Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
839 detections
Filters
Last updated
All Time
Detection languages
438
190
77
62
40
Contributors
120
114
72
71
68
Categories
464
233
193
152
122
Platforms
288
274
154
88
56
Products / Services
220
169
162
90
76
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
839
CVEs
6
5
5
5
5
IDS Classtypes
4
2
IDS Protocols
1
This rule monitors SAP Change Document logs to identify when highly privileged SAP profiles are assigned to users. This activity is indicative of potential privilege escalation, as it involves modifying user access rights within the SAP environment to grant elevated permissions.
This rule detects the assignment of sensitive or highly privileged roles to users within an SAP environment by monitoring change documents. It focuses on identifying potentially unauthorized or high-risk configuration changes where specific sensitive roles are assigned, which could indicate a privilege escalation attempt.
Detects multiple password changes (BU2) by a single actor or targeting a single user across systems.
Detects unauthorized or suspicious modifications to authorization objects (via PFCG transaction) within SAP environments, specifically targeting sensitive roles. The rule correlates these changes with SAP security audit logs to identify the user's session context and ensure the action was performed by someone not listed as an authorized SAP administrator.
Detects various sensitive configuration modifications in AWS that could indicate malicious activity, such as privilege escalation, defense evasion, or data exposure. This rule looks for a curated list of API calls related to changes in IAM, EC2 security groups, S3 bucket policies, and logging configurations.
Detects various sensitive configuration modifications in AWS that could indicate malicious activity, such as privilege escalation, defense evasion, or data exposure. This rule looks for a curated list of API calls related to changes in IAM, EC2 security groups, S3 bucket policies, and logging configurations.
Azure Suspicious Redirect URI Detection
Cortex XDR
This rule detects the modification or addition of redirect URIs for Azure Active Directory applications or service principals that point to suspicious domains. These suspicious domains include known reverse proxy/tunneling services (e.g., ngrok, cloudflare tunnel), callback infrastructure (e.g., burpcollaborator, interact.sh), or localhost/loopback addresses. Such modifications can indicate an adversary attempting to establish persistence, exfiltrate data, or redirect authentication flows to attacker-controlled infrastructure.
This rule detects successful device registrations to the 'Device Registration Service' in Azure Entra. It specifically looks for sign-in events where the ResourceDisplayName is 'Device Registration Service', the ErrorCode is '0' (indicating success), and the ConditionalAccessStatus is not '1' (which typically means that conditional access did not block the authentication flow for device registration). The rule is pivotal for hunting devices registered for persistence, post-successful phishing campaign execution, where >= 1 accounts were compromised.
This rule detects the creation of a new local user account followed by its addition to the local administrators group within a 10-minute timeframe. It monitors process command lines for 'net.exe' or 'powershell.exe' creating users and then adding them to the 'administrators' group, excluding domain operations.
Detects registry modifications to the SpecialAccounts\UserList key, setting a value to 0 to hide an account from the Windows login screen. This technique is observed in the CTRL framework to conceal backdoor accounts (e.g., Administrator, Admin, Windows).
Detects mass device wipe, retire, or delete operations performed via Microsoft Intune, inspired by the Stryker/Handala attack. This rule combines five detection signals: static velocity threshold, bulk destructive actions from a single operator, first-time operator detection, UEBA anomaly correlation, and ML anomaly detection. Operations are categorized into Tier 1 (critical, zero baseline activity like wipe/retire) and Tier 2 (high, legitimate IT ops activity like device delete, subject to velocity and ML thresholds). Severity escalates based on the number of overlapping signals.
This rule detects several types of suspicious activities related to Microsoft Graph API calls, specifically targeting device management actions. It identifies: 1. Actions from an IP address not previously seen for a given caller identity. 2. Actions performed by a service principal that has not been observed before. 3. High-risk actions (e.g., device wipe, retire, remote lock, reset passcode) or device configuration changes occurring outside of business hours or on weekends. 4. Bulk device targeting, where a single caller identity performs actions on a large number of devices within a short time frame. These detections aim to identify potential compromise of accounts or malicious administrative actions.
This rule detects attempts to manipulate user or service principal names (SPN/UPN) in Active Directory by adding non-ASCII or zero-width characters. Such modifications can be used by adversaries for obfuscation, to bypass detection mechanisms, or to create stealthy persistence. The rule specifically looks for Event IDs 4738 (User Account Changed) and 5136 (Directory Service Object Modified) where the 'servicePrincipalName' or 'userPrincipalName' attributes contain characters outside the standard ASCII range or zero-width characters like U+200B, U+200C, U+200D.
This rule detects changes to a user account's User Account Control (UAC) settings, specifically when the 'NewUacValue' is set to '0x2080'. This value corresponds to the 'ACCOUNTDISABLE' flag, indicating that a user account has been disabled. Monitoring such changes can help identify potential malicious activity where an attacker might disable legitimate user accounts to disrupt operations or hinder incident response.
Detects a single Azure identity accessing three or more distinct Azure resource types within a short time window. This behavior can indicate an attacker attempting to enumerate or pivot through an environment after compromising an identity.
This rule detects the creation of new local user accounts or the addition of existing accounts to the local Administrators group on Windows systems. It specifically looks for Windows Security Event IDs 4720 (A user account was created) and 4732 (A member was added to a security-enabled local group) or 4728 (A member was added to a security-enabled global group) or 4756 (A member was added to a security-enabled universal group), filtering for 'User' account types and ensuring that for Event ID 4732, the group is the 'Administrators' group (identified by SID S-1-5-32-544 or group name). This activity can indicate an adversary establishing persistence or escalating privileges.
This rule identifies the creation or deletion of user accounts in Azure AD (Entra ID) by principals not on an approved list. It relies on a customized list of approved administrators/service principals to reduce false positives.
Rule to detect where there are role bindings and high-risk actions (verbs) applied within production or default namespaces. This rule specifically looks for these high-risk actions (verbs), excluding actions by the 'system:clusterrole-aggregation-controller' user, which is a legitimate system process.
Detects when a new AWS IAM Principal (User, Role, or Group) is created and then has a policy attached to it by the same actor within a 10-minute time frame. This sequence is a suspicious TTP often used by attackers to provision a new, privileged "shadow" account or role for persistence and lateral movement, bypassing existing accounts or role assumption paths.
Detects a suspicious sequence where a new credential (PAT, SSH key, or OAuth authorization) is created and then used to establish durable persistence via webhooks or deploy keys. This behavior typically occurs after an account compromise as an attacker attempts to "lock in" access that survives credential rotation and provides real-time exfiltration of repository data.
Multi-layered detection rule that identifies anomalous behavior on privileged accounts across six independent detection layers: absolute rule violations ("never actions"), self-calibrating ratio-based thresholds, behavioral technique substitution (e.g., WMI drop-off while other lateral movement continues), time-series statistical anomaly detection via series_decompose_anomalies(), reconnaissance burst detection on LDAP/directory queries, and MFA gap analysis. All layers roll up into a composite risk score for analyst prioritization. Originally derived from diffpatterns() analysis of real penetration test data vs. normal operations, this community edition replaces environment-specific hardcoded thresholds with self-calibrating statistical baselines. Requires Microsoft Defender for Identity and Entra ID Sign-in Logs.
Page 25 of 40