Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
837 detections
Filters
Last updated
All Time
Detection languages
436
190
77
62
40
Contributors
120
114
72
71
68
Categories
462
233
193
152
120
Platforms
288
272
154
88
56
Products / Services
220
169
162
90
74
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
837
CVEs
6
5
5
5
5
IDS Classtypes
4
2
IDS Protocols
1
Detects when a service account key is created in or uploaded to a monitored Google Cloud project.
Identifies when Google Workspace password policy is changed. Security teams can monitor for changes to password policy configuration that may weaken the organization's security posture.
Detect when admin privileged roles such as Owner or Editor are added to a Service Account.
Detect when GCP IAM Organization Policy is updated or deleted.
Detect AWS IAM activities associated with the S3 Browser utility.
Detect AWS IAM activities made by AWS EC2 instances to retain access or escalate privileges.
Alerts when a permission on the watchlist is applied to an Entra ID application.
Identifies when an administrator role is assigned to a user account in Google Workspace. Security teams can monitor for the malicious or accidental assignment of administrator privileges to prevent unauthorized access to data.
Identifies when a custom administrator role is created in Google Workspace. Security teams can monitor for malicious or accidental configuration of administrator privileges to prevent unauthorized access to data.
Identifies when a Google Workspace user account is moved between Organizational Units.
Detects when an access policy that is applied to a GCP cloud resource is deleted. An adversary would be able to remove access policies to gain access to a GCP cloud resource.
Detects when an access policy that is applied to a GCP cloud resource is deleted.
An adversary would be able to remove access policies to gain access to a GCP cloud resource.
An adversary would be able to remove access policies to gain access to a GCP cloud resource.
Detects suspicious inbox manipulation rules that are set on a user's mailbox to delete or move messages or folders. This often indicates an attacker is trying to hide their activities or exfiltrate data by automatically moving emails.
This rule identifies when an owner is removed from an application or service principal within Azure Active Directory. This activity could indicate an attempt to remove legitimate administrative access or to obscure malicious activity by removing an owner who might detect it.
Detects when a user account's User Account Control (UAC) flags are modified to enable weak encryption (DES) or disable Kerberos pre-authentication. This configuration can make the account vulnerable to Kerberoasting attacks, where an attacker can request a service ticket for the user and then offline crack the NTLM hash of the user's password if DES encryption is allowed, or if pre-authentication is disabled.
Detects the creation, modification, or deletion of Kubernetes RoleBindings and ClusterRoleBindings in Google Cloud. These actions can indicate an adversary attempting to escalate privileges or maintain persistence within a Kubernetes cluster by granting themselves or other accounts additional roles and permissions.
Detects the usage of the 'usermod' command to add a user to either the 'root' or 'sudoers' group on a Linux system. This activity can indicate privilege escalation or persistence mechanisms by an attacker.
Detects password change for the computer's domain account or host principal via "ksetup.exe", a command-line tool used to configure Kerberos settings.
Page 40 of 40