Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
694
181
114
75
54
Contributors
328
252
122
76
71
Categories
726
700
220
196
148
Platforms
1,120
187
161
59
51
Products / Services
10,680
9,761
6,694
4,418
3,744
1,153
MITRE Techniques
699
428
360
209
197
CVEs
2
2
1
1
1
IDS Classtypes
4
3
1
1
IDS Protocols
8
This rule identifies when a suppression rule is created in Azure. Adversaries might create suppression rules to evade detection by preventing security alerts from being generated or displayed for their malicious activities.
Detects when highly privileged delegated permissions are granted on behalf of all users in Azure Active Directory. This can indicate an attempt to gain broad access to resources by an application.
Identifies when a application gateway is modified or deleted.
Identifies when a application security group is modified or deleted.
Identifies when a key vault is modified or deleted.
Identifies when a network security configuration is modified or deleted.
Identifies when a VPN connection is modified or deleted.
Identifies when a device or device configuration in azure is modified or deleted.
Identifies when DNS zone is modified or deleted.
Identifies when a Keyvault Key is modified or deleted in Azure.
Identifies when secrets are modified or deleted in Azure.
Identifies when a Azure Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate.
Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs.
An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.
Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs.
An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.
Identifies the deletion of Azure Kubernetes Pods.
Identifies when a Firewall Rule Configuration is Modified or Deleted.
Identifies when a Point-to-site VPN is Modified or Deleted.
Identifies when a virtual network device is being modified or deleted.
This can be a network interface, network virtual appliance, virtual hub, or virtual router.
This can be a network interface, network virtual appliance, virtual hub, or virtual router.
Identifies when a new cloudshell is created inside of Azure portal.
Identifies when a suppression rule is created in Azure. Adversary's could attempt this to evade detection.
Identifies when a Virtual Network is modified or deleted in Azure.
Page 55 of 55