Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,004 detections
Filters
Last updated
All Time
Detection languages
1,442
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,443
11,831
5,875
5,151
4,864
3,004
Platforms
1,199
673
623
512
218
Products / Services
880
726
311
257
229
MITRE Techniques
1,661
1,109
905
468
464
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
This rule detects administrative actions in GCP that involve modifying or deleting Cloud Logging sinks, or disabling specific services, with a specific focus on disabling the logging service itself. Adversaries may perform these actions to tamper with audit trails and evade detection of malicious activities.
This rule detects modifications to AWS IAM policies (PutUserPolicy, PutRolePolicy, PutGroupPolicy, AttachUserPolicy, AttachRolePolicy, or CreatePolicyVersion) that result in a policy granting administrative '*' access to both Actions and Resources. This pattern is commonly used by adversaries for persistence and privilege escalation after initial IAM credential compromise.
Detects the creation of new AWS IAM access keys where the actor initiating the request is distinct from the target user associated with the key. This behavior often indicates an adversary attempting to establish persistent access to a compromised account by creating additional, long-lived credentials.
Detects suspicious modifications to AWS Organization structure, specifically the moving of accounts out of protected organizational units (e.g., security, quarantine, guardrail), accounts leaving the organization, or the detachment of policies, which may indicate an attempt to evade security controls or organizational guardrails.
This rule detects the creation of new, potentially long-lived service account keys for GCP service accounts that possess highly privileged roles, such as Project Owner, Project Editor, or broad custom roles. The creation of such keys for privileged accounts can be a technique used by adversaries to establish persistent, stealthy access within a GCP environment.
This rule detects a correlation between a successful non-interactive authentication event (e.g., token-based sign-in) and a subsequent device registration event performed by the same user identity within a short time window. This sequence is a known pattern for attackers seeking to register an adversary-controlled device against a compromised account to establish durable persistence and potentially bypass conditional access policies (PRT persistence).
This rule detects administrative changes that weaken cloud identity security, specifically the disabling of Entra ID Security Defaults, per-user MFA enforcement, or tenant-wide authentication-methods policies. These actions remove critical second-factor authentication requirements, significantly increasing the risk of unauthorized access via password-spraying or credential-stuffing attacks.
This rule detects instances where a user successfully activates a privileged role via Privileged Identity Management (PIM) in a cloud environment, despite the activation policy requiring approval. It flags cases where the 'Add member to role completed' event indicates that approval is required, but the 'approvalStatus' is absent, suggesting an attempt to bypass the formal approval workflow.
Detects the addition of a federated identity credential to an Azure AD / Entra ID application. Adversaries may use this technique to establish persistent, secretless access to an application's service principal by configuring trust with an external OIDC issuer under their control (e.g., a malicious GitHub repository or personal OIDC provider).
Detects administrative actions in Azure that disable or modify diagnostic settings, which stops the flow of logs to services like Azure Sentinel/Log Analytics, or deletes policy assignments. Such actions are often performed by adversaries to blind security operations monitoring prior to lateral movement or further malicious activity.
This rule detects modifications to AWS IAM policies (PutUserPolicy, PutRolePolicy, PutGroupPolicy, AttachUserPolicy, AttachRolePolicy, or CreatePolicyVersion) that result in a policy granting administrative '*' access to both Actions and Resources. This pattern is commonly used by adversaries for persistence and privilege escalation after initial IAM credential compromise.
Detects the creation of GCP compute instances that are attached to service accounts with broad 'cloud-platform' scope permissions. This activity is monitored to ensure that only authorized automation service accounts (e.g., IaC pipelines) are performing these actions, as creating instances with highly privileged service accounts can be a technique used to escalate privileges or establish persistence.
Detects modifications to application secrets or certificates in Azure that are performed by a user who is not the registered owner of the application, or when a new credential is added to an application that already has credentials configured, potentially indicating persistent access establishment.
Detects the modification of an Azure Storage account configuration to enable public access (allowBlobPublicAccess: true). This activity is often associated with attackers attempting to facilitate anonymous data exfiltration by enabling public access to blobs and subsequently reading them.
Detects the creation of new AWS IAM access keys where the actor initiating the request is distinct from the target user associated with the key. This behavior often indicates an adversary attempting to establish persistent access to a compromised account by creating additional, long-lived credentials.
Detects suspicious modifications to AWS Organization structure, specifically the moving of accounts out of protected organizational units (e.g., security, quarantine, guardrail), accounts leaving the organization, or the detachment of policies, which may indicate an attempt to evade security controls or organizational guardrails.
Detects modifications or deletions of Azure AD Conditional Access policies that weaken security, such as disabling policies, removing MFA requirements, or adding user/group/application exclusions. This behavior can be indicative of an attacker attempting to bypass authentication controls.
This rule detects the creation of new, potentially long-lived service account keys for GCP service accounts that possess highly privileged roles, such as Project Owner, Project Editor, or broad custom roles. The creation of such keys for privileged accounts can be a technique used by adversaries to establish persistent, stealthy access within a GCP environment.
Detects instances where an IAM user or role attempts to assume a role in a different AWS account (Cross-Account) without providing a valid ExternalID. This often indicates unauthorized attempts to access or abuse cross-account trust relationships, which is a common technique for lateral movement or privilege escalation in cloud environments.
This rule detects a correlation between a successful non-interactive authentication event (e.g., token-based sign-in) and a subsequent device registration event performed by the same user identity within a short time window. This sequence is a known pattern for attackers seeking to register an adversary-controlled device against a compromised account to establish durable persistence and potentially bypass conditional access policies (PRT persistence).
Detects the creation or modification of Microsoft 365/Exchange inbox rules that suggest malicious staging or exfiltration activities. This includes rules configured for external email auto-forwarding, automatic deletion of messages, or movement of emails into hidden/system folders (e.g., RSS Subscriptions, Archive) which may be filtered based on sensitive keywords related to financial or credential theft (e.g., invoice, wire, payment).
Page 22 of 144