Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
57 detections
Filters
Last updated
All Time
Detection languages
24
11
7
5
5
Contributors
24
10
5
3
3
Categories
30
24
13
12
9
Platforms
26
23
15
7
7
Products / Services
22
13
11
5
5
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
4
1
IDS Protocols
4
1
Monitors GitHub audit logs for suspicious or high-risk activities within CI/CD pipelines, including actions triggered by forks, workflow approvals, branch policy overrides, self-hosted runner registration, and sensitive secret access.
Monitors GitHub audit logs for suspicious or high-risk activities within CI/CD pipelines, including actions triggered by forks, workflow approvals, branch policy overrides, self-hosted runner registration, and sensitive secret access.
Detects the Miasma worm propagating through CI/CD pipelines by identifying unauthorized updates to GitHub Actions workflow files. Specifically monitors for modifications to workflows under the LeoPlatform or LeoInsights projects by the compromised user 'czirker', with signs of weaponization such as the addition of OIDC id-token write permissions and npm-publish capabilities.
This rule detects SSH connections to the internal network ($HOME_NET) on port 22. It specifically looks for the 'SSH-2.0' content in the TCP flow to the server. A threshold is set to trigger an alert if three such connections are observed from the same source within 60 seconds. The rule's message suggests it's intended to identify third-party SSH access potentially using a vendor key, implying an attempt to detect unauthorized or unusual SSH activity.
This rule detects HTTP requests to URIs containing keywords associated with common IT management platforms (ConnectWise, Kaseya, SolarWinds, Datto, N-central). It specifically looks for established HTTP traffic flowing to the server. A threshold of 5 occurrences within 60 seconds from the same source IP is set to trigger an alert, indicating a potential remote access session or activity related to these platforms.
This rule detects RDP (Remote Desktop Protocol) sessions initiated towards the HOME_NET on port 3389. It specifically looks for the RDP connection initiation sequence (content:"|03 00|" with depth:2) and uses a threshold to detect multiple connections from the same source within a 5-minute window, which could indicate activity from a Managed Service Provider or other remote access scenarios.
This rule detects Server Message Block (SMB) access attempts from external sources to internal networks, specifically looking for NTLMSSP (NT LAN Manager Security Support Provider) authentication traffic. It triggers an alert if five such connections are observed from the same source IP within a 60-second window. This could indicate an attempt by a third-party vendor or an attacker to access internal resources via SMB.
This rule detects VNC (Virtual Network Computing) remote access sessions initiated from any source IP address to any IP address within the local network ($HOME_NET) on port 5900. It specifically looks for the 'RFB 00' string within the first 7 bytes of the TCP payload, which is characteristic of the VNC protocol handshake. A threshold is applied to trigger an alert if 3 such connections are observed from the same source IP within a 60-second window, indicating potential repeated or sustained VNC activity.
Detects AWS IAM roles whose trust policies were newly created or updated to allow cross account AWS principals to assume the role without any confused deputy protections in place.
Detects the creation or modification of an IAM Role trust policy that grants assume-role permissions to an AWS account that is not part of the organization. This action creates a backdoor for an external entity to gain persistent access to your environment, often used by attackers to maintain unauthorized access. This rule relies on an `aws_org_accounts.csv` lookup table to identify accounts belonging to the organization. If this lookup is not established, manual filtering of AWS accounts will be required.
Service Accounts may need to be filtered.
Service Accounts may need to be filtered.
Detects Airstalk malware, which exists in both PowerShell and .NET variants. The rule identifies specific strings related to its C2 communication over the AirWatch MDM API, tasking, and other unique artifacts.
KQL Query
'Detects anomalous IP address usage by user accounts and then checks to see if a suspicious Teams action is performed.
Query calculates IP usage Delta for each user account and selects accounts where a delta >= 90% is observed between the most and least used IP.
To further reduce results the query performs a prevalence check on the lowest used IP's country, only keeping IP's where the country is unusual for the tenant (dynamic ranges).
Please note, if the initial logic of prevalence to find suspicious logon activity is noisy then consider adding filtering based on Location.
Finally the user accounts activity within Teams logs is checked for suspicious commands (modifying user privileges or admin actions) during the period the suspicious IP was active.'
Query calculates IP usage Delta for each user account and selects accounts where a delta >= 90% is observed between the most and least used IP.
To further reduce results the query performs a prevalence check on the lowest used IP's country, only keeping IP's where the country is unusual for the tenant (dynamic ranges).
Please note, if the initial logic of prevalence to find suspicious logon activity is noisy then consider adding filtering based on Location.
Finally the user accounts activity within Teams logs is checked for suspicious commands (modifying user privileges or admin actions) during the period the suspicious IP was active.'
This rule identifies when a new domain is added to the list of trusted domains within Google Workspace. An adversary might leverage this capability to establish trusted relationships, potentially manipulating sharing settings to gain unauthorized access to sensitive organizational files and folders.
Detects when a Security Compliance Center reported a user who exceeded sending limits of the service policies and because of this has been restricted from sending email.
Page 3 of 3