Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
490 detections
Filters
Last updated
All Time
Detection languages
406
57
13
12
1
Contributors
387
54
19
12
8
Categories
142
104
64
45
34
Platforms
385
30
19
18
13
Products / Services
205
136
62
40
27
MITRE Techniques
18,079
15,542
12,519
8,344
6,154
CVEs
2
1
Detects changes to the "TracingDisabled" key in order to disable ETW logging for services.exe (SCM)
Detects when an attacker register a new SIP provider for persistence and defense evasion
Detects tamper attempts to sophos av functionality via registry key modification
Detects a Sysmon configuration change, which could be the result of a legitimate reconfiguration or someone trying manipulate the configuration
Triggers on any Sysmon "FileBlockExecutable" event, which indicates a violation of the configured block policy
Detects when a GitHub repository is archived or unarchived, which may indicate unauthorized changes to repository status.
Identifies when Rule Collections (Application, NAT, and Network) is being modified or deleted.
Identifies when a Firewall Policy is Modified or Deleted.
Monitor and alert on conditional access changes where non approved actor removed CA Policy.
Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare "old" vs "new" value.
Monitor and alert for changes to the device registration policy.
Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.
Detects disabling of Multi Factor Authentication.
Detects the addition of a new Federated Domain.
Detects when an attempt at deactivating or resetting MFA.
Detects removing immutable file attribute.
Detect changes of syslog daemons configuration files
Detects the execution of 'auditctl' with the '-D' command line parameter, which deletes all configured audit rules and watches on Linux systems.
This technique is commonly used by attackers to disable audit logging and cover their tracks by removing monitoring capabilities.
Removal of audit rules can significantly impair detection of malicious activities on the affected system.
This technique is commonly used by attackers to disable audit logging and cover their tracks by removing monitoring capabilities.
Removal of audit rules can significantly impair detection of malicious activities on the affected system.
Detects usage of the 'chattr' utility to remove immutable file attribute.
Detects chmod targeting files in sensitive directory paths on Linux systems.
Attackers may use chmod to change permissions of files in these directories to maintain persistence, escalate privileges, or disrupt system operations.
Attackers may use chmod to change permissions of files in these directories to maintain persistence, escalate privileges, or disrupt system operations.
Detects logs clearing attempts on Linux systems via utilities such as 'rm', 'rmdir', 'shred', and 'unlink' targeting log files and directories.
Adversaries often try to clear logs to cover their tracks after performing malicious activities.
Adversaries often try to clear logs to cover their tracks after performing malicious activities.
Page 19 of 24