in Office 365. This rule specifically looks for events where the event type is 'GROUP_DELETION', the product event type is 'Delete group.', the product is 'Office 365', the vendor is 'Microsoft', and the security result action is 'ALLOW'. It also tracks the user responsible for the deletion.
Logins to Azure AD PowerShell app can have legitimate purposes, but are also abused to gain access to user information. Programatic access to Azure AD should generally be through other apps
Detects authentication to O365 followed by a non-interactive sign-ins that aligns to suspicious activity.
Detects API calls originating from AWS accounts that are not part of the organization, based on a reference list of approved AWS account IDs. This could indicate unauthorized access or activity from external entities.
This rule detects when a single user generates an excessive number of 'Permission Denied' events within a one-hour timeframe in Google Cloud Platform (GCP). Specifically, it looks for more than 5 'BLOCK' actions with a severity of 'ERROR' and a status code of '7' (which typically indicates 'Permission Denied' in GCP API errors) from a single user. Additionally, it requires these events to span across more than one target application and more than one product event type, which helps to reduce false positives by indicating broader activity rather than a single, isolated error.
Detects successfully authenticated user logins to Okta based on Okta's Behavior Detection pattern analysis, specifically looking for high-risk indicators such as new geo-location, new device, new IP, new city, new state, new country, or velocity anomalies. It also flags logins originating from unauthorized target geographies like Cuba, Iran, North Korea, Russia, and Syria. The rule only applies to existing users, not newly created ones.
This rule detects successful logins to the AWS console where Multi-Factor Authentication (MFA) was not used. It specifically looks for 'ConsoleLogin' events from AWS CloudTrail with an 'ALLOW' action and where 'MFAUsed' is explicitly set to 'No'. The rule also increases the risk score if the login is performed by a 'Root' user.
This rule identifies when a new application from the Google Workspace Marketplace is added to a Google Workspace organization. Installing certain third-party applications can introduce security risks such as data exfiltration, data leakage, or an expanded attack surface for the organization.
This rule identifies when an external user account is added to a group within Google Workspace. This detection helps security teams monitor for unauthorized or unexpected additions of external users to internal groups, which could lead to unauthorized access to sensitive data or resources. The rule works by comparing the domain of the group with the domain of the user being added; if they differ, it indicates an external user is being added.
Detects when an AWS IAM user creates an AWS Access Key for programmatic calls. This action can be used by adversaries to establish persistence or escalate privileges within an AWS environment.
This rule identifies when a user account is unsuspended within Google Workspace. Unsuspending an account can be a legitimate administrative action, but it can also indicate an adversary reactivating a previously disabled account to regain access or enable further malicious activity. Monitoring this activity is crucial for detecting potential account takeover or persistence mechanisms.
This rule detects when a Google Cloud Workload Identity Pool is either disabled or deleted. Workload Identity Pools are used to manage external identities (e.g., from AWS, Azure, or on-premises identity providers) that need to access Google Cloud resources. Disabling or deleting a Workload Identity Pool will immediately revoke access for all federated identities associated with that pool, potentially leading to a denial of service for legitimate users or indicating an attempt by an attacker to disrupt operations or remove traces of their access. The rule specifically looks for the 'google.iam.v1.WorkloadIdentityPools.DeleteWorkloadIdentityPool' event or an 'google.iam.v1.WorkloadIdentityPools.UpdateWorkloadIdentityPool' event where the 'req_identityPool_disabled' attribute is set to 'true'.
This rule detects successful API executions within Google Cloud Platform (GCP) that originate from an IP address identified as a Tor exit node. It correlates GCP Cloud Audit logs, specifically looking for 'ALLOW' actions, with a GCTI (Google Cloud Threat Intelligence) feed that lists known Tor exit node IP addresses. The rule also calculates a risk score, with additional weight given if the originating IP is from certain high-risk countries (Cuba, Iran, North Korea, Russia, Syria).
This rule detects when an Okta end-user reports suspicious activity on their account. This could indicate that the user's account has been compromised or is being targeted by an attacker. The rule specifically looks for the 'user.account.report_suspicious_activity_by_enduser' event type in Okta logs. The risk score is increased if the suspicious activity event type is related to an MFA enrollment notification being sent, suggesting a potential attempt to enroll an unauthorized MFA device.
Detects when a single user successfully logs into Okta from multiple distinct cities within a 24-hour period. This behavior can indicate a compromised account being used by an attacker from a different geographical location than the legitimate user, or a user traveling rapidly between distant locations. The rule also incorporates risk scoring based on Okta ThreatInsight and logins from suspicious countries.
This rule detects multiple failed login attempts from different users originating from the same IP address within a one-hour window in OneLogin. It specifically looks for 'USER_LOGIN' events with a 'BLOCK' security result and a product event type of '6' (user failed authentication). The rule also calculates a risk score, which is increased if the originating IP address is from certain unauthorized geographies (Cuba, Iran, North Korea, Russia, Syria). This behavior is indicative of potential brute-force attacks or credential stuffing attempts against multiple user accounts from a single source.
Page 51 of 52