Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,004 detections
Filters
Last updated
All Time
Detection languages
1,442
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,443
11,831
5,875
5,151
4,864
3,004
Platforms
1,199
673
623
512
218
Products / Services
880
726
311
257
229
MITRE Techniques
1,661
1,109
905
468
464
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
Detects an Entra 'Add device' event within 2 minutes after a successful sign-in from an IP never seen for that user in the lookback window, and where the registration originates from that same new IP (rogue device persistence after token replay).
Detects agentic AI jailbreak attempts that try to establish persistent control over M365 Copilot through rule injection, universal triggers, response automation, system overrides, and persona establishment techniques. The detection analyzes the PromptText field for keywords like "from now on," "always respond," "ignore previous," "new rule," "override," and role-playing commands (e.g., "act as," "you are now") that attempt to inject persistent instructions. The search computes risk by counting distinct jailbreak indicators per user session, flagging coordinated manipulation attempts.
The following analytic detects the creation of a local administrator account using the "net.exe" command. It leverages Endpoint Detection and Response (EDR) data to identify processes named "net.exe" with the "/add" parameter and keywords related to administrator accounts. This activity is significant as it may indicate an attacker attempting to gain persistent access or escalate privileges. If confirmed malicious, this could lead to unauthorized access, data theft, or further system compromise. Review the process details, user context, and related artifacts to determine the legitimacy of the activity.
A BTP service instance or service binding was created, modified, or deleted through the Service Manager API
A BTP subaccount entity was deleted from the global account
A Build Work Zone site was created or its content was modified
Detects when a privileged SAP user's credentials are reset by an administrator and subsequently used to log in from the same IP address that the administrator previously used.
This rule detects when a user starts an ABAP program that is on a list of deprecated or unsafe programs within an SAP environment using SAP Security Audit logs.
Detects when a user invokes a function module on the deprecated or unsafe module list within SAP environments based on SAP security audit logs.
Detects dynamic ABAP programming events (Insert, Generate, Delete) in SAP environments, excluding pre-defined authorized transactions.
Detects when a privileged SAP account modifies the master record of a different user within a specified timeframe.
Detects successful or failed logon activity by a privileged SAP account on a production system using SAP Security Audit logs.
Detects modifications to privileged SAP accounts' user master records or authorizations, indicating potential account manipulation or privilege abuse.
Detects when a dialog user reads a restricted SAP table using generic table browser transactions such as SE11, SE16, or SE16N.
This rule detects when a user executes a sensitive or restricted transaction code in an SAP system, as identified by SAP security audit logs (AU3/AU4 messages). It tracks non-excluded users performing these transactions and aggregates them over a 75-minute window.
A transaction code lock was removed through message ID AUQ
Detects the execution of the SAP Transport Organizer transaction (SE09), which is critical for managing development objects and transport requests. Execution by unauthorized users may indicate unauthorized system modification or bypassing of change management controls.
Detects the modification of a user's master record via an administrative action within SAP, which may indicate unauthorized account manipulation or privilege escalation.
Detects a successful device-code sign-in followed within 60 minutes by non-interactive replay from a different IP AND a persistence action (inbox rule, app consent, device add) from a non-original IP. Persistence is now mandatory (inner join) instead of optional, and the retired AADSignInEventsBeta table is replaced by EntraIdSignInEvents.
Detects an Entra 'Add device' event within 2 minutes after a successful sign-in from an IP never seen for that user in the lookback window, and where the registration originates from that same new IP (rogue device persistence after token replay).
Detects the creation of scheduled tasks on remote hosts by monitoring for the NetrJobAdd function call (opnum 0) against the ATSVC RPC interface (UUID: 1FF70682-0A51-30E8-076D-740BE8CEE98B). This interface is associated with the legacy Windows AT scheduler, which is frequently abused by offensive security tools like Impacket's atexec for remote command execution and lateral movement.
Page 5 of 144