Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
137 detections
Filters
Last updated
All Time
Detection languages
83
24
10
10
6
Contributors
25
24
19
11
9
Categories
72
43
40
34
20
Platforms
73
47
18
16
11
Products / Services
46
13
9
9
8
MITRE Techniques
18,108
15,614
12,573
8,384
6,204
CVEs
1
1
1
IDS Classtypes
1
1
IDS Protocols
2
Detects when a user downloads a high number of non-public GitHub repositories. An adversary may attempt to steal the contents of several GitHub repositories after compromising a user account.
Detects when a user grants access to a GitHub Personal Access Token prior to cloning several GitHub non-public GitHub repositories. An adversary may grant access to a Personal Access Token before attempting to steal the contents of several GitHub repositories using a an automated script or offensive tool.
Detects when a user clones a high number of non-public GitHub repositories. An adversary may attempt to steal the contents of several GitHub repositories after compromising a user account.
Detects when a user downloads a high number of non-public GitHub repositories. An adversary may attempt to steal the contents of several GitHub repositories after compromising a user account.
Detects instances where an attacker attempts to interact with or exploit a REDIS service running on an OpenCanary honeypot. This indicates reconnaissance or an attempt to gain unauthorized access or extract data from the emulated Redis service.
This rule detects when a Git clone request is made to a Git service running on an OpenCanary honeypot. This indicates an adversary is interacting with the honeypot, likely attempting to collect information or test access.
Detects instances where a REDIS service on an OpenCanary node has had an action command attempted.
Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using SQLAuth.
Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using Windows Authentication.
Detects instances where a GIT service on an OpenCanary node has had Git Clone request.
Detects instances where a MySQL service on an OpenCanary node has had a login attempt.
Page 7 of 7