Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,004 detections
Filters
Last updated
All Time
Detection languages
1,442
479
390
321
192
Contributors
650
521
286
272
264
Categories
20,456
11,839
5,876
5,155
4,865
3,004
Platforms
1,199
673
623
512
218
Products / Services
880
726
311
257
229
MITRE Techniques
1,661
1,109
905
468
464
CVEs
6
5
5
5
5
IDS Classtypes
49
13
6
3
2
IDS Protocols
40
31
1
This rule detects the creation of a new Azure AD user account via the Microsoft Graph API. It specifically looks for HTTP POST requests to 'graph.microsoft.com' with the URI containing '/users'. This activity could indicate an attacker establishing persistence by creating new accounts in a compromised Azure AD environment.
This rule detects attempts to modify hybrid identity federation settings by monitoring HTTP POST requests to graph.microsoft.com with a URI containing 'federationConfiguration'. This activity could indicate an attacker attempting to establish persistence or gain unauthorized access by manipulating identity federation.
This rule detects attempts to access the command-line interface (CLI) of a network device via Telnet, specifically looking for the 'enable' and 'configure terminal' commands. This indicates an administrative attempt to configure or manage a network device.
This rule detects attempts to deploy a container with host network mode enabled. It specifically looks for HTTP requests to the '/containers/create' endpoint, which is commonly used by container orchestration systems like Docker, and checks for the presence of 'host' within the HTTP client body, indicating the host network mode configuration. This can be a security concern as it allows the container to have direct access to the host's network interfaces, potentially bypassing network segmentation and security controls.
This rule detects the creation of an email auto-forwarding rule within Microsoft Exchange via the Exchange Web Services (EWS) interface. It specifically looks for HTTP requests to the '/EWS/Exchange.asmx' endpoint containing the string 'ForwardToRecipients' in the client body, indicating an attempt to configure email forwarding.
This rule detects attempts to purge mailbox data using Exchange Web Services (EWS) by looking for HTTP requests to '/EWS/Exchange.asmx' containing the 'HardDelete' string in the client body. This activity is indicative of an attacker attempting to remove evidence or sensitive information from a compromised mailbox.
This rule detects the creation of a new inbox rule via Exchange Web Services (EWS) that could be used to hide phishing replies. Specifically, it looks for HTTP traffic to '/EWS/Exchange.asmx' with 'NewInboxRule' in the client body, indicating an attempt to create a new inbox rule.
This rule detects attempts to modify an EC2 instance's attributes, specifically looking for the 'ModifyInstanceAttribute' API call to 'ec2.amazonaws.com'. This activity could indicate an attacker attempting to evade detection or alter the instance's configuration for malicious purposes.
This rule detects HTTP POST requests to cloud compute infrastructure management endpoints, specifically Amazon EC2, Google Cloud Compute, and Azure Management. The rule is triggered if 20 such requests are observed from a single source IP within 60 seconds, indicating potential automated activity to modify cloud infrastructure for evasion purposes.
Identifies a risky sign-in to a known O365 landing page followed shortly by the creation of an inbox rule that deletes messages or moves them to junk/trash. This pattern frequently indicates account compromise (e.g., BEC or AiTM) attempting to hide malicious activity.
This rule monitors successful operations related to Azure Traffic Manager within Azure Activity logs. It summarizes the count of such operations by the caller and time, ordered by the most recent activity. This can be used to track administrative actions or changes made to Traffic Manager configurations.
Detects the successful creation or update of an Azure API Management Service. This activity could indicate legitimate administrative actions or, if unexpected, potential unauthorized access or privilege escalation within the Azure environment. Monitoring these events can help identify suspicious configuration changes or resource provisioning by malicious actors.
This rule detects when a single user makes multiple changes to security groups within a short timeframe (binned hourly). Specifically, it looks for Event IDs 4752 (A security-enabled global group was changed), 4753 (A security-enabled local group was changed), or 4754 (A security-enabled universal group was changed). This could indicate an attempt to manipulate group memberships for privilege escalation or lateral movement.
This rule detects an unusually high number of firewall rule changes (Event ID 4948) occurring on a single computer within a one-hour window. A sudden surge in firewall modifications can indicate malicious activity, such as an attacker attempting to establish persistence, bypass security controls, or facilitate lateral movement by opening new ports or disabling existing rules.
Detects the creation of new members in the 'Domain Admins' or 'Enterprise Admins' groups by monitoring Windows Security Event ID 4728. This event indicates that a member was added to a security-enabled global group. The rule specifically looks for additions to highly privileged administrative groups, which could indicate unauthorized privilege escalation or persistence.
This rule detects potential abuse of Group Policy Objects (GPOs) by identifying multiple changes (3 or more) to GPO-related objects within a short timeframe. It specifically looks for Event ID 5136 (Directory Service Changes) where the ObjectClass is either 'groupPolicyContainer' or 'gPCFileSysPath'. This could indicate an adversary modifying GPOs to achieve persistence, privilege escalation, or other malicious objectives.
This rule detects when an AWS IAM role is assumed, which can be a legitimate activity for temporary elevated access within an AWS environment. The detection is based on HTTP traffic to 'sts.amazonaws.com' with 'AssumeRole' in the URI, indicating a request to the AWS Security Token Service to assume an IAM role. This activity is often associated with privilege escalation techniques.
This rule detects the creation of a new domain trust via LDAP by looking for specific content in TCP traffic on port 389 (LDAP). It specifically targets HTTP POST requests containing "(objectClass=trustedDomain)" in the payload, indicating an attempt to establish a new trust relationship between domains.
This rule detects suspicious activity related to Azure Active Directory service principals. It specifically looks for a service principal performing multiple (5 or more within an hour) 'Add service principal', 'Add owner to application', or 'Add permission grant' operations. This pattern could indicate an attacker attempting to escalate privileges or establish persistence within an Azure AD environment by manipulating service principals and application permissions.
This rule detects suspicious activity related to Azure Active Directory service principals. It specifically looks for a service principal performing multiple (5 or more within an hour) 'Add service principal', 'Add owner to application', or 'Add permission grant' operations. This pattern could indicate an attacker attempting to escalate privileges or establish persistence within an Azure AD environment by manipulating service principals and application permissions.
This rule detects attempts to add email delegate permissions via the Microsoft Graph API. It specifically looks for HTTP PATCH requests to 'graph.microsoft.com' with a URI containing 'mailboxSettings'. This activity could indicate an attacker attempting to gain unauthorized access to a user's mailbox by granting delegate access to another account, which is a common persistence technique.
Page 88 of 144