Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,119 detections
Filters
Last updated
All Time
Detection languages
1,061
794
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
310
Platforms
2,112
365
217
213
142
Products / Services
487
482
389
167
149
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
3,119
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Identifies when DNS zone is modified or deleted.
Identifies when a Keyvault Key is modified or deleted in Azure.
Identifies the deletion of Azure Kubernetes Pods.
Identifies when a Firewall Rule Configuration is Modified or Deleted.
Identifies when a Point-to-site VPN is Modified or Deleted.
Identifies when a virtual network device is being modified or deleted.
This can be a network interface, network virtual appliance, virtual hub, or virtual router.
This can be a network interface, network virtual appliance, virtual hub, or virtual router.
Identifies when a suppression rule is created in Azure. Adversary's could attempt this to evade detection.
Identifies when a Virtual Network is modified or deleted in Azure.
Detect when a Cloud SQL DB has been modified or deleted.
Detects when a Microsoft Cloud App Security reported when a user uploads files to the cloud that might be infected with ransomware.
Detects when a Microsoft Cloud App Security reported a user has deleted a unusual a large volume of files.
Detects specific commands commonly used to remove or empty the syslog
Detects command line parameters or strings often used by crypto miners
DD File Overwrite
Sigma
Detects potential overwriting and deletion of a file using DD.
Detects when a user manipulates with Firmward Password on MacOS. NOTE - this command has been disabled on silicon-based apple computers.
Detects a segmentation fault error message caused by a crashing apache worker process
An application has been removed. Check if it is critical.
User Logoff Event
Sigma
Detects a user log-off activity. Could be used for example to correlate information during forensic investigations
Locked Workstation
Sigma
Detects locked workstation session events that occur automatically after a standard period of inactivity.
Windows Update Error
Sigma
Detects Windows update errors including installation failures and connection issues. Defenders should observe this in case critical update KBs aren't installed.
This the exploitation of a NTFS vulnerability as reported without many details via Twitter
Page 129 of 149