Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,120 detections
Filters
Last updated
All Time
Detection languages
1,062
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
217
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,636
12,583
8,393
6,221
3,120
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects when storage bucket is modified or deleted in Google Cloud.
Identifies when sensitive information is re-identified in google Cloud.
Identifies when a VPN Tunnel Modified or Deleted in Google Cloud.
Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.
Detects command line parameters or strings often used by crypto miners
Identifies when an EKS cluster is created or deleted.
Identifies when a key vault is modified or deleted.
Identifies when secrets are modified or deleted in Azure.
Identifies when a network security configuration is modified or deleted.
Identifies when a VPN connection is modified or deleted.
Identifies when a service account is disabled or deleted in Google Cloud.
Identifies when a service account is modified in Google Cloud.
Detects process connections to a Monero crypto mining pool
Detects execution of the "groupdel" binary. Which is used to delete a group. This is sometimes abused by threat actors in order to cover their tracks
Detects events in which a history file gets deleted, e.g. the ~/bash_history to remove traces of malicious activity
Detects execution of the "userdel" binary. Which is used to delete a user account and related files. This is sometimes abused by threat actors in order to cover their tracks
Nginx Core Dump
Sigma
Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts.
Detects the stopping of a Windows service via the PowerShell Cmdlet "Stop-Service"
Detects when a EFS Fileshare is modified or deleted.
You can't delete a file system that is in use.
If the file system has any mount targets, the adversary must first delete them, so deletion of a mount will occur before deletion of a fileshare.
You can't delete a file system that is in use.
If the file system has any mount targets, the adversary must first delete them, so deletion of a mount will occur before deletion of a fileshare.
Detects when a EFS Fileshare Mount is modified or deleted. An adversary breaking any file system using the mount target that is being deleted, which might disrupt instances or applications using those mounts.
Identifies when an ElastiCache security group has been modified or deleted.
Page 128 of 149