Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
132 detections
Filters
Last updated
All Time
Detection languages
66
28
15
13
5
Contributors
29
22
20
13
12
Categories
96
93
27
19
16
Platforms
74
44
27
26
16
Products / Services
55
42
27
14
9
MITRE Techniques
18,108
15,614
12,573
8,384
6,204
CVEs
1
IDS Classtypes
2
IDS Protocols
2
Detect when a user creates or updates a login profile for another user and escalates privileges using this new user from the same IP.
Application creation is a legitimate activity but doesn't occur frequently. Alerts when a new application is created in Entra ID (formerly Azure AD).
Detects the addition of a new Federated Domain in Microsoft Exchange. This event can be indicative of credential abuse or the establishment of a backdoor via federated identities, potentially in the context of a Golden SAML attack.
Detects when an AWS ElastiCache security group has been created. This action can be used by adversaries to establish persistence or modify network access to ElastiCache resources.
Detects the addition of a new Federated Domain.
Detects when an ElastiCache security group has been created.
Page 7 of 7