Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
505 detections
Filters
Last updated
All Time
Detection languages
245
92
78
48
19
Contributors
141
113
53
46
41
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
210
138
110
80
76
Products / Services
147
74
61
41
28
MITRE Techniques
243
128
69
68
55
CVEs
10
9
5
5
5
IDS Classtypes
4
IDS Protocols
4
Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities.
Upon deletion, GuardDuty stops monitoring the environment and all existing findings are lost.
Verify with the user identity that this activity is legitimate.
Upon deletion, GuardDuty stops monitoring the environment and all existing findings are lost.
Verify with the user identity that this activity is legitimate.
Detects the addition of a new module to an IIS server.
Detects the removal of a previously installed IIS module.
Detects when an access level is changed for a Google workspace application.
An access level is part of BeyondCorp Enterprise which is Google Workspace's way of enforcing Zero Trust model.
An adversary would be able to remove access levels to gain easier access to Google workspace resources.
An access level is part of BeyondCorp Enterprise which is Google Workspace's way of enforcing Zero Trust model.
An adversary would be able to remove access levels to gain easier access to Google workspace resources.
Detects when an application is modified or deleted.
Detects changes to the bitbucket audit log configuration.
Detects when a secret scanning allowlist rule is added for projects.
Detects when a repository is exempted from secret scanning feature.
Detects when a user creates action secret for the organization, environment, codespaces or repository.
Detects when a modification (create, update or replace) action is taken that affects mutating or validating webhook configurations, as they can be used by an adversary to achieve persistence or exfiltrate access credentials.
Detects changes to of the IIS server configuration in order to disable/remove the ETW logging/processing option.
Detects changes to of the IIS server configuration in order to disable HTTP logging for successful requests.
A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com.
This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected,
it should be validated from GitHub UI because the log entry may not provide full context.
This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected,
it should be validated from GitHub UI because the log entry may not provide full context.
Detects when changes are made to the SSH certificate configuration of the organization.
Detects when a configuration change is made to an applications AppID URI.
Detects when a configuration change is made to an applications URI.
URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.
URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.
Invalid PIM License
Sigma
Identifies when an organization doesn't have the proper license for PIM and is out of compliance.
Detects the deactivation of the SAP Security Audit Log (AUJ). This is a critical event as it stops further security logging.
Detects when an Network Zone is Deactivated or Deleted.
Detects unauthorized modifications to the SAP Security Audit Log configuration by monitoring specific SAP system message codes (AUE, AUF, AUI, AUJ, FU0, E05) associated with audit trail changes, excluding known administrative accounts.
Detects the modification of sensitive authorization objects (CD1251) within a role. This identifies potential 'backdoor' privilege escalation where a standard role is granted administrative powers (e.g., Debugging or System Table access) via PFCG.
Page 19 of 25