Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,004 detections
Filters
Last updated
All Time
Detection languages
1,442
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,443
11,831
5,875
5,151
4,864
3,004
Platforms
1,199
673
623
512
218
Products / Services
880
726
311
257
229
MITRE Techniques
1,661
1,109
905
468
464
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
This rule detects commands executed on Cisco network devices related to the export of private keys or the import/management of PKI certificates. Specifically, it looks for the commands 'crypto pki export', 'crypto pki import', and 'crypto pki trustpoint'. These actions can indicate an attempt to exfiltrate sensitive cryptographic material (private keys) or to establish new trusted certificates, which could be used for defense evasion or to facilitate man-in-the-middle attacks.
This rule detects when the master password for an AWS RDS database instance is changed. This activity could be a precursor to data exfiltration or an attempt to gain unauthorized access to the database. The rule specifically looks for the 'ModifyDBInstance' event from 'rds.amazonaws.com' where the 'masterUserPassword' in 'pendingModifiedValues' is present, indicating a password change.
This detection identifies the creation or update of a server instance within an Azure AD Hybrid Health AD FS service using Azure Activity logs. An adversary might perform this action to create a new AD Health ADFS service and a fake server instance to spoof AD FS signing logs, potentially bypassing the need to compromise an on-premises AD FS server. This can be achieved programmatically via HTTP requests to Azure.
Identifies when a service principal was removed in Azure. This action could indicate an attempt to remove legitimate service accounts to hinder detection or to clean up after malicious activity.
This rule detects changes to the device registration policy within Azure. Such modifications can be used by adversaries to evade defenses, escalate privileges, or enable unauthorized device registrations, potentially leading to broader access to the environment. The detection specifically looks for 'Set device registration policies' activity within the 'Policy' category of Azure Audit Logs.
Identifies when a network security configuration in Azure is modified or deleted. This could indicate an adversary attempting to bypass security controls, establish persistence, or impact the availability of resources.
Detects when an attacker calls the "ALTER SERVER AUDIT" or "DROP SERVER AUDIT" transaction in order to delete or disable audit logs on the server. This action is a strong indicator of an adversary attempting to evade detection by tampering with logging mechanisms.
Detects reconnaissance activity involving attempts to enumerate domain administrator accounts and domain groups. Specifically, it looks for Event ID 4661 (An operation was performed on an object) with an AccessMask of '0x2d' (which indicates a read access attempt) on SAM_USER or SAM_GROUP objects whose ObjectName corresponds to well-known SIDs for the built-in Administrator account (-500) or Domain Admins group (-512) within a domain (S-1-5-21- prefix). This activity is often associated with adversaries using commands like 'net user administrator /domain' or 'net group domain admins /domain' to discover privileged accounts.
This rule identifies when a device or device configuration is modified or deleted within Azure. This activity is logged in Azure Activity Logs and can indicate administrative changes, potential misconfigurations, or malicious activity aimed at impacting the availability or integrity of cloud resources.
Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs. This rule specifically looks for Event ID 4662, indicating an operation on an object, where the ObjectType is 'WMI Namespace' and the ObjectName contains 'subscription'. This combination is indicative of WMI persistence mechanisms being created or modified.
Detects when multi-factor authentication (MFA) is disabled in Google Workspace. This could indicate an adversary attempting to weaken security controls for persistent access or to facilitate further compromise.
Detects when an attacker attempts to establish persistence or escalate privileges on an MSSQL server by adding a new or existing account to the 'sysadmin' fixed server role. This action grants the account full administrative control over the SQL Server instance.
Detects attempts to export an Exchange mailbox to an unusual file path, specifically to a network share or a file with an .aspx extension, which could indicate an adversary attempting to place a webshell. It also detects the assignment of the 'Mailbox Import Export' role to a user, a prerequisite for performing mailbox exports.
Identifies when an Azure Application Security Group is modified or deleted. This could indicate an attempt to alter network access controls, potentially to bypass security measures or disrupt services.
This rule detects when a user or entity makes changes to Amazon S3 bucket data management configurations. This includes modifications to logging, website hosting, encryption, lifecycle policies, replication configurations, and object restoration. Such changes could indicate an attempt to tamper with data integrity, availability, or exfiltration mechanisms within S3.
This rule identifies when an application is deleted in Azure. This could indicate an attempt by an adversary to remove traces of their activity, disrupt services, or impact the availability of applications.
This rule identifies when a new Azure Cloud Shell instance is created within the Azure portal. Cloud Shell provides a browser-based shell experience for managing Azure resources, and its creation could indicate administrative activity, or potentially, an attacker establishing a persistent command-line environment within a compromised Azure subscription.
This rule detects the installation of an Exchange Transport Agent. Transport agents are .NET assemblies that can operate on email messages passing through the Exchange transport pipeline. Adversaries may abuse this functionality to establish persistence, intercept emails, or exfiltrate data.
This detection uses Azure Activity logs (Administrative category) to identify the deletion of an Azure AD Hybrid Health AD FS service instance in a tenant. A threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs. The health AD FS service can then be deleted after it is no longer needed via HTTP requests to Azure.
This rule identifies when an Azure DNS zone is either modified or deleted. This activity is detected by monitoring Azure Activity Logs for operations starting with 'MICROSOFT.NETWORK/DNSZONES' and ending with '/WRITE' (for modifications) or '/DELETE' (for deletions). Such changes can indicate malicious activity aimed at redirecting traffic or disrupting services.
Detects when events are deleted in Azure Kubernetes. An adversary may delete events in Azure Kubernetes in an attempt to evade detection by removing forensic evidence.
Page 141 of 144