Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,120 detections
Filters
Last updated
All Time
Detection languages
1,062
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
217
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,636
12,583
8,393
6,221
3,120
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.
Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.
This rule detects when multiple HMAC (Hash-based Message Authentication Code) authentication keys are deleted from Google Cloud Storage settings within a one-hour window by the same user. HMAC keys are used for programmatic access to Cloud Storage, and their deletion can indicate an attempt to disrupt legitimate access, cover tracks, or impact service availability.
Detects when a user deletes multiple secrets or secret versions from Google Cloud Platform (GCP) Secret Manager within a one-hour period. This activity could indicate an attempt to destroy critical data or disrupt services.
This rule detects when an OpenCanary honeypot's NTP service receives a 'monlist' request. The 'monlist' command is a deprecated feature in NTP that can be abused for amplification attacks (Network Denial of Service). Detecting this activity on a honeypot indicates an adversary is likely scanning for vulnerable NTP servers or attempting to use the honeypot in an amplification attack.
This rule detects when a single user disables or destroys 10 or more Google Cloud KMS (Key Management Service) crypto key versions within a one-hour period. This activity could indicate an attacker attempting to destroy data encrypted by these keys, leading to data unavailability or integrity issues. The rule specifically looks for 'DestroyCryptoKeyVersion' events or 'UpdateCryptoKeyVersion' events where the key version state is changed to 'DISABLED'.
This rule detects when a single user disables multiple Google Cloud Platform (GCP) Service APIs within a short period (1 hour). Specifically, it triggers if a user performs more than 5 'DisableService' actions on 'serviceusage.googleapis.com' within an hour. This activity could indicate an attempt to disrupt cloud services or evade detection by disabling security-related APIs.
Identifies when a user deletes multiple files from Google Drive within a one-hour period. This activity may indicate an attempt at data destruction or an insider threat activity.
Detects when an AWS Backup Plan or Backup Selection is deleted. This activity can indicate an adversary attempting to inhibit system recovery by removing backup configurations, potentially as a precursor to data destruction or encryption for impact.
This rule detects cryptocurrency mining activity within Amazon EC2, AWS Lambda, or Amazon EKS Runtimes, as reported by AWS GuardDuty. It specifically looks for GuardDuty findings related to 'CryptoCurrency', 'CryptoMinerExecuted', or 'BitcoinDomainRequest' and filters out sample findings.
Detects when an AWS Key Management Service (KMS) key is disabled or scheduled for deletion. This activity can indicate an attempt to disrupt services, destroy data, or hinder forensic analysis by making encrypted data inaccessible.
This rule detects Denial of Service (DoS) activity originating from an Amazon EC2 instance, as identified by AWS GuardDuty. It specifically looks for GuardDuty findings where the product event type indicates a DenialOfService event and filters out any sample findings.
Detects when an Amazon Simple Email Service (SES) configuration is modified, which could indicate an attacker attempting to propagate phishing email campaigns. This includes the creation, deletion, or verification of email identities and domains, as well as enabling sending for accounts or configuration sets.
Detects command line patterns used by BlackByte ransomware in different operations, including execution from the Public user directory, attempts to delete Task Manager, disable services, and use obfuscated PowerShell commands.
Detect when multiple HMAC authentication keys are deleted from GCP Storage settings.
Identifies when a user deletes multiple files from Google Drive, which may indicate data destruction.
Detects instances where an NTP service on an OpenCanary node has had a NTP monlist request.
This rule detects the Helldown ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include finding files for encryption, the encryption process itself, dropping a ransom note, and attempting to kill virtual machines. The rule specifically targets ELF executables, indicating it's designed for Linux systems.
AWS Backup Plan Deleted
YARA-L
Detects when AWS Backup Plan is deleted.
Detect when a KMS (Key Management Service) key is disabled or scheduled for deletion.
Detect when the Amazon Simple Email Service (SES) has been modified where an attacker can modify Amazon SES service to propagate phishing emails campaigns.
Page 121 of 149