Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
113 detections
Filters
Last updated
All Time
Detection languages
47
22
12
8
8
Contributors
36
28
14
11
5
Categories
63
25
22
18
14
Platforms
49
38
31
17
7
Products / Services
15
14
13
13
10
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
12
12
1
1
1
IDS Classtypes
3
IDS Protocols
2
1
Detects suspicious SQL query keywords that are often used during reconnaissance, data exfiltration, or destructive activities. This includes keywords like 'drop', 'truncate', 'dump', and 'select *', which can indicate attempts to manipulate database structures, extract sensitive information, or perform denial-of-service attacks.
Detects suspicious modifications to sensitive or critical system files on Linux systems. This rule monitors for common command-line utilities (like 'cat', 'echo', 'grep', 'vi', 'nano', 'sed') being used with output redirection ('>') or directly to edit files within critical system directories and configuration files. This activity could indicate an attacker attempting to alter system behavior, maintain persistence, or escalate privileges by modifying files that are not expected to change without explicit administrative planning.
This rule identifies when a device or device configuration is modified or deleted within Azure. This activity is logged in Azure Activity Logs and can indicate administrative changes, potential misconfigurations, or malicious activity aimed at impacting the availability or integrity of cloud resources.
This rule identifies when an Azure DNS zone is either modified or deleted. This activity is detected by monitoring Azure Activity Logs for operations starting with 'MICROSOFT.NETWORK/DNSZONES' and ending with '/WRITE' (for modifications) or '/DELETE' (for deletions). Such changes can indicate malicious activity aimed at redirecting traffic or disrupting services.
Detects events in which a history file gets deleted, e.g. the ~/bash_history to remove traces of malicious activity
Identifies when a device or device configuration in azure is modified or deleted.
Identifies when DNS zone is modified or deleted.
Detects specific commands commonly used to remove or empty the syslog
Page 6 of 6