Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,088 detections
Filters
Last updated
All Time
Detection languages
619
191
113
86
47
Contributors
302
211
112
88
54
Categories
481
416
353
192
164
Platforms
726
348
216
136
57
Products / Services
518
292
197
124
88
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,088
CVEs
5
5
5
5
4
IDS Classtypes
3
2
1
1
IDS Protocols
3
This rule detects when the AWS IAM AdministratorAccess policy is attached to a user, group, or role. This action grants full administrative privileges and can be used by an attacker for privilege escalation, persistence, or to establish initial access within an AWS environment. The rule specifically looks for CloudTrail events indicating policy attachment actions (AttachUserPolicy, AttachGroupPolicy, AttachRolePolicy) where the target resource is the predefined 'AdministratorAccess' policy and the action was allowed.
This rule detects when a user is assigned 'Super user' privileges within the OneLogin SSO system. It specifically looks for events where the event type is 'USER_CHANGE_PERMISSIONS', the product is 'ONELOGIN_SSO', the vendor is 'ONELOGIN', the product event type indicates a permission grant (code 72), and the target resource name is 'Super user'. This indicates a significant privilege escalation within the identity provider.
This rule detects successful user authentications to Okta that occur outside of typical business hours or on weekends. It specifically flags logins on Saturdays and Sundays, and logins between 8 PM and 7 AM UTC on weekdays. The rule calculates a risk score based on the day and time of the login, with higher scores for weekend logins and late-night/early-morning logins.
This rule detects suspicious user login activity where a single user attempts to log in from multiple distinct countries within a 24-hour period. This behavior can indicate a compromised account being used by an attacker from a different geographic location than the legitimate user, or a user attempting to bypass security controls. The rule also assigns a higher risk score if the login originates from specific high-risk countries (Cuba, Iran, North Korea, Russia, Syria).
Identifies when a user account is unsuspended in Google Workspace.
Detects API Calls from AWS accounts that are not part of the organization.
Detect when a user logs into AWS console without MFA.
Detect when GCP Workload identity pools are disabled or deleted. Disabling or deleting a pool will prevent any connected identities from accessing all GCP resources.
Identifies when an external user account is added to a group in Google Workspace. Security teams can monitor for unexpected user accounts being added to Google Workspace groups to prevent unauthorized access to data.
Detects when AWS IAM AdministratorAccess policy is attached to a user, group or role which can be used for privilege escalation.
Detects when an AWS IAM user creates an AWS Access Key for programmatic calls.
This rule identifies sign-in attempts from geographically distant locations within a short timeframe, which is indicative of an "impossible travel" scenario. It also considers if one of these locations is atypical for the user based on their past behavior. This pattern often suggests that an attacker has compromised user credentials and is attempting to access the account from a new, unusual location, potentially using a VPN or proxy service to mask their true origin.
Identifies when a service principal was removed in Azure. This action could indicate an attempt to remove legitimate service accounts to hinder detection or to clean up after malicious activity.
This rule detects the use of the Resource Owner Password Credentials (ROPC) authentication flow. ROPC is generally discouraged because it requires applications to directly handle user credentials, increasing the risk of credential compromise. While it can be used for automated testing or legacy applications, its presence in other contexts may indicate a security weakness or an attempt to bypass more secure authentication mechanisms.
Detects sign-in attempts with properties (e.g., device, location, browser) that are unusual or unfamiliar compared to a user's past sign-in history. This rule leverages Azure AD Identity Protection's risk detection capabilities to identify anomalous sign-ins.
This rule detects sign-in attempts originating from a country that is considered new or infrequent for the user based on their past activity locations. This behavior can indicate a compromised account being used by an attacker from an unusual geographic location.
This rule detects anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser. This indicates a potential compromise of user credentials or an attempt to bypass authentication mechanisms.
Page 52 of 52