Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,832 detections
Filters
Last updated
All Time
Detection languages
1,375
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,443
11,831
5,875
5,151
4,864
2,832
Platforms
1,449
916
693
670
264
Products / Services
994
701
613
469
216
MITRE Techniques
1,240
912
484
482
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects when an AWS ElastiCache security group has been created. This action can be used by adversaries to establish persistence or modify network access to ElastiCache resources.
This rule identifies when an Azure Virtual Network or Virtual Network Gateway is modified or deleted. This activity is captured through Azure Activity Logs, specifically looking for 'MICROSOFT.NETWORK/VIRTUALNETWORKGATEWAYS/' or 'MICROSOFT.NETWORK/VIRTUALNETWORKS/' operations that end with '/WRITE' or '/DELETE'. Such actions can indicate unauthorized changes to network infrastructure, potentially leading to denial of service, network segmentation bypass, or other security incidents.
Detects when an administrator grants an application either application permissions (app roles) or highly privileged delegated permissions within an Azure environment. This action is logged in the Azure audit logs as 'Add app role assignment to service principal'. Such assignments can lead to persistence or privilege escalation if abused.
Identifies when a service account is modified, created, updated, enabled, or undeleted in Google Cloud. This rule specifically looks for API calls related to service account management, which could indicate an attacker establishing persistence, escalating privileges, or otherwise manipulating cloud resources.
Detects when a Microsoft Cloud App Security reported for users whose account were terminated in Azure AD, but still perform activities in other platforms such as AWS or Salesforce.
This is especially relevant for users who use another account to manage resources, since these accounts are often not terminated when a user leaves the company.
This is especially relevant for users who use another account to manage resources, since these accounts are often not terminated when a user leaves the company.
Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region.
Disabling default encryption does not change the encryption status of your existing volumes.
Disabling default encryption does not change the encryption status of your existing volumes.
An attempt to export an AWS EC2 instance has been detected. A VM Export might indicate an attempt to extract information from an instance.
Detects the modification of an EC2 snapshot's permissions to enable access from another account
Identifies when a DNS Zone is modified or deleted in Google Cloud.
Identifies when a application gateway is modified or deleted.
Identifies when a application security group is modified or deleted.
Identifies when a network security configuration is modified or deleted.
Detects when storage bucket is modified or deleted in Google Cloud.
Identifies when sensitive information is re-identified in google Cloud.
Identifies when a VPN Tunnel Modified or Deleted in Google Cloud.
Identifies when an EKS cluster is created or deleted.
Detects when a user tampers with S3 data management in Amazon Web Services.
Identifies when a key vault is modified or deleted.
Identifies when secrets are modified or deleted in Azure.
Identifies when a Point-to-site VPN is Modified or Deleted.
Identifies when a VPN connection is modified or deleted.
Page 133 of 135