Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,004 detections
Filters
Last updated
All Time
Detection languages
1,442
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,456
11,839
5,876
5,155
4,865
3,004
Platforms
1,199
673
623
512
218
Products / Services
880
726
311
257
229
MITRE Techniques
1,661
1,109
905
468
464
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
This rule detects potential business email compromise (BEC) activity where a compromised mailbox is used to send internal phishing emails or fraudulent invoices to financial departments. It identifies emails sent internally with subjects containing keywords like 'Invoice', 'Payment', 'Wire Transfer', or 'Updated Account', and correlates them with email sending events from cloud applications.
This rule detects potentially malicious activity within Oracle database audit and alert logs, specifically monitoring for the usage of packages like DBMS_SCHEDULER or UTL_FILE to execute OS commands or manipulate files. It also flags the execution of known exploit scripts or reconnaissance queries commonly associated with database-based attacks and unauthorized data dumping.
Detects rapid enumeration of SharePoint sites, drives, lists, and document libraries from one account, which can precede targeted data collection. This rule identifies a high volume of GET requests to SharePoint-related URIs within a short timeframe, indicating potential reconnaissance or data exfiltration attempts.
Detects a potential logging sink hijack in Google Cloud Platform (GCP) by identifying the deletion of a logging sink's destination bucket followed by the creation of a new bucket with the same name in a different project. This technique could allow an attacker to redirect logs to an attacker-controlled bucket, impairing defenses and potentially exfiltrating sensitive log data.
Detects modification of Azure management groups to bypass governance policies
This rule detects attempts to modify or delete Conditional Access Policies within Microsoft Azure Active Directory (now Microsoft Entra ID) via the Microsoft Graph API. Adversaries may alter or remove these policies to bypass security controls, maintain persistence, or facilitate unauthorized access to resources. The detection specifically looks for network events targeting 'graph.microsoft.com' that involve 'conditionalAccessPolicies' and use 'PATCH' (modification) or 'DELETE' (removal) HTTP methods.
Detects the deletion of a phishing-resistant authentication method (like FIDO2 security key or passkey) followed by the registration of a weaker authentication method (like a phone authentication method or software OATH token) for the same account. This pattern indicates a potential downgrade attack on an account's authentication security.
Detects when an actor searches Slack audit logs, which could indicate an attacker attempting to understand logging capabilities or evade detection. Also detects bulk session resets initiated by an administrator, which may be a response to an account takeover or an attacker attempting to evict legitimate users from their sessions.
Detects new app installations, expansions of OAuth scopes, or the addition of collaborators to Slack applications. These activities can indicate an adversary attempting to gain persistent access, escalate privileges, or exfiltrate data from Slack by leveraging malicious or compromised applications.
Detects high volume Google Cloud Storage (GCS) object listing and downloads, which can indicate reconnaissance of cloud storage contents or data exfiltration. The rule correlates multiple 'storage.objects.list' and 'storage.objects.get' operations within a one-hour window from the same identity, bucket, and project, flagging activity exceeding 50 operations.
Detects attempts to invoke 'sudo' for privilege escalation or enumeration from non-interactive contexts such as scripts, scripting language interpreters, or web/application service processes. It also identifies 'sudo -l' or '--list' commands used for privilege enumeration.
Detects attempts by a user or process to disable or modify Linux kernel-level mandatory access control mechanisms, specifically SELinux and AppArmor. Such actions are commonly performed by adversaries to reduce system security posture and facilitate further malicious activity by bypassing enforced containment policies.
Detects the attacker leveraging a stolen token to create or modify inbox rules (e.g., moving emails to RSS Subscriptions or Archive) to hide their activities. This rule specifically looks for actions like 'New-InboxRule' or 'Set-InboxRule' with parameters indicating email manipulation such as 'MoveToFolder', 'DeleteMessage', or 'MarkAsRead'.
Detects modifications to Azure AD domain federation settings or authentication methods that could indicate attempts to establish persistent access or bypass authentication controls (e.g., golden SAML attacks, domain-level backdoors). The rule monitors for successful operations related to domain federation, authentication changes, and domain management, excluding known administrative actions from internal Microsoft domains.
This rule detects suspicious activities related to OAuth application consent and service principal operations originating from IP addresses identified as proxy infrastructure. Specifically, it looks for actions such as adding service principal credentials, granting OAuth2Permission, consenting to applications, adding delegated permission grants, and adding service principals or applications, when these actions are performed from a proxy IP address. This combination of activities and source IP can indicate an adversary attempting to establish persistence or escalate privileges within an Azure AD environment.
Detects modifications to Azure AD domain federation settings or authentication methods that could indicate attempts to establish persistent access or bypass authentication controls (e.g., golden SAML attacks, domain-level backdoors). The rule monitors for successful operations related to domain federation, authentication changes, and domain management, excluding known administrative actions from internal Microsoft domains.
Detects a single source issuing at least eight HTTP PUT requests to five or more distinct Ghost Admin post objects within a ten-minute window. This activity is indicative of the Ghost ClickFix attack chain, which involves mass modification of blog posts.
Detects a successful self-service password reset for a privileged or high-value account when the initiating context does not match an approved helpdesk workflow.
This rule detects modifications to Group Policy Objects (GPOs) that involve sensitive attributes such as logon scripts, startup/shutdown scripts, or file system paths, particularly when performed by service accounts or non-administrator users. This activity is a common indicator of persistence mechanisms or lateral movement via GPO abuse.
This rule monitors GitHub repository activity (git.push, git.clone, repo.contents) to identify specific activity patterns associated with known GitHub usernames, email addresses, or specific repository paths (e.g., tools/setup, .github/scripts/precheck) and commit messages. It flags potentially significant actions such as forced pushes to default branches for review.
Detects administrative commands (e.g., showing running configuration, copying startup configuration, or accessing enable secret) executed via SSH or Telnet on network devices from non-baseline management IP addresses.
Page 75 of 144