Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
837 detections
Filters
Last updated
All Time
Detection languages
436
190
77
62
40
Contributors
120
114
72
71
68
Categories
462
233
193
152
120
Platforms
288
272
154
88
56
Products / Services
220
169
162
90
74
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
837
CVEs
6
5
5
5
5
IDS Classtypes
4
2
IDS Protocols
1
This analytic detects an increase in modifications to Active Directory groups or objects. Frequent changes to AD groups or objects can indicate potential security risks, such as unauthorized access attempts, impairing defenses, or establishing persistence. By monitoring AD logs for unusual modification patterns, this detection helps identify suspicious behavior that could compromise the integrity and security of the AD environment. The rule specifically looks for a statistically significant increase in the number of unique objects modified by a source user over a 5-minute span, compared to their historical average and standard deviation.
This analytic identifies failed attempts to delete AWS IAM groups. It leverages AWS CloudTrail logs to detect events where the DeleteGroup action fails due to errors like NoSuchEntityException, DeleteConflictException, or AccessDenied. This activity is significant as it may indicate unauthorized attempts to modify IAM group configurations, which could be a precursor to privilege escalation or other malicious actions. If confirmed malicious, this could allow an attacker to disrupt IAM policies, potentially leading to unauthorized access or denial of service within the AWS environment.
The following analytic identifies the successful deletion of an IAM group in AWS. It leverages CloudTrail logs to detect `DeleteGroup` events with a success status. This activity is significant as it could indicate potential changes in user permissions or access controls, which may be a precursor to further unauthorized actions. If confirmed malicious, an attacker could disrupt access management, potentially leading to privilege escalation or unauthorized access to sensitive resources. Analysts should review related IAM events, such as recent user additions or new group creations, to assess the broader context.
The analytic detects attempts to reset the Directory Services Restore Mode (DSRM) administrator password on a Domain Controller. It leverages event code 4794 from the Windows Security Event Log, specifically looking for events where the DSRM password reset is attempted. This activity is significant because the DSRM account can be used similarly to a local administrator account, providing potential persistence for an attacker. If confirmed malicious, this could allow an attacker to maintain administrative access to the Domain Controller, posing a severe risk to the domain's security.
Detects when a user attaches a Lambda layer to an existing AWS Lambda function. A malicious Lambda layer could execute arbitrary code in the context of the function's IAM role, potentially granting an adversary access to resources the function has access to. This activity could indicate privilege escalation or unauthorized modification of serverless functions.
Detects when a GitHub Personal Access Token is created from a known Tor exit node IP address. An adversary may create a Personal Access Token before carrying out follow up actions such as cloning GitHub repositories to steal data.
This rule detects HTTP 400 Bad Request errors when attempting to interact with the Microsoft Graph API's /v1.0/groups endpoint via a POST request. This specific activity can indicate a failed attempt to duplicate a group, potentially by tools like GraphRunner's Invoke-SecurityGroupCloner function. It focuses on identifying issues during group creation or modification operations within Azure AD through the Graph API.
Detects when an SSH deploy key is added or modified in a GitHub repository. A compromised or unauthorized deploy key could allow malicious actors to push unauthorized changes into production environments, potentially bypassing code reviews and testing procedures. This could lead to the introduction of backdoors, malware, or the exfiltration of sensitive data.
Detects when a user is blocked from accessing repositories within a GitHub organization.
Detects when a user is unblocked from accessing repositories within a GitHub organization.
Detects when a group is attempted to be created but fails in Office 365. This could be due to insufficient permissions or other errors
Detects when a group is created in Office 365.
Detects when a user is added to a group in Office 365.
Detects when a group GUID in Office 365 has more users added to it by the same user than a defined thresold.
Detects when a user is removed from a group in Office 365.
Entra ID application was restored. This implies a soft delete was performed at some point but less than 30 days ago.
This rule detects when a Google Cloud Platform (GCP) Identity and Access Management (IAM) Organization Policy is either updated or deleted. Such actions can indicate an attempt to modify security controls, potentially to facilitate persistence or privilege escalation within the GCP environment. Monitoring these changes is crucial for maintaining the security posture of an organization's cloud resources.
This rule identifies when a Google Workspace user account is moved between Organizational Units (OUs). This activity can be a legitimate administrative action, but it can also be used by an attacker to move a compromised account to an OU with different policies, potentially granting them more privileges or evading existing security controls. For example, an attacker might move an account to an OU with less stringent multi-factor authentication requirements or different access policies to sensitive data.
This rule identifies when the password policy configuration is changed within Google Workspace. Monitoring these changes is crucial for security teams to detect potential weakening of the organization's security posture, which could be exploited by adversaries to maintain or elevate access.
Detects AWS IAM activities originating from an EC2 instance that could be used to retain access or escalate privileges. This includes actions like creating users, attaching policies, creating/updating login profiles, creating access keys, creating groups, and creating roles.
This rule detects AWS IAM activities associated with the S3 Browser utility. Specifically, it looks for attempts to create new users (`CreateUser`), create login profiles (`CreateLoginProfile`), create access keys (`CreateAccessKey`), or put user policies (`PutUserPolicy`) within AWS IAM. The detection is triggered when these actions are performed and the HTTP user agent string in the CloudTrail log indicates the use of 'S3 Browser'. This combination of actions and user agent suggests potential account manipulation for persistence or privilege escalation within an AWS environment.
Page 39 of 40