Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
88 detections
Filters
Last updated
All Time
Detection languages
31
30
9
8
6
Contributors
21
10
8
7
6
Categories
49
21
18
18
12
Platforms
29
25
11
8
6
Products / Services
19
14
13
8
6
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
CVEs
4
IDS Classtypes
3
IDS Protocols
2
1
Detects the use of the 'net.exe' command to reset the password of a local administrator account. This behavior is specifically associated with the NoEscape ransomware, which utilizes this command as part of its impact-oriented activity to prevent authorized access to the compromised system.
ARTokenC2NetworkTraffic - fully-featured phishing-as-a-service (PhaaS) operator panel, branded "ARToken," that shares infrastructure, API contracts, and operational patterns with the EvilTokens platform.
Detects the deletion of directory service objects such as users, groups, organizational units, computers, or trusted domains. This is identified via Windows Security Event ID 5141, which tracks when a directory object is deleted.
Detects the deletion of directory service objects such as users, groups, organizational units, computers, or trusted domains. This is identified via Windows Security Event ID 5141, which tracks when a directory object is deleted.
Detects when an actor searches Slack audit logs, which could indicate an attacker attempting to understand logging capabilities or evade detection. Also detects bulk session resets initiated by an administrator, which may be a response to an account takeover or an attacker attempting to evict legitimate users from their sessions.
Detects bulk deletion of user accounts to lock out defenders and users
Detects attempts to modify or delete Microsoft Graph API conditional access policies. This could indicate an adversary attempting to weaken security controls to facilitate unauthorized access or persistence.
This rule detects attempts to modify or delete Conditional Access Policies within Azure Active Directory (now Microsoft Entra ID) by monitoring network events targeting 'graph.microsoft.com' with 'conditionalAccessPolicies' in the AdditionalFields, specifically looking for 'PATCH' or 'DELETE' operations. Such activities could indicate an adversary attempting to weaken security controls or maintain persistence.
Detects when an actor searches Slack audit logs, which could indicate an attacker attempting to understand logging capabilities or evade detection. Also detects bulk session resets initiated by an administrator, which may be a response to an account takeover or an attacker attempting to evict legitimate users from their sessions.
Detects when five or more user accounts are deleted within a one-hour period by a single user. This activity can indicate malicious intent to disrupt operations or cover tracks.
This rule detects attempts to modify or delete Conditional Access Policies within Microsoft Azure Active Directory (now Microsoft Entra ID) via the Microsoft Graph API. Adversaries may alter or remove these policies to bypass security controls, maintain persistence, or facilitate unauthorized access to resources. The detection specifically looks for network events targeting 'graph.microsoft.com' that involve 'conditionalAccessPolicies' and use 'PATCH' (modification) or 'DELETE' (removal) HTTP methods.
Detects deletion of MFA configurations to enable authentication bypass
Detects when an actor searches Slack audit logs, which could indicate an attacker attempting to understand logging capabilities or evade detection. Also detects bulk session resets initiated by an administrator, which may be a response to an account takeover or an attacker attempting to evict legitimate users from their sessions.
Detects bulk deletion or disabling of accounts to lock out defenders
Detects when five or more user accounts are deleted within a one-hour period by a single user. This activity can indicate malicious intent to disrupt operations or cover tracks.
Detects deletion of MFA configurations to enable authentication bypass
This rule detects multiple HTTP requests to 'iam.amazonaws.com' with the URI containing 'DeleteAccessKey'. This activity, especially when occurring frequently (5 times in 30 seconds from the same source), could indicate an attempt to revoke cloud account access keys, potentially as part of a lockout impact attack.
Detects when five or more user accounts are deleted within a one-hour period by a single user. This activity can indicate malicious intent to disrupt operations or cover tracks.
This rule detects attempts to remotely lock out user accounts via SMB (Server Message Block) by looking for specific content within TCP traffic on port 445. It specifically targets the 'NetUserSetInfo' function call, which can be used to modify user account properties, in conjunction with the keyword 'lockout'. This combination suggests an attacker is attempting to trigger a mass account lockout.
This rule detects bulk account deletion attempts via LDAP. It triggers when multiple LDAP requests (at least 5 within 30 seconds from the same source IP) are observed on port 389, containing both 'userAccountControl' and 'delete' keywords, indicating an attempt to modify user account control attributes to disable or delete accounts.
This rule detects anomalous mass device wipe or deletion activity in Microsoft Intune by comparing current activity against an actor's historical behavior. It identifies four patterns: first-time wipers with high volume, known actors statistically far above their norm (Z-score), thin-history actors exceeding their personal peak, and time-compressed bursts of wipes. The rule calculates a severity based on the volume and rate of wipes.
Page 2 of 5