Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,004 detections
Filters
Last updated
All Time
Detection languages
1,442
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,456
11,839
5,876
5,155
4,865
3,004
Platforms
1,199
673
623
512
218
Products / Services
880
726
311
257
229
MITRE Techniques
1,661
1,109
905
468
464
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
Detects when five or more user accounts are deleted within a one-hour period by a single user. This activity can indicate malicious intent to disrupt operations or cover tracks.
Detects deletion of MFA configurations to enable authentication bypass
This rule detects modifications to registry keys related to the Local Security Authority (LSA) or Security Account Manager (SAM). Such modifications, indicated by Event ID 4657, can be a sign of privilege escalation attempts, credential dumping, or other malicious activities aimed at compromising system security.
This rule detects modifications to the 'AdminCount' attribute in Active Directory, indicated by Event ID 5136. Changes to this attribute can signify privilege escalation attempts or modifications to highly privileged accounts.
This rule detects attempts to deploy a malicious pod via the Kubernetes API. It specifically looks for HTTP POST requests to the '/api/v1/namespaces/' endpoint followed by '/pods', indicating an attempt to create a new pod within a Kubernetes namespace.
This rule detects a spike in modifications or creations of Azure Diagnostic Settings within a one-hour window. A high volume of 'Diagnostic Setting' operations by a single caller could indicate an attempt to alter logging configurations, potentially to impair defenses or hide malicious activity.
This rule detects when a single caller performs multiple (3 or more) retrievals of Azure Storage Account Keys within a one-hour window. This activity can indicate an attempt to gain unauthorized access to storage resources or exfiltrate data.
Flags Intune assignments to “All Devices” or “All Users,” which attackers may abuse for mass deployment.
This rule detects when a single caller performs multiple (3 or more) retrievals of Azure Storage Account Keys within a one-hour window. This activity can indicate an attempt to gain unauthorized access to storage resources or exfiltrate data.
This rule detects when a single caller successfully updates three or more SQL Server firewall rules within a one-hour window. This behavior could indicate an adversary attempting to open up network access to a SQL database, potentially for data exfiltration, command and control, or further lateral movement.
This rule detects suspicious activity related to Azure AD device registration. It identifies instances where a single user principal name (UPN) performs 5 or more device registrations or adds members to groups within a one-hour window, specifically targeting device resources. This could indicate an adversary attempting to register multiple devices to bypass conditional access policies or gain persistent access.
This rule detects suspicious GitHub workflow modifications or pushes originating from multiple distinct IP addresses within a short time frame (1 hour). It specifically looks for 'WorkflowCreated', 'WorkflowUpdated', or 'Push' actions on GitHub, and triggers if more than one such event and more than one distinct IP address are observed for a given account within an hour. This could indicate compromised credentials or unauthorized access to a GitHub account being used to manipulate CI/CD pipelines.
Detects creation of Intune device management scripts, a potential privilege abuse vector.
Detects suspicious Azure PIM role activation requests for temporary elevated access
Detects assignments of Intune objects (such as policies, scripts, or applications) to high-impact default groups like 'All Devices' or 'All Users'. Adversaries leverage these broad assignments to maximize the blast radius of malicious payloads or destructive wipe commands.
This rule detects the creation of new transport rules within Exchange Online. Adversaries may create malicious transport rules to forward emails, bypass security controls, or exfiltrate data. Monitoring the creation of new transport rules can help identify suspicious activity.
This rule detects when sharing inheritance settings are modified in SharePoint. This could indicate an attempt to broaden access to sensitive information, a misconfiguration, or an attacker attempting to maintain access or exfiltrate data.
This rule detects when a user creates two or more email forwarding rules within a one-hour period in Exchange Online. This behavior can indicate an adversary setting up persistence or exfiltration mechanisms for email.
This rule detects the creation of an Azure Blob Lifecycle Management rule that is configured for deletion. It specifically looks for HTTP PUT requests to blob.core.windows.net with 'managementPolicies' in the URI, indicating an attempt to define or modify lifecycle policies for Azure Blob Storage, potentially for data deletion.
This rule detects attempts to dump router configuration via a Telnet session. Specifically, it looks for the string "show running-config" being sent to a Telnet server on the home network. This command is commonly used on network devices to display their current running configuration, and its use over an unencrypted protocol like Telnet could indicate unauthorized access or data exfiltration.
This rule detects suspicious device registration operations in a tenant by identifying device names that match known automated device code phishing kit patterns. Specifically, it looks for device names that are in the format of 'DESKTOP-' followed by 6 to 8 hexadecimal characters, which deviates from typical Windows default naming conventions. This pattern is often used by attackers to register devices for persistence or to bypass MFA.
Page 84 of 144