Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,120 detections
Filters
Last updated
All Time
Detection languages
1,062
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
217
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,636
12,583
8,393
6,221
3,120
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
This rule identifies when a key within Azure Key Vault is modified or deleted. This includes operations such as updating, creating, importing, recovering, restoring, deleting, backing up, or purging keys. Monitoring these actions is crucial as compromise or unauthorized modification/deletion of cryptographic keys can lead to significant security incidents, including data compromise, loss of access to encrypted resources, or disruption of services relying on these keys.
This rule identifies when sensitive information is re-identified in Google Cloud Platform (GCP). The detection is based on the 'projects.content.reidentify' method name in GCP audit logs, indicating an attempt to reverse a de-identification process, potentially exposing sensitive data.
Detects when Microsoft Cloud App Security reports activities performed by users whose accounts have been terminated in Azure AD, but are still active in other platforms like AWS or Salesforce. This is particularly relevant for accounts used to manage resources that might not be terminated when a user leaves the company.
This rule identifies when secrets stored in Azure Key Vaults are modified or deleted. It specifically looks for operations such as writing, deleting, backing up, purging, updating, recovering, restoring, or setting secrets within Azure Key Vaults. This activity can indicate unauthorized access to sensitive credentials or an attempt to disrupt services by removing critical secrets.
This rule detects specific commands commonly used to remove or empty the syslog file on Linux systems. Adversaries may clear or modify system logs to remove evidence of their activities, hindering incident response and forensic analysis. The rule specifically looks for 'rm' commands with various flags (e.g., -r, -f, -rf) and 'mv' commands targeting '/var/log/syslog', as well as redirection to empty the file ('>/var/log/syslog').
Detects when a role privilege is deleted in Google Workspace. This could indicate an attempt to remove or modify administrative access, potentially as part of a privilege de-escalation by an attacker to avoid detection, or to clean up after an attack.
Detects when Microsoft Cloud App Security reports an unusual volume of file deletions by a user, which could indicate malicious activity such as data destruction or ransomware.
This rule identifies DNS queries made to domains associated with known cryptocurrency mining pools. It specifically looks for DNS queries where the 'query' field ends with any of the listed mining pool domains. The rule excludes queries with answers '127.0.0.1' or '0.0.0.0' and those marked as rejected, to reduce false positives. The primary goal is to detect potential resource hijacking through cryptomining on compromised systems.
Detects when an application is removed from Google Workspace, which could indicate an attempt to disrupt services or remove security controls. This includes both direct application removal and removal from a whitelist.
This rule identifies when a VPN Tunnel is modified or deleted within Google Cloud Platform. Adversaries may modify or delete VPN tunnels to disrupt network connectivity, reroute traffic, or hinder defensive efforts, impacting the availability or integrity of services.
Detects the execution of the 'groupdel' command, which is used to delete a group on Linux systems. This activity can be abused by threat actors to remove evidence of their presence or to disrupt legitimate user access by deleting groups.
This rule identifies when an Azure Application Gateway is either modified or deleted. This activity is captured through Azure Activity Logs by monitoring specific operation names related to Application Gateway write (modification) and delete operations. Detection of these events can indicate administrative changes to the network infrastructure, which could be legitimate or potentially malicious if unauthorized.
This rule identifies when a device registered in Azure Active Directory (now Microsoft Entra ID) transitions to a state where it is no longer considered managed or compliant. This could indicate a change in device policy, a device being unenrolled, or a security posture degradation.
Detects when a role is modified or deleted in Google Workspace. This could indicate an attacker attempting to escalate privileges, maintain persistence, or disrupt services by altering administrative roles.
This rule detects attempts to shut down a Cisco device or change its boot mode by looking for specific keywords in Cisco AAA logs. The keywords 'shutdown', 'config-register 0x2100', and 'config-register 0x2142' indicate actions that can lead to a denial of service or a change in the device's operational state.
Detects the deletion of a backup catalog on Windows systems. This action can be performed by adversaries to inhibit system recovery, making it harder to restore systems after an attack, such as a ransomware incident.
This rule identifies when an Azure VPN connection is either modified or deleted. This activity is captured through Azure Activity Logs, specifically looking for 'MICROSOFT.NETWORK/VPNGATEWAYS/VPNCONNECTIONS/WRITE' (modification) or 'MICROSOFT.NETWORK/VPNGATEWAYS/VPNCONNECTIONS/DELETE' (deletion) operations. Such actions can indicate an attempt to disrupt network connectivity or reconfigure access to cloud resources, potentially as part of an impact-oriented attack or unauthorized access.
Detects when a Google Cloud Storage bucket is modified or deleted. This includes operations such as deleting a bucket, inserting (creating) a bucket, or updating/patching a bucket's properties. Such activities can indicate unauthorized access, data manipulation, or attempts to disrupt services.
Detects the execution of the 'userdel' binary, which is used to delete a user account and associated files. This activity can be abused by threat actors to remove accounts, hindering forensic analysis and covering their tracks.
Identifies when the default Amazon Elastic Block Store (EBS) encryption is disabled in a specific AWS region. Disabling default encryption does not affect existing volumes but means newly created volumes will not be encrypted by default, potentially impacting data confidentiality and integrity.
Identifies when a network security configuration in Azure is modified or deleted. This could indicate an adversary attempting to bypass security controls, establish persistence, or impact the availability of resources.
Page 123 of 149