Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
259 detections
Filters
Last updated
All Time
Detection languages
113
50
38
38
10
Contributors
116
35
20
11
10
Categories
146
101
98
84
80
Platforms
183
108
58
9
5
Products / Services
126
117
59
35
31
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
CVEs
3
3
IDS Classtypes
1
1
IDS Protocols
2
Detects when an Okta user's password is reset and MFA factor(s) are deactivated or reset within a 30 minute time window. This activity may indicate that the user account has been compromised.
Detects the registration of a new Multi-Factor Authentication (MFA) method for an AWS user. This can be an indicator of an attacker attempting to maintain persistence or bypass existing MFA controls by registering their own MFA device.
Detects attempts to disable multi-factor authentication for an AWS IAM user by monitoring AWS CloudTrail events for 'DeleteVirtualMFADevice' or 'DeactivateMFADevice' actions. This could indicate an adversary attempting to maintain persistent access or bypass MFA for compromised accounts.
Detects when a user removes an authentication factor or OTP device within OneLogin. This action can weaken security by removing a layer of multi-factor authentication, potentially making the account more vulnerable to compromise.
Detects attempts to disable multi-factor authentication for an AWS IAM user.
Detects the registration of a new Multi Factor authentication method for an AWS user.
Detects when multi-factor authentication (MFA) is disabled in Google Workspace. This could indicate an adversary attempting to weaken security controls for persistent access or to facilitate further compromise.
Page 13 of 13