Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
839 detections
Filters
Last updated
All Time
Detection languages
438
190
77
62
40
Contributors
120
114
72
71
68
Categories
464
233
193
152
122
Platforms
288
274
154
88
56
Products / Services
220
169
162
90
76
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
839
CVEs
6
5
5
5
5
IDS Classtypes
4
2
IDS Protocols
1
Detects execution of Azure Automation runbook jobs by managed identities that have recently been assigned high-privilege roles (Owner, Contributor, or User Access Administrator). This behavior is indicative of potential privilege escalation or abuse of existing high-privilege identities to execute unauthorized automation tasks.
Detects execution of Azure Automation runbook jobs by managed identities that have recently been assigned high-privilege roles (Owner, Contributor, or User Access Administrator). This behavior is indicative of potential privilege escalation or abuse of existing high-privilege identities to execute unauthorized automation tasks.
This rule detects changes to a user account's User Account Control (UAC) settings, specifically when the 'NewUacValue' is set to '0x2080'. This value corresponds to the 'ACCOUNTDISABLE' flag, indicating that a user account has been disabled. Monitoring such changes can help identify potential malicious activity where an attacker might disable legitimate user accounts to disrupt operations or hinder incident response.
Detects suspicious activity involving multiple password resets for different users initiated by a single user within a one-hour timeframe in Azure AD. This could indicate an attacker attempting to gain control over multiple accounts.
This rule detects suspicious changes to account delegation settings by monitoring Security Event ID 5136 for modifications to the 'msDS-AllowedToDelegateTo' attribute. It specifically looks for instances where an account's delegation settings are changed two or more times within an hour, which could indicate an adversary attempting to establish persistence or elevate privileges through constrained delegation.
This rule detects the creation or modification of user accounts on Windows systems by monitoring Security Event IDs 4741 (A security-enabled local group was created) and 4742 (A computer account was changed). It summarizes the count of such changes per hour by the subject user name, which can help identify unusual or excessive account management activities.
Detects attempts to modify or delete Conditional Access Policies in Microsoft Graph. Adversaries may attempt to alter or remove Conditional Access Policies to bypass security controls and gain unauthorized access or persistence.
Detects credential abuse patterns from FortiGate logs including administrative changes, tunneling activity, and anomalous source-IP behavior.
Detects the creation of user accounts or modifications to sensitive groups (Event IDs 4720, 4728, 4732, 4756) where the account name matches naming conventions typically associated with backup service accounts or elevated administrative roles (e.g., prefix 'backup_', 'bkp_' or suffix '_da', '_ea'). This activity can indicate an attacker attempting to establish persistence or escalate privileges via compromised or newly created accounts.
This rule detects when a user account is disabled on a Windows system by monitoring Security Event ID 4725. It summarizes the count of disabled accounts per hour, grouped by the subject user name. This can indicate administrative actions, but also potential malicious activity such as an attacker disabling accounts to disrupt services or hinder incident response.
Detects rapid successive password changes to the default 'admin' account on Cisco SD-WAN controllers followed by a configuration rollback. This pattern indicates an adversary attempting to temporarily modify credentials for exploitation while attempting to evade detection by reverting to the original configuration state, specifically targeting NETCONF configuration commits.
This rule detects potentially malicious modification or configuration changes to Azure Function Apps. It monitors for operations such as creation, updates, and configuration changes that contain suspicious indicators like hardcoded credentials (TOKEN, SECRET, PASS), potential reverse shell patterns, or large Base64 encoded payloads. The rule specifically excludes known CI/CD pipeline callers to minimize false positives.
This rule detects potentially malicious modification or configuration changes to Azure Function Apps. It monitors for operations such as creation, updates, and configuration changes that contain suspicious indicators like hardcoded credentials (TOKEN, SECRET, PASS), potential reverse shell patterns, or large Base64 encoded payloads. The rule specifically excludes known CI/CD pipeline callers to minimize false positives.
Detects Event 5136 where msDS-KeyCredentialLink is added to an AD object, indicative of Shadow Credentials abuse via Whisker/DSInternals. The rule filters out MSOL_ sync accounts and computer-to-computer self-writes to reduce false positives.
Detects broad assignments of administrative roles or specific deletion permissions for cloud storage buckets in GCP, AWS, and Azure. This includes granting 'storage.admin', 'storage.objectAdmin', or 'storage.buckets.delete' in GCP, 's3:DeleteBucket' in AWS IAM policies, or 'Storage Account Contributor'/'Owner' roles in Azure. Such assignments to service accounts or non-administrative identities could enable 'Universal Bucket Hijacking' or unauthorized data deletion.
Detects successful Device Code authentication followed immediately by a new device registration, a tactic used to extend access via PRT generation.
This rule detects sensitive modifications to payroll-related information in Workday, such as bank account details, direct deposit settings, or payment method changes. It flags instances where such modifications occur from multiple IP addresses for the same user account, which may indicate account compromise and unauthorized attempts to divert funds.
Detects unauthorized changes to the admin or vmanage-admin user credentials on Cisco SD-WAN Manager. The rule monitors for 'usermod', 'passwd', or AAA password commit commands within the 'vmanage-admin' user context. It specifically identifies a 'change-and-revert' pattern, where the attacker changes a password to gain access and immediately reverts it to evade detection, elevating the risk to critical.
Detects creation and deletion of an Azure SQL firewall rule by the same caller within a short window, which can provide temporary database access while reducing later evidence. This behavior is often indicative of an adversary attempting to gain temporary access to a database, perform actions, and then remove their tracks by deleting the firewall rule.
Detects a compromised account revoking refresh tokens, signing out other sessions, or replacing authentication state to retain exclusive access. This behavior is indicative of an attacker attempting to maintain exclusive control over a compromised account by invalidating other legitimate sessions or tokens.
This rule detects when sensitive administrative roles are assigned directly to users in Microsoft Entra ID (formerly Azure AD) without utilizing the Privileged Identity Management (PIM) service. Direct assignment of these roles bypasses the security controls and JIT (Just-In-Time) access workflows enforced by PIM, potentially indicating unauthorized privilege escalation or a misconfiguration.
Page 17 of 40