Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
88 detections
Filters
Last updated
All Time
Detection languages
31
30
9
8
6
Contributors
21
10
8
7
6
Categories
49
21
18
18
12
Platforms
29
25
11
8
6
Products / Services
19
14
13
8
6
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
CVEs
4
IDS Classtypes
3
IDS Protocols
2
1
Detects execution of the "userdel" binary. Which is used to delete a user account and related files. This is sometimes abused by threat actors in order to cover their tracks
Identifies when an ElastiCache security group has been modified or deleted.
User Logoff Event
Sigma
Detects a user log-off activity. Could be used for example to correlate information during forensic investigations
Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users.
Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts.
Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts.
Page 5 of 5