Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,253 detections
Filters
Last updated
All Time
Detection languages
1,543
1,191
352
288
225
Contributors
792
520
494
349
298
Categories
1,711
1,489
400
382
376
Platforms
3,052
528
334
314
254
Products / Services
779
648
634
283
238
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
4,253
CVEs
6
6
6
5
5
IDS Classtypes
75
63
37
23
9
IDS Protocols
127
66
6
4
4
Detects when an existing password policy is updated or deleted in an AWS account. This could indicate an adversary attempting to weaken password requirements to facilitate brute-force attacks or to remove obstacles for credential reuse.
This rule detects when an EC2 instance makes a high number of API calls within a 5-minute window. The rule specifically looks for API calls originating from an assumed role associated with an EC2 instance, identified by a user ID matching the pattern `/i-.*$/`. A high number is defined as more than 7 distinct product event types within the specified timeframe. This behavior can indicate reconnaissance or other malicious activity from a compromised instance.
This rule detects the creation of new applications within Microsoft Entra ID (formerly Azure AD). While application creation is a legitimate administrative activity, it does not occur frequently. Monitoring this event can help identify unauthorized or suspicious application registrations that could be used for persistence, privilege escalation, or other malicious activities within the cloud environment.
This rule detects when a permission on a pre-defined watchlist is applied to an Entra ID application. It specifically looks for 'Update application.' events in Office 365 logs where the 'NewValue_EntitlementId-' or 'OldValue_EntitlementId-' labels indicate a change in application permissions. The rule leverages a watchlist named 'msgraph_watchlist_permissions' to identify sensitive or suspicious permission changes.
Detects when an excessive number of permissions are assigned to an Entra ID application within a short time window, calculated as a percentage increase from existing permissions. This could indicate a "greedy permission grab" by an attacker attempting to escalate privileges or gain broader access within the Entra ID environment. The rule specifically looks for updates to application permissions where the percentage increase of new permissions over old permissions exceeds a 70% threshold.
Detects excessive PermissionDenied events within an hour timeframe from a user
Detects instances where an SNMP service on an OpenCanary node has had an OID request.
Detects external IP address lookups by non-browser processes via services such as "api.ipify.org". This could be indicative of potential post compromise internet test activity.
Detects excessive AccessDenied events within an hour timeframe from an IAM User
Detect when an EC2 instance makes high number of API calls.
Detects excessive successful events within a 5 minute timeframe from an IAM User.
Detects when an existing password policy is updated or deleted in an AWS account.
Detects enumeration of local system accounts on Linux. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior. The rule identifies common commands and file accesses used for this purpose, such as 'lastlog', 'id', 'lsof -u', and utilities like 'cat', 'head', 'tail' accessing '/etc/passwd', '/etc/shadow', or '/etc/sudoers'.
This rule detects the execution of common Linux utilities used for process discovery. Adversaries often use these commands (atop, htop, pgrep, ps, pstree, top) to gather information about running processes on a system, which helps them understand the environment and plan subsequent actions. This information can reveal common software or applications running on systems within the network.
Detects attempts to query the contents of the event log using command line utilities such as `wevtutil.exe`, `wmic.exe`, and PowerShell cmdlets like `Get-WinEvent` or `Get-EventLog`. Attackers use this technique to find sensitive information in logs, such as credentials, usernames, or IP addresses.
Detects attempts to discover password policy information on Linux systems by monitoring access to key configuration files and the execution of 'chage' and 'passwd' commands with specific arguments.
Detects the use of common Linux utilities such as 'find', 'tree', 'findmnt', 'ls -R', and 'mlocate' for discovering files, directories, and potentially network shares. This activity is often performed by adversaries to gain situational awareness of the file system.
Detects the execution of SOAPHound, a .NET tool for collecting Active Directory data, using specific command-line arguments that may indicate an attempt to extract sensitive AD information. The rule specifically looks for command-line arguments related to building caches, dumping bloodhound data, certificate dumping, and DNS dumping, combined with arguments for cache filenames or output directories.
Detects system discovery activity carried out by Pikabot, such as network, user information, and domain groups. The malware Pikabot has been observed using this technique as part of its C2-botnet registration with a short collection time frame (less than 1 minute). The rule specifically looks for `ipconfig.exe /all`, `netstat.exe -aon`, and `whoami.exe /all` commands executed by processes whose grandparent image ends with `rundll32.exe` or parent image ends with `SearchFilterHost.exe` or `SearchProtocolHost.exe`.
Detects the use of the WMI command-line (WMIC) utility to identify and display various system information, including OS, CPU, GPU, disk drive names, memory capacity, display resolution, baseboard, BIOS, and GPU driver products/versions. This activity is often performed by adversaries during the discovery phase to understand the compromised environment.
Detects the execution of Accesschk.exe, a Sysinternals utility used for auditing permissions. Adversaries often abuse this tool to discover privileges and access rights on a system, which can aid in privilege escalation or further discovery within the environment.
Page 181 of 203