Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,004 detections
Filters
Last updated
All Time
Detection languages
1,442
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,443
11,831
5,875
5,151
4,864
3,004
Platforms
1,199
673
623
512
218
Products / Services
880
726
311
257
229
MITRE Techniques
1,661
1,109
905
468
464
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
This rule detects the use of the 'Get-AdGroup' PowerShell cmdlet with the '-Filter' parameter to enumerate groups within Active Directory. This activity is often performed by attackers during the discovery phase to identify privileged groups and users.
Identifies when a application security group is modified or deleted.
Cisco Discovery
Sigma
Find information about network devices that is not stored in config files
Detect standard users login that are part of high privileged groups such as the Administrator group
This rule is designed to detect attempts to exploit Zerologon (CVE-2020-1472) vulnerability using mimikatz zerologon module or other exploits from machine with "kali" hostname.
Identifies when an EKS cluster is created or deleted.
Identifies when a key vault is modified or deleted.
Detects when administrator grants either application permissions (app roles) or highly privileged delegated permissions
Detects the creation or patching of potential malicious RoleBinding. This includes RoleBindings and ClusterRoleBinding.
Identifies when a service account is disabled or deleted in Google Cloud.
Detects the addition of a new Federated Domain.
Detects activity as "net user administrator /domain" and "net group domain admins /domain"
Detects when an account makes changes to the ingress or egress rules of a security group.
This can indicate that an attacker is attempting to open up new attack vectors in the account, that they are trying to exfiltrate data over the network, or that they are trying to allow machines in that VPC/Subnet to contact a C&C server.
This can indicate that an attacker is attempting to open up new attack vectors in the account, that they are trying to exfiltrate data over the network, or that they are trying to allow machines in that VPC/Subnet to contact a C&C server.
Identifies when an ElastiCache security group has been modified or deleted.
Identifies when a suppression rule is created in Azure. Adversary's could attempt this to evade detection.
Identifies potential full network packet capture in gcp. This feature can potentially be abused to read sensitive data from unencrypted internal traffic.
Detects when an attacker tries to backdoor the MSSQL server by adding a backdoor account to the sysadmin fixed server role
Detects when the a stored procedure is set or cleared for automatic execution in MSSQL. A stored procedure that is set to automatic execution runs every time an instance of SQL Server is started
Detects specific patterns found after a successful ProxyLogon exploitation in relation to a Commandlet invocation of Set-OabVirtualDirectory
Rule to detect an adversary setting OabVirtualDirectory External URL property to a script in Exchange Management log
Detects remote service activity via remote access to the svcctl named pipe
Page 143 of 144