Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,832 detections
Filters
Last updated
All Time
Detection languages
1,375
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,443
11,831
5,875
5,151
4,864
2,832
Platforms
1,449
916
693
670
264
Products / Services
994
701
613
469
216
MITRE Techniques
1,240
912
484
482
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detect when GCP IAM Organization Policy is updated or deleted.
Detect when multiple KMS crypto key versions are disabled or destroyed from GCP Cloud KMS.
Detect when GCP Security Command Center services are disabled.
Detect when GCP Workload identity pools are disabled or deleted. Disabling or deleting a pool will prevent any connected identities from accessing all GCP resources.
Identifies when an external user account is added to a group in Google Workspace. Security teams can monitor for unexpected user accounts being added to Google Workspace groups to prevent unauthorized access to data.
Identifies when a Google Workspace user transfers the ownership of a file.
Identifies when a Google Workspace user shares a file on Google Drive after a suspicious login event occurred.
Detect an AWS account attempting to leave or being removed from an AWS organization.
Detects when an insecure SSL policy is configured for an AWS Application Load Balancer.
Detects when an insecure SSL policy is configured for an AWS CloudFront distribution.
Detects when AWS Config Service is updated, stopped or deleted.
AWS Delete VPC Flow Logs
YARA-L
Detects when AWS VPC FLow Logs are deleted.
Detects when an Amazon EC2 AMI or Snapshot is shared publicly.
Detect when an EC2 instance makes high number of API calls.
Detect modifications to user data script on an EC2 instance.
Detects excessive successful events within a 5 minute timeframe from an IAM User.
AWS GuardDuty Disabled
YARA-L
Detects when a GuardDuty Detector is disabled or suspended.
Detects when AWS IAM Access Analyzer is deleted.
Detect AWS IAM activities associated with the S3 Browser utility.
Detect AWS IAM activities made by AWS EC2 instances to retain access or escalate privileges.
Detects when AWS IAM AdministratorAccess policy is attached to a user, group or role which can be used for privilege escalation.
Page 129 of 135