Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,004 detections
Filters
Last updated
All Time
Detection languages
1,442
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,456
11,839
5,876
5,155
4,865
3,004
Platforms
1,199
673
623
512
218
Products / Services
880
726
311
257
229
MITRE Techniques
1,661
1,109
905
468
464
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
Identify Suspicious Admin Activity in F5 BIG IP
Detects suspicious administrative activities on F5 BIG-IP devices, such as failed logins or configuration changes. This is based on recommendations from F5 in response to a security incident disclosed in October 2025 where a threat actor gained access to BIG-IP development environments. F5 advised customers to enhance monitoring for admin logins, failed authentications, and privilege and configuration changes.
Detects GitHub activity associated with the 'Shai-Hulud' NPM supply chain attack. The attack involves malicious NPM packages that use stolen GitHub tokens to create a new branch, inject a malicious workflow file to exfiltrate secrets, and make private repositories public.
Detects when a transfer lock was removed from an AWS Route 53 domain. This action is typically performed when intending to transfer the domain to a different registrar, but it can also be an indicator of malicious activity if unauthorized. Disabling the transfer lock makes the domain vulnerable to unauthorized transfers, which could lead to domain hijacking or redirection of traffic.
This rule monitors and alerts when a user is added to the 'Global Administrator' or 'Device Administrator' roles within Azure Active Directory. These roles grant highly elevated privileges, making this activity critical for detecting potential persistence, privilege escalation, or initial access attempts by adversaries. The detection logic specifically looks for 'Add member to role' operations within the RoleManagement category, targeting the unique identifiers for these two sensitive administrative roles.
Detects when a user is removed from a privileged role in Azure AD. Bulk changes should be investigated as they could indicate an adversary attempting to remove legitimate administrators or clean up their tracks after gaining access.
Detects when a user successfully resets their own password within Azure Active Directory. This rule specifically looks for 'UserManagement' category events with a 'Success' status, initiated by a 'UPN' (User Principal Name) and targeting a 'UPN' with an 'ActivityType' containing 'Password reset'.
Identifies when an account in a privileged role has not signed in for a specified number of days, indicating a potentially stale or unused privileged account. Such accounts can be a security risk if compromised, as they might not be actively monitored.
Detects activity mentioned in the Operation Wocao report, specifically the use of 'checkadmin.exe' to enumerate local administrators. This tool is used by the threat actor to identify potential targets for privilege escalation or lateral movement.
This rule detects the creation of a new trust relationship to a domain, indicated by Windows Event ID 4706. The addition of domain trusts is an infrequent administrative action and should be carefully verified for legitimacy, as unauthorized trust relationships could be used for privilege escalation or persistence within an Active Directory environment.
Detects when a user is added to a privileged role in Azure AD. This could indicate an attempt to escalate privileges or establish persistence within the cloud environment.
Identifies when the same privilege role has multiple activations by the same user, which could indicate an attempt to bypass time-based access restrictions or an adversary repeatedly activating a role for malicious purposes. This alert is triggered by the 'sequentialActivationRenewalsAlertIncident' risk event type in Azure PIM.
This rule identifies an event where the number of accounts assigned the Global Administrator role in Azure Active Directory (now Microsoft Entra ID) exceeds a predefined threshold. This is detected by monitoring the 'tooManyGlobalAdminsAssignedToTenantAlertIncident' risk event type from Azure PIM (Privileged Identity Management). A high number of Global Administrators can increase the attack surface and risk of privilege abuse or compromise.
Detects when a user without the necessary permissions attempts to invite a guest user in an Azure environment, indicated by a failed 'Invite external user' operation in the audit logs. This could signify an attempt at unauthorized access, privilege escalation, or persistence.
This rule detects the successful creation of a new administrative account within an Azure environment. It specifically looks for audit log entries indicating both 'Add user' and 'Add member to role' actions occurring successfully, which signifies a user being created and then assigned a privileged role.
This rule detects changes to an application's Uniform Resource Identifier (URI) configuration within Azure. Such changes can include modifications to domain names, protocol usage (e.g., switching from HTTPS), the introduction of wildcards, or URIs pointing to uncontrolled domains. These types of modifications can be indicative of an attacker attempting to redirect traffic, establish persistence, or facilitate other malicious activities by altering how an application is accessed or interacts with external resources.
Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.
This detection identifies SSH being enabled on ESXi hosts. Enabling SSH on ESXi can be an early indicator of malicious activity, as threat actors often use SSH to gain persistent remote access after compromising credentials or exploiting vulnerabilities. The rule specifically looks for syslog messages indicating that SSH access has been enabled.
Detects user data export activity.
Detects user permission data export attempt.
Detects when an organization member or an outside collaborator is added to or removed from a project board or has their permission level changed or when an owner removes an outside collaborator from an organization or when two-factor authentication is required in an organization and an outside collaborator does not use 2FA or disables 2FA.
Page 108 of 144