Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
11 detections
Filters
Last updated
All Time
Detection languages
5
4
1
1
Contributors
4
2
1
1
1
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
8
3
1
Products / Services
3
2
2
2
1
MITRE Techniques
8
3
3
3
2
Detects PHP memory exhaustion errors ('Allowed memory size exhausted') logged via syslog, which may indicate resource exhaustion, denial of service attempts, or exploitation attempts against PHP-based web applications.
Cortex Broker VM Collection Error
Cortex XDR
Detects error-classified data collection audit events associated with designated Cortex Broker VMs, identifying collection failures that may interrupt or degrade data ingestion.
Detects when an adversary is trying to hide it's action from Sysmon logging based on error messages
Uses time-series anomaly detection to identify a sudden, complete drop-off in DeviceEvents telemetry from a host immediately following a suspect driver load, indicating kernel-mode EDR blinding.
Goal: Find machines in the last N days where the SystemGuardSecurityLevel value NOW is less than it was BEFORE.
Step 1: Get a list of all security levels in the system where the level is not null.
Step 1: Get a list of all security levels in the system where the level is not null.
Detects when an adversary is trying to hide it's action from Sysmon logging based on error messages
Get stats on ASR audit events - count events and machines per rule.
The following analytic detects the abnormal termination of the Linux audit daemon (auditd) by identifying DAEMON_ABORT events in audit logs. These terminations suggest a serious failure of the auditing subsystem, potentially due to resource exhaustion, corruption, or malicious interference. Unlike a clean shutdown, DAEMON_ABORT implies that audit logging may have been disabled without system administrator intent. Alerts should be generated on detection and correlated with DAEMON_START, DAEMON_END, and system logs to determine root cause. If no DAEMON_START follows soon after, or this pattern repeats, it indicates a high-severity issue that impacts log integrity and should be immediately investigated.
Detects when one of the critical Windows Event Logs (PowerShell, Sysmon, Security, System) is cleared. This activity is often performed by adversaries to remove traces of their actions and evade detection. The rule specifically looks for Event ID 104 from the 'Microsoft-Windows-Eventlog' provider across these important channels.
Detects various Windows Update errors, including failures to connect to the update service, installation failures, uninstallation failures, revert failures, and commit failures. Monitoring these events is crucial to ensure that critical security updates are being successfully applied to systems. Persistent errors could indicate issues with network connectivity, compromised update services, or attempts to prevent system patching, which could leave systems vulnerable to known exploits.
This rule detects error messages generated by Sysmon when it fails to open its service configuration or connect to its driver to update the configuration. These errors can indicate an adversary's attempt to tamper with or disable Sysmon logging to evade detection. The rule specifically filters out known false positives related to write-protected media or specific error codes (19, 93) to reduce noise.