Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
461 detections
Filters
Last updated
All Time
Detection languages
134
111
68
41
32
Contributors
136
63
56
49
29
Categories
264
153
62
60
59
Platforms
39,894
7,228
6,523
3,864
3,624
461
Products / Services
260
63
57
52
51
MITRE Techniques
148
103
61
58
58
CVEs
3
2
2
1
1
IDS Classtypes
7
5
5
4
3
IDS Protocols
27
Detects when multi-factor authentication (MFA) is disabled in Google Workspace. This could indicate an adversary attempting to weaken security controls for persistent access or to facilitate further compromise.
Detects when a Google Cloud SQL database instance or its user accounts are created, deleted, or modified. This can indicate malicious activity such as data destruction, unauthorized access attempts, or attempts to disrupt services.
This rule identifies when Kubernetes secrets are modified or deleted within a Google Cloud Platform (GCP) environment. It specifically looks for audit log entries related to the creation, update, patch, or deletion of Kubernetes secrets.
Detects when a firewall rule is modified, deleted, or inserted in Google Cloud Platform (GCP). This activity can indicate an adversary attempting to impair defenses or establish persistence by altering network access controls.
This rule identifies when a DNS Zone is either modified or deleted within Google Cloud Platform. This activity is captured through specific Google Cloud DNS API calls: 'Dns.ManagedZones.Delete', 'Dns.ManagedZones.Update', and 'Dns.ManagedZones.Patch'. Such actions can indicate malicious activity aimed at disrupting services or redirecting traffic, or legitimate administrative changes.
This rule identifies activities related to Google Cloud Platform (GCP) Packet Mirroring. Packet Mirroring allows capturing full network traffic, which can be abused by adversaries to intercept and collect sensitive data from unencrypted internal network communications. The rule specifically looks for various API calls related to the creation, modification, deletion, or listing of Packet Mirroring configurations.
Identifies when a service account is disabled or deleted in Google Cloud. This activity can indicate an attempt to remove access for legitimate services or users, potentially as part of an impact or defense evasion strategy.
Identifies when a service account is modified, created, updated, enabled, or undeleted in Google Cloud. This rule specifically looks for API calls related to service account management, which could indicate an attacker establishing persistence, escalating privileges, or otherwise manipulating cloud resources.
Identifies when a DNS Zone is modified or deleted in Google Cloud.
Detects when storage bucket is modified or deleted in Google Cloud.
Identifies when sensitive information is re-identified in google Cloud.
Identifies when a VPN Tunnel Modified or Deleted in Google Cloud.
Detects the creation or patching of potential malicious RoleBinding. This includes RoleBindings and ClusterRoleBinding.
Identifies when the Secrets are Modified or Deleted.
Identifies when a service account is disabled or deleted in Google Cloud.
Identifies when a service account is modified in Google Cloud.
Detects when storage bucket is enumerated in Google Cloud.
Identifies potential full network packet capture in gcp. This feature can potentially be abused to read sensitive data from unencrypted internal traffic.
Identifies when a Google Cloud Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate.
Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs.
An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.
Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs.
An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.
Detect when a Cloud SQL DB has been modified or deleted.
Page 22 of 22