Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,004 detections
Filters
Last updated
All Time
Detection languages
1,442
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,443
11,831
5,875
5,151
4,864
3,004
Platforms
1,199
673
623
512
218
Products / Services
880
726
311
257
229
MITRE Techniques
1,661
1,109
905
468
464
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
The following analytic detects a spike in the number of API calls made to cloud security groups by a user. It leverages data from the Change data model, focusing on successful firewall-related changes. This activity is significant because an abnormal increase in security group API calls can indicate potential malicious activity, such as unauthorized access or configuration changes. If confirmed malicious, this could allow an attacker to manipulate security group settings, potentially exposing sensitive resources or disrupting network security controls.
The following analytic identifies the registration of a new Multi-Factor Authentication (MFA) method for an AWS account, as logged through Amazon Security Lake (ASL). It detects this activity by monitoring the `CreateVirtualMFADevice` API operation within ASL logs. This behavior is significant because adversaries who gain unauthorized access to an AWS account may register a new MFA method to maintain persistence. If confirmed malicious, this activity could allow attackers to secure their access, making it harder to detect and remove their presence from the compromised environment.
The analytic identifies cloud instances being modified by users who have not previously modified them. This activity is significant because it can indicate unauthorized or suspicious changes by potentially compromised or malicious users. If confirmed malicious, this could lead to unauthorized access, configuration changes, or potential disruption of cloud services, posing a significant risk to the organization's cloud infrastructure.
Looks for a new device registration in Entra ID preceded by medium or high-risk sign-in session for the same user within maximum 6h timeframe.
The analytic detects the creation of a cloud compute instance in a region that has not been previously used within the last hour. It leverages cloud infrastructure logs and compares the regions of newly created instances against a lookup file of historically used regions. This activity is significant because the creation of instances in new regions can indicate unauthorized or suspicious activity, such as an attacker attempting to evade detection or establish a foothold in a less monitored area. If confirmed malicious, this could lead to unauthorized resource usage, data exfiltration, or further compromise of the cloud environment.
This query helps reviewing admin reported email submissions
The analytic identifies potential exploitation attempts on a PaperCut NG server by analyzing its debug log data. It detects unauthorized or suspicious access attempts from public IP addresses and searches for specific URIs associated with known exploits. The detection leverages regex to parse unstructured log data, focusing on admin login activities. This activity is significant as it can indicate an active exploitation attempt on the server. If confirmed malicious, attackers could gain unauthorized access, potentially leading to data breaches or further compromise of the server.
This query helps reviewing top submitters of admin submissions
Detects attempts by an identity to enumerate its Kubernetes Role-Based Access Control (RBAC) permissions. This activity is often observed in the early stages of a breach as attackers try to understand their access within a compromised Kubernetes environment. This can be achieved by querying the Kubernetes API server's SelfSubjectRulesReview API, for example, using the "kubectl auth can-i --list" command.
This rule identifies when sensitive ClusterRoles or Roles are being modified, deleted, or when their permissions are being escalated or bound in Azure Kubernetes Service (AKS). These operations can indicate an attempt to gain elevated privileges or disrupt access within the Kubernetes cluster.
This rule detects suspicious activity following a successful login to the Azure AD PowerShell application. Specifically, it looks for a user performing multiple administrative actions within a short timeframe after logging in. These actions include adding or updating applications, adding delegated permission grants, or managing certificates and secrets for applications. This behavior is indicative of an attacker attempting to establish persistence or escalate privileges within an Entra ID environment after initial access.
Detects attempts to inject a sidecar container into a running Kubernetes deployment. This is achieved by monitoring for 'patch' operations on 'deployments' resources within the 'apps' API group. An attacker might use this technique to run their code and hide activity within a legitimate pod, rather than deploying a separate, potentially more conspicuous, pod.
Detects the modification or deletion of Kubernetes RoleBindings or ClusterRoleBindings within Azure Kubernetes Service. These actions can indicate an adversary attempting to escalate privileges, maintain persistence, or disrupt services by altering access control configurations.
Detects the creation of a "privileged" container in Kubernetes. A privileged container has root capabilities on the host, allowing it to access and modify host processes, network operations, IPC calls, file system, mount points, and SELinux configurations. This action can indicate a threat actor attempting container breakout or privilege escalation. The rule specifically looks for 'create' verbs on 'pods' resources where 'capabilities' are present, which implies elevated privileges.
This rule detects when a user is added to an administrative role within Office 365. While adding users to administrative roles is not inherently malicious, it is a sensitive action that warrants validation due to the elevated privileges granted. The rule specifically looks for the 'Add member to role.' event type within Office 365 and requires the role to be present in a predefined watchlist of sensitive roles.
Detects when an Azure Kubernetes Cluster is created or deleted. This activity can indicate significant infrastructure changes, either legitimate or malicious. Monitoring these operations is crucial for maintaining the security and integrity of containerized environments.
Detects when a Kubernetes RoleBinding or ClusterRoleBinding is created, modified, or deleted. This activity can indicate privilege escalation attempts or unauthorized access within a Kubernetes cluster.
Detects when Kubernetes Secrets are created, modified, or deleted. This activity is critical to monitor as secrets often contain sensitive information like API keys, passwords, and OAuth tokens. Unauthorized modification or deletion of these secrets could lead to credential compromise, unauthorized access, or denial of service within a Kubernetes cluster.
Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.
Once a user authenticates to the Azure AD PowerShell application, if they take multiple admin actions indicative of establishing their own persistence with an Entra ID application within a portion of the access token time, alert for additional investigation
Identifies when a Azure Kubernetes network policy is modified or deleted.
Page 123 of 144