Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,122 detections
Filters
Last updated
All Time
Detection languages
1,062
796
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
219
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
3,122
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects when an application is modified or deleted.
Detects when an Okta policy is modified or deleted.
Detects when an Policy Rule is Modified or Deleted.
Detects when unauthorized access to app occurs.
Detects when an user account is locked out.
Detects when a GitHub repository is archived or unarchived, which may indicate unauthorized changes to repository status.
A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com.
This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected,
it should be validated from GitHub UI because the log entry may not provide full context.
This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected,
it should be validated from GitHub UI because the log entry may not provide full context.
Identifies when Rule Collections (Application, NAT, and Network) is being modified or deleted.
Identifies when a Firewall Policy is Modified or Deleted.
Cisco File Deletion
Sigma
See what files are being deleted from flash file systems
Audit CVE Event
Sigma
Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited.
MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability.
Unfortunately, that is about the only instance of CVEs being written to this log.
MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability.
Unfortunately, that is about the only instance of CVEs being written to this log.
Detects the image load of vss_ps.dll by uncommon executables. This DLL is used by the Volume Shadow Copy Service (VSS) to manage shadow copies of files and volumes.
It is often abused by attackers to delete or manipulate shadow copies, which can hinder forensic investigations and data recovery efforts.
The fact that it is loaded by processes that are not typically associated with VSS operations can indicate suspicious activity.
It is often abused by attackers to delete or manipulate shadow copies, which can hinder forensic investigations and data recovery efforts.
The fact that it is loaded by processes that are not typically associated with VSS operations can indicate suspicious activity.
Detects when adversaries stop services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities
Detects when adversaries stop services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities
Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct data destructive activities
Detects changes of sensitive and critical files. Monitors files that you don't expect to change without planning on Linux system.
These files include, but are not limited to, system configuration files, authentication files, and critical application files.
Attackers often target these files to maintain persistence, escalate privileges, or disrupt system operations.
These files include, but are not limited to, system configuration files, authentication files, and critical application files.
Attackers often target these files to maintain persistence, escalate privileges, or disrupt system operations.
Detects when a API Token is revoked.
Detects when an application Sign-on Policy is modified or deleted.
Detects when an Network Zone is Deactivated or Deleted.
On March 11, 2026, the global medical technology giant Stryker experienced a severe cyberattack when Iranian-linked hackers called Handala Hack affiliated with Iranian Ministry of Intelligence and Security (MOIS) used wiper malware to permanently erase data from its network. Based On the List of IOC’s seen from the previous attacks from the threat group I’ve done threat hunt.
Detects Qilin ransomware attack chain where DLL sideloading via msimg32.dll is followed by malicious driver installation on the same host
Page 84 of 149