Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,918 detections
Filters
Last updated
All Time
Detection languages
2,238
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
807
765
577
Platforms
1,844
1,022
856
814
658
Products / Services
988
596
477
456
383
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
4,918
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
This rule detects suspicious sign-in activities that occur shortly after a network connection to an IP address associated with 'Lab539 Clickfix'. It correlates risky sign-in events from Azure Active Directory (AAD) with network connection logs from devices. Specifically, it looks for AAD sign-ins with a risk level of 30 or higher, from non-guest, non-compliant, and non-managed devices, where the IP address has not been seen for that user in the last 30 days. This is then joined with network connection events to IP addresses found in the 'Lab539 Clickfix' external data, ensuring the sign-in occurs after the network connection within a short timeframe. The 'Lab539 Clickfix' reference suggests a connection to a known threat or campaign, possibly related to phishing or credential compromise.
Detects attempts to enable the root account on macOS systems using the 'dsenableroot' command-line utility. This action can be used for persistence, privilege escalation, or defense evasion by adversaries.
Detects instances where an SSH service on an OpenCanary honeypot node has had a login attempt. This indicates an adversary attempting to gain unauthorized access to a system, likely through brute-force or credential stuffing attacks against the honeypot.
Detects the S3 Browser utility creating an IAM User or AccessKey in AWS. This activity can be indicative of an attacker establishing persistence or escalating privileges within an AWS environment.
This rule detects when guest users are invited to the tenant by individuals who are not on an approved list of inviters. This helps identify unauthorized or suspicious external user invitations that could lead to unauthorized access or compromise.
This rule identifies instances where a user has been assigned a privileged role within Azure Active Directory (now Microsoft Entra ID) but is not actively using that role. This is detected by monitoring 'redundantAssignmentAlertIncident' risk events from the Azure PIM (Privileged Identity Management) service. Such alerts can indicate over-privileged accounts, potential misconfigurations, or accounts that could be targeted for privilege escalation if compromised.
Detects attempts to create and add an account to the admin group via the `sysadminctl` utility on macOS. This action can be used for persistence, privilege escalation, or defense evasion by creating a new administrative user.
Detects network connections to the InterPlanetary File System (IPFS) where the URI contains a pattern indicative of an email address. This behavior is associated with recent phishing campaigns that leverage IPFS to host credential harvesting webpages, attempting to collect user credentials.
Detects when users successfully authenticate to Azure AD using only single-factor authentication, indicating that MFA was not required or was bypassed. This could be due to misconfiguration, an attacker bypassing MFA, or legitimate exceptions.
Detects when a user account is created and subsequently deleted within a short period. This behavior can indicate an adversary attempting to establish temporary persistence, perform actions, and then remove traces of their activity to evade detection. It could also be related to privilege escalation attempts where an account is created for a specific task and then removed.
Detects when failed sign-in attempts increase by 10% or greater within Azure AD. This could indicate brute-force attacks, password spraying, or attempts to gain unauthorized access to accounts.
Detects when successful authentications to important applications occur using only single-factor authentication. This could indicate a weakened security posture for critical resources or a bypass of expected multi-factor authentication policies.
Detects malicious ASP.NET webshell activity associated with the CL0P Ransomware Gang exploiting CVE-2023-34362. The rule looks for specific HTTP headers used by the webshell, indicators of Azure Blob Storage interaction, or SQL injection attempts.
Detects the creation of suspicious files (jsp, java, class) in specific SAP NetWeaver directories. This activity may indicate an attempt to establish a webshell or exploit vulnerabilities, such as CVE-2025-31324, to gain persistent access or execute arbitrary code within the SAP environment.
This rule identifies suspicious activity related to Security Assertion Markup Language (SAML) in AWS. Specifically, it looks for two events: `AssumeRoleWithSAML` from the `sts.amazonaws.com` service and `UpdateSAMLProvider` from the `iam.amazonaws.com` service. An adversary could leverage these actions to gain unauthorized access, establish persistence, or escalate privileges within an AWS environment by manipulating SAML providers or assuming roles via SAML.
Detects attempts to add a user account to the 'admin' group on macOS using the `dseditgroup` utility, which grants administrative privileges to the added user. This action can be used for persistence, privilege escalation, or defense evasion by an attacker.
Detects the command line executed when TeamViewer starts a session initiated by a remote host. This rule specifically looks for the `TeamViewer_Desktop` process being launched by `TeamViewer_Service` with specific command-line arguments, indicating a remote connection. An investigator can verify connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.
Detects when a user account is added to the local 'Administrators' group on a Windows system. This activity is critical for privilege escalation and persistence, as it grants the added user administrative rights. While it can be a legitimate administrative action, it is also a common technique used by attackers to maintain control and elevate privileges after initial compromise.
Detects exploitation attempts of CVE-2024-50623 in Cleo software by identifying `cmd.exe` processes spawned from `javaw.exe` (associated with Cleo applications like Harmony, Lexicom, VersaLex, or VLTrader) that execute PowerShell commands with suspicious arguments indicative of encoded commands or web downloads.
Detects the S3 Browser utility performing reconnaissance by checking for existing AWS IAM Users without a LoginProfile defined, and subsequently creating a LoginProfile if one is not found. This behavior has been associated with the Guivil threat actor.
Detects when an account that has been disabled or blocked attempts to sign in. This could indicate an attacker attempting to use compromised credentials for an account that is no longer active or has been locked out due to suspicious activity.
Page 155 of 235