Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,932
7,263
6,535
3,865
3,643
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects when an Network Zone is Deactivated or Deleted.
Detects when a user has potentially entered their password into the
username field, which will cause the password to be retained in log files.
username field, which will cause the password to be retained in log files.
Detects when an security threat is detected in Okta.
Detects new user account creation
This rule monitors SAP environments by correlating Change Documents (PFCG) with Security Audit logs to detect when a high-privilege role is assigned to a user. It specifically looks for additions to the AGR_USERS table and correlates this activity with security audit events to attribute the action to a specific source IP and user.
This rule detects unauthorized or suspicious direct access to sensitive SAP tables (such as USR02, which contains user credentials) when initiated specifically via an RFC (Remote Function Call) logon connection. This helps identify potential data exfiltration attempts or unauthorized reconnaissance of sensitive SAP security data.
Detects SAP user administration activities including the creation, deletion, or unlocking of user accounts, as captured by SAP Security Audit logs (messages AU7, AU8, AU9, AUA).
This rule monitors SAP systems for high-privileged role assignments by correlating Change Documents (PFCG, AGR_USERS table) with Security Audit logs. It identifies instances where a non-administrative user account assigns a role to another user (or themselves), providing visibility into potential unauthorized privilege escalation or account manipulation within the SAP environment.
Detects high-volume data downloads (AUY) from SAP to a local frontend file, potentially indicating exfiltration.
This rule monitors SAP Change Document logs to identify when highly privileged SAP profiles are assigned to users. This activity is indicative of potential privilege escalation, as it involves modifying user access rights within the SAP environment to grant elevated permissions.
This rule detects the assignment of sensitive or highly privileged roles to users within an SAP environment by monitoring change documents. It focuses on identifying potentially unauthorized or high-risk configuration changes where specific sensitive roles are assigned, which could indicate a privilege escalation attempt.
Detects unauthorized in-memory data modifications occurring during an SAP ABAP debugging session. Specifically, it flags instances where a user modifies data (using the CUL action) while actively debugging their own or another session, excluding predefined SAP administrative accounts.
Detects the execution of high-risk SAP ABAP programs identified in a sensitive program list. These programs, often used for administrative or internal testing purposes, can bypass standard SAP transaction-level authorization checks, making them attractive targets for privilege escalation or unauthorized data access.
This rule detects the execution of sensitive SAP function modules via Remote Function Call (RFC) using SAP Security Audit logs (AUK). It monitors for specific function modules defined in a sensitive list being executed by non-administrative users. The rule provides context including the function group and transaction code involved in the execution.
Detects unauthorized or suspicious modifications to authorization objects (via PFCG transaction) within SAP environments, specifically targeting sensitive roles. The rule correlates these changes with SAP security audit logs to identify the user's session context and ensure the action was performed by someone not listed as an authorized SAP administrator.
Detects a suspicious pattern in SAP environments where an existing user creates a new account (AU7 - User created) and subsequently logs into that newly created account (AU1 - User logged on or AU5 - User logged on via RFC) from the same terminal/IP address within a 30-minute window, potentially indicating account takeover or unauthorized persistence.
Duo User Marked Fraud
YARA-L
This rule detects when a user marks an authentication request as fraudulent within Duo Security. This indicates a potential attempt to gain unauthorized access to a user's account, possibly through MFA fatigue or other social engineering tactics. The rule specifically looks for 'user_marked_fraud' in the security result summary of Duo authentication events.
This rule detects impossible travel scenarios for Azure logins by calculating the speed required to travel between two consecutive login locations for the same user. It flags logins where the calculated speed exceeds the maximum speed of a commercial passenger aircraft (900 km/h) and the logins originate from different countries. Mobile device logins are excluded to reduce false positives related to VPN usage.
This rule detects impossible travel scenarios for Azure logins by calculating the speed required to travel between two consecutive login locations for the same user. It flags logins where the calculated speed exceeds the maximum speed of a commercial passenger aircraft (900 km/h) and the logins originate from different countries. Mobile device logins are excluded to reduce false positives related to VPN usage.
This rule detects potential device code phishing attempts where a user accesses a commonly abused Platform-as-a-Service (PaaS) platform (Cloudflare Workers, Vercel, Amplify) and subsequently attempts to log in via the Microsoft device login endpoint within a 5-minute window. This sequence of events is indicative of an adversary luring a user to a malicious site hosted on a PaaS platform to capture a device code, which is then used to authenticate to Microsoft services.
Detects the creation of a GitHub repository named `tpcp-docs`. This specific repository name is utilized as a fallback exfiltration channel by the TeamPCP threat actor. During the Trivy supply chain attack, the malware abused stolen GitHub tokens to create this public repository on the victim's account to host stolen data as release assets when the primary exfiltration method failed.
Page 120 of 142