Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,122 detections
Filters
Last updated
All Time
Detection languages
1,062
796
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
219
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
3,122
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects delete actions within GitHub audit logs related to codespaces, environments, projects, and repositories. This can indicate an attempt to remove critical development infrastructure or source code.
Detects when a GitHub repository is archived or unarchived, which may indicate unauthorized changes to repository status. This action can be used by adversaries for various purposes, including defense evasion by hiding malicious repositories, persistence by making a repository less likely to be deleted, or impact by disrupting access to legitimate codebases.
This rule detects when an Okta Policy Rule is either modified or deleted. Monitoring changes to policy rules is crucial as unauthorized modifications or deletions could indicate an attempt to bypass security controls, alter access permissions, or disrupt normal operations within the Okta environment. Such actions could lead to unauthorized access, privilege escalation, or impact the availability of services.
This rule detects when an application within the Okta environment is either modified or deleted. This activity can indicate administrative changes, potential misconfigurations, or malicious activity aimed at disrupting services or altering access controls.
Detects when an Okta Network Zone is deactivated or deleted. This activity can indicate an attempt to bypass network-based security controls, potentially allowing unauthorized access from untrusted IP ranges or locations. It could be a precursor to other malicious activities or an attempt to hinder forensic investigation.
Detects when a user attempts to access an application in Okta without proper authorization. This could indicate an attacker trying to gain unauthorized access to resources or a legitimate user attempting to access an application they do not have permissions for.
Detects when a user account in Okta is locked out due to exceeding the maximum number of sign-in attempts. This can indicate brute-force attacks, password spraying, or legitimate users forgetting their passwords.
Detects when an Okta application Sign-on Policy is modified or deleted. This could indicate an adversary attempting to weaken security controls to gain unauthorized access or maintain persistence.
This rule detects when a user account in OneLogin is locked or suspended, either through the API or other system actions. This could indicate an attempt to disrupt user access or a response to suspicious activity.
Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activity is uncommon and provides a high certainty signal.
This rule detects specific command-line patterns associated with Snatch ransomware activity. Specifically, it looks for commands that immediately reboot the system into safe mode ('shutdown /r /f /t 00') and commands that stop the 'SuperBackupMan' service ('net stop SuperBackupMan'). These actions are characteristic of Snatch ransomware's evasion and impact tactics, where it reboots into safe mode to bypass security software and stops backup-related services to facilitate encryption.
Detects potential Ryuk ransomware activity by looking for specific command-line patterns. This includes attempts to establish persistence via the Run registry key, deletion of backup files, and stopping critical services using 'net stop' commands.
Detects unexpected file modifications by 'dns.exe', which could indicate remote code execution or other exploitation, specifically referencing CVE-2020-1350 (SigRed). The rule filters out modifications to 'dns.log' to reduce false positives.
Detects the deletion of an AWS SAML provider, which could indicate an attacker attempting to disrupt administrative or security team access. By removing the SAML provider, an adversary can hinder the ability of security personnel or system administrators to investigate and respond during an attack.
Detects the creation of files with the ".funksec" extension, which is appended to encrypted files by the FunkLocker ransomware. This indicates that a system is actively being encrypted by this specific ransomware.
This rule detects modifications to Cisco device configurations that could be used by an adversary for persistence, privilege escalation, or to impact system availability. Specifically, it looks for commands related to enabling HTTP/HTTPS servers, configuring Kron jobs (scheduled tasks), modifying access lists, archiving configurations, and setting NTP servers. These commands, if used maliciously, can allow an attacker to maintain access, execute arbitrary commands, control network access, or disrupt time synchronization.
Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology for IPv6 transition, unexpected or unauthorized ISATAP router configurations could indicate a potential IPv6 DNS Takeover attack using tools like mitm6. In such attacks, adversaries advertise themselves as DHCPv6 servers and set malicious ISATAP routers to intercept traffic. This detection should be correlated with network baselines and known legitimate ISATAP deployments in your environment.
Detects when an user assumed another user account.
Detects GitHub activity associated with the 'Shai-Hulud' NPM supply chain attack. The attack involves malicious NPM packages that use stolen GitHub tokens to create a new branch, inject a malicious workflow file to exfiltrate secrets, and make private repositories public.
Detects the usage of the Windows native Cipher tool within PowerShell or cmd.exe to wipe the contents of the C Drive. The rule specifically looks for the 'cipher /W:C' command, which is used to remove data from available unused disk space on the C: drive, making previously deleted data unrecoverable.
Detects registry value settings that would replace the user's desktop background. This is a common technique used by malware to change the desktop background to a ransom note or other image.
Page 95 of 149