Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects when an instance identity has taken an action that isn't inside SSM.
This can indicate that a compromised EC2 instance is being used as a pivot point.
This can indicate that a compromised EC2 instance is being used as a pivot point.
Detects successful authentication attempts originating from clients using legacy authentication methods, identifiable via specific user agent strings. This activity can indicate an adversary attempting to bypass multi-factor authentication (MFA), potentially as part of a password spray attack. Legacy authentication protocols often do not support modern MFA mechanisms, making them a target for attackers who have obtained valid credentials through other means or are performing brute-force attacks like password spraying.
This rule detects attempts to abuse Azure Browser Single Sign-On (SSO) by monitoring for the loading of the 'MicrosoftAccountTokenProvider.dll' library. This DLL is involved in requesting OAuth 2.0 refresh tokens for Azure AD-authenticated Windows users on Azure AD-joined machines, enabling SSO in browsers. An attacker could leverage this to authenticate to Azure AD as the compromised user within a browser. The rule filters out legitimate loads by common processes like BackgroundTaskHost.exe, Visual Studio (devenv.exe), Internet Explorer (iexplore.exe), Microsoft Edge (msedge.exe, msedgewebview2.exe), and OneDrive (OneDrive.exe) to reduce false positives.
Detects when an Azure Blob Storage container's access level is changed to allow public access, or when a long-lived, highly privileged Shared Access Signature (SAS) token is created. Threat actors can use these methods for persistence and data exfiltration.
Detects various activities associated with the UTA0388 threat actor and their GOVERSHELL malware family. This includes network connections to known C2 infrastructure, creation of persistence via scheduled tasks, and execution of the malware payload, often involving DLL side-loading. The detection logic covers network communication with known C2 domains and IPs, creation of scheduled tasks with specific names, execution of the malware from common staging directories with specific flags, and the dropping of GOVERSHELL DLLs or files with known hashes.
Detects suspicious modification of the crontab file, which can be used by adversaries for persistence, privilege escalation, or execution of malicious code on Unix-like systems. The rule specifically looks for the 'REPLACE' keyword in cron logs, indicating a crontab entry has been changed.
Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith. The rule specifically looks for 'UserLoggedIn' operations with 'Success' status for the Microsoft Intune Company Portal ApplicationId, while excluding a specific ObjectId often associated with mobile device enrollment to reduce false positives.
Detects when Microsoft Cloud App Security (MCAS) reports a risky sign-in attempt due to an impossible travel scenario. This indicates a potential compromise of user credentials where an attacker logs in from a geographically distant location in a short timeframe, making physical travel impossible.
This rule detects activities performed by the AWS root account. The root account has unrestricted access to all resources in an AWS account, making its usage a critical security event that often indicates a potential compromise, misconfiguration, or a highly privileged operation that should be closely monitored. The rule specifically looks for events where the 'userIdentity.type' is 'Root' and excludes 'AwsServiceEvent' to filter out automated AWS service activities that might legitimately use root permissions internally.
Detects the registration of a new device or MFA authentication method in Microsoft Entra ID from an IP address geolocated to Morocco or associated with specific Moroccan ASNs. This is a persistence tactic used by the Jingle Thief group (also tracked as Atlas Lion and STORM-0539).
This rule detects the creation or modification of cron files or files within standard cron directories on Linux systems. Adversaries often abuse the cron utility to establish persistence or schedule malicious tasks for execution at specific times or intervals. Monitoring these file events can help identify unauthorized scheduling of tasks.
Detects potential exploitation of the PwnKit vulnerability (CVE-2021-4034) by looking for specific keywords in authentication logs. The rule identifies attempts to execute 'pkexec' with suspicious environment variable content and specific user/TTY information, indicative of a local privilege escalation attempt.
This rule detects the execution of 'GUP.exe' (Notepad++ updater) from any directory other than its legitimate installation paths within 'Program Files' or user-specific 'AppData' folders. This behavior is often indicative of DLL side-loading attacks where a malicious GUP.exe might be placed in a controlled directory to load a malicious DLL.
This rule detects when a user successfully elevates their permissions to manage all Azure Subscriptions. This action grants broad access across the Azure environment and should be immediately investigated if it is not a planned administrative activity. Such an elevation could be leveraged by an attacker to gain extensive control over Azure resources.
Detects the creation of a new user account with privileged User ID (UID) or Group ID (GID) on Linux systems, specifically targeting root (UID=0, GID=0), wheel (GID=10), or sudo (GID=27) groups. This rule monitors logs for `useradd` events indicating the creation of users with these elevated privileges.
Detects the execution of SharpUp, a tool used for local privilege escalation. The rule specifically looks for the executable name 'SharpUp.exe' or the description 'SharpUp', combined with command-line arguments indicative of its privilege escalation enumeration capabilities, such as 'HijackablePaths', 'UnquotedServicePath', 'ProcessDLLHijack', 'ModifiableServiceBinaries', 'ModifiableScheduledTask', 'DomainGPPPassword', and 'CachedGPPPassword'.
This rule detects modifications to Active Directory user accounts that could enable an attacker to control another user's or computer's account without needing their credentials. Specifically, it looks for changes to attributes related to delegation, such as 'msDS-AllowedToDelegateTo' and 'msDS-AllowedToActOnBehalfOfOtherIdentity', or the 'servicePrincipalName' attribute for user objects, which can be abused for Kerberoasting or other delegation attacks. Event ID 4738 indicates a user account was changed, and Event ID 5136 indicates a directory service object was modified.
Detects the installation of services associated with various legitimate remote access tools. Threat actors commonly abuse these tools for persistence, privilege escalation, and remote control of compromised systems.
Detects successful AWS console logins that were performed without Multi-Factor Authentication (MFA). This alert can be used to identify potential unauthorized access attempts, as logging in without MFA can indicate compromised credentials or misconfigured security settings.
Detects AWS console logins from countries and IP addresses that are not recognized as legitimate for the organization. This alert can help identify potential unauthorized access attempts from unusual locations, which may indicate compromised credentials or malicious activity.
Detects known malicious service installations associated with Cobalt Strike beacons, often used for privilege escalation or lateral movement. The rule specifically looks for patterns in the ServiceFileName field of Windows Security Event ID 4697, such as the presence of 'ADMIN$' and '.exe', '%COMSPEC%', 'start', and 'powershell', or encoded PowerShell commands often used by Cobalt Strike.
Page 243 of 401