Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
30 detections
Filters
Last updated
All Time
Detection languages
12
8
6
2
1
Contributors
8
7
6
3
1
Categories
20
17
14
5
1
Platforms
16
9
2
2
1
Products / Services
16
9
2
2
2
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
This rule detects when a single caller performs five or more successful 'Create or Update Network Security Group' operations within a one-hour window in Azure Activity logs. This could indicate an attacker attempting to modify network access controls to facilitate lateral movement, C2, or data exfiltration, or a misconfigured automated process.
This rule detects repeated successful operations related to public access or firewall configuration changes within Azure Activity Logs. A high count (3 or more) of such operations by the same caller within an hour could indicate malicious activity, such as an attacker attempting to open up network access to compromised resources or exfiltrate data.
Detects modification of a storage account network rule set to allow public access, bypass trusted-service checks, or add broad network ranges.
Detects modification of an Azure storage account network rule set to allow public access, bypass trusted-service checks, or add broad network ranges. This could indicate an attacker attempting to gain broader access to sensitive data stored in Azure Storage.
Detects the writing and subsequent deletion of Azure SQL firewall rules, a technique used to enable remote access and evade defenses. This behavior could indicate an adversary attempting to open up network access to an Azure SQL server and then remove the evidence of the rule change.
Detects modification of Azure Storage Account network access rules, specifically when the 'networkAcls' property is changed. This could indicate an attempt to enable public access from specific IP addresses, potentially exposing the storage account to unauthorized access.
This rule detects repeated successful operations related to public access or firewall configuration changes within Azure Activity Logs. A high count (3 or more) of such operations by the same caller within an hour could indicate malicious activity, such as an attacker attempting to open up network access to compromised resources or exfiltrate data.
Detects when a Network Security Group (NSG) rule is successfully deleted in Azure. This could indicate an attempt to bypass network access controls, potentially to enable unauthorized access or exfiltration.
This rule detects when a single caller performs five or more successful 'Create or Update Network Security Group' operations within a one-hour window in Azure Activity logs. This could indicate an attacker attempting to modify network access controls to facilitate lateral movement, C2, or data exfiltration, or a misconfigured automated process.
This rule detects repeated successful operations related to public access or firewall configuration changes within Azure Activity Logs. A high count (3 or more) of such operations by the same caller within an hour could indicate malicious activity, such as an attacker attempting to open up network access to compromised resources or exfiltrate data.
Detects when a Network Security Group (NSG) rule is successfully deleted in Azure. This could indicate an attempt to bypass network access controls, potentially to enable unauthorized access or exfiltration.
This rule detects attempts to delete a cloud security group rule via the AWS EC2 API. Specifically, it looks for HTTP traffic to 'ec2.amazonaws.com' with the URI containing 'RevokeSecurityGroupIngress', which is the API call used to remove an inbound rule from a security group.
Detects modifications to AWS EC2 security groups that allow SSH (port 22) or RDP (port 3389) access from any IP address (0.0.0.0/0) to instances. This configuration significantly increases the attack surface and can be an indicator of unauthorized access attempts, misconfigurations, or malicious activity.
Detects the deletion of one or more VPC Flow Logs in AWS Elastic Compute Cloud (EC2) through the DeleteFlowLogs API call. Adversaries may delete flow logs to evade detection or remove evidence of network activity, hindering forensic investigations and visibility into malicious operations.
The following analytic detects a suspicious modification to the firewall to allow network discovery on a machine. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving the 'netsh' command to enable network discovery. This activity is significant because it is commonly used by ransomware, such as REvil and RedDot, to discover and compromise additional machines on the network. If confirmed malicious, this could lead to widespread file encryption across multiple hosts, significantly amplifying the impact of the ransomware attack.
Detects the addition of a new network route to a route table in AWS. This activity can be indicative of an adversary attempting to reroute traffic for C2, exfiltration, or to bypass network controls.
This rule detects the creation of new network Access Control List (ACL) entries within an AWS route table. Such an event could indicate that new network access vectors have been opened, potentially allowing unauthorized access or facilitating malicious activities within the AWS environment. This is a critical security event as it directly impacts network segmentation and access control.
This rule detects the modification of an Azure Network Security Group (NSG) rule to allow traffic from any source IP address ('*'). This configuration change significantly broadens network access and could indicate an adversary attempting to establish persistence, enable command and control, or facilitate data exfiltration by opening up previously restricted network paths.
Get all filtering events done by the Windows filtering platform.
This includes any blocks done by Windows Firewall rules, but also blocks triggered by some 3rd party firewalls.
When no Firewall rules are configured, the default behavior is to block all incoming network connections.
This includes any blocks done by Windows Firewall rules, but also blocks triggered by some 3rd party firewalls.
When no Firewall rules are configured, the default behavior is to block all incoming network connections.
The following analytic detects the creation of AWS Network Access Control Lists (ACLs) with all ports open to a specified CIDR. It leverages AWS CloudTrail events, specifically monitoring for `CreateNetworkAclEntry` or `ReplaceNetworkAclEntry` actions with rules allowing all traffic. This activity is significant because it can expose the network to unauthorized access, increasing the risk of data breaches and other malicious activities. If confirmed malicious, an attacker could exploit this misconfiguration to gain unrestricted access to the network, potentially leading to data exfiltration, service disruption, or further compromise of the AWS environment.
The following analytic identifies instances where new IP addresses are added to the trusted IPs list in Office 365, potentially allowing users from these IPs to bypass Multi-Factor Authentication (MFA) during login. It leverages O365 audit logs, specifically focusing on events related to the modification of trusted IP settings. This activity is significant because adding trusted IPs can weaken the security posture by bypassing MFA, which is a critical security control. If confirmed malicious, this could lead to unauthorized access, compromising sensitive information and systems. Immediate investigation is required to validate the legitimacy of the IP addition.
Page 1 of 2