Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
839 detections
Filters
Last updated
All Time
Detection languages
438
190
77
62
40
Contributors
120
114
72
71
68
Categories
464
233
193
152
122
Platforms
288
274
154
88
56
Products / Services
220
169
162
90
76
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
839
CVEs
6
5
5
5
5
IDS Classtypes
4
2
IDS Protocols
1
Identify cases where privileged tokens appear in unexpected contexts (e.g., admin accounts logging into low-tier devices, unusual logon types, or rare hosts).
Detects modifications or additions to Conditional Access policies or External Authentication Methods in Azure AD/Entra ID. These changes could be indicative of an adversary attempting to bypass multi-factor authentication or establish persistence by weakening authentication controls.
Detects changes to the Access Control List (ACL) of the AdminSDHolder object in Active Directory. AdminSDHolder is a protected object whose ACL is automatically propagated by the SDProp process every 60 minutes to all privileged groups and accounts in the domain. Modifying the ACL on this object allows an adversary to establish a durable, self-healing backdoor by granting persistent access to high-privileged security principals.
Detects changes to the Access Control List (ACL) of the AdminSDHolder object in Active Directory. AdminSDHolder is a protected object whose ACL is automatically propagated by the SDProp process every 60 minutes to all privileged groups and accounts in the domain. Modifying the ACL on this object allows an adversary to establish a durable, self-healing backdoor by granting persistent access to high-privileged security principals.
Detects scenarios where a user registers a new WebAuthn/Passkey credential and subsequently performs a sign-in from a different network or device shortly after, preceded by a sign-in from a risky or non-passkey-based method. This pattern is often associated with credential abuse or MFA registration hijacking.
Detects modifications to Microsoft Entra ID (formerly Azure AD) authentication methods policy where a new external authentication method is configured using a non-approved discovery URL. This could indicate an adversary attempting to configure a malicious identity provider to facilitate authentication bypass or unauthorized access.
Detects unauthorized modifications to SSH authorized_keys files. Attackers often modify these files to inject their own public keys, ensuring persistent access to a compromised Linux host. This rule excludes known configuration management and provisioning tools to reduce noise.
Detects modifications to Microsoft Entra ID (formerly Azure AD) authentication policies, specifically the registration, enablement, or modification of External Authentication Methods (EAMs). This activity can indicate an attempt to add a rogue authentication provider for persistent unauthorized access, bypassing standard MFA or conditional access policies.
Detects anomalous account recovery or MFA reset activity performed by a single help-desk user account. A high volume of reset actions across numerous distinct users within a short duration is a key behavioral indicator of potential help-desk account compromise or insider abuse involving unauthorized account takeovers.
Detects high-privilege IAM roles (roles/owner, roles/resourcemanager.organizationAdmin) being granted at the GCP organization level. This activity is indicative of the ConfigConfusion attack, where a low-privilege user exploits a Kubernetes ConfigConnector (KCC) controller's high-privilege service account to perform unauthorized IAM modifications.
This rule detects potentially suspicious activity within a Git repository environment, specifically monitoring for code pushes, administrative changes (such as added collaborators, permission changes, or ownership transfers), and force push operations. It identifies high-impact repository modifications that could indicate unauthorized access, persistence, or attempts to disrupt repository integrity.
Detects anomalous account recovery or MFA reset activity performed by a single help-desk user account. A high volume of reset actions across numerous distinct users within a short duration is a key behavioral indicator of potential help-desk account compromise or insider abuse involving unauthorized account takeovers.
If your environment does not normally use smart cards or certificate-based authentication, or if a user who does not typically authenticate using smart cards suddenly generates events with TokenHasThisOrgCertificateSid, this may warrant investigation, as it could indicate authentication using a fraudulently issued certificate.
Detects unauthorized or suspicious use of Google Cloud Config Connector (KCC) service accounts to apply high-privilege IAM roles ('roles/owner' or 'roles/resourcemanager.organizationAdmin') at the Organization or Folder scope. This rule monitors for 'SetIamPolicy' API calls where the principal is identified as a KCC-related service account, flagging potential exploitation of KCC's authority to grant excessive permissions.
Detects a potential privilege escalation attempt where a namespace-scoped user creates a Config Connector (KCC) IAMPolicyMember resource, which is immediately followed by a high-privilege organization or folder-level SetIamPolicy operation executed by the KCC system service account, suggesting the KCC controller was manipulated to perform actions beyond the namespace's intended authorization.
Detects modifications to Microsoft Entra authentication policy or external authentication method configurations, which may indicate an adversary attempting to establish a 'TrustSink' or alternate authentication persistence mechanism by registering a malicious OIDC provider or modifying authentication policy.
Detects modifications to payroll direct deposit or payment election settings within Workday. This activity is a common indicator of payroll fraud or Business Email Compromise (BEC), where an attacker gains access to an employee's Workday account to redirect salary payments to an unauthorized bank account.
Detects high-velocity administrative activity performed by a single user account in Azure Active Directory, specifically focusing on account provisioning and role membership changes. The rule flags patterns such as password resets, enabling/disabling accounts, adding new users, and privilege escalation (e.g., granting Global Administrator roles), which are indicative of malicious post-compromise activity.
Detects changes to the Access Control List (ACL) of the AdminSDHolder object in Active Directory. AdminSDHolder is a protected object whose ACL is automatically propagated by the SDProp process every 60 minutes to all privileged groups and accounts in the domain. Modifying the ACL on this object allows an adversary to establish a durable, self-healing backdoor by granting persistent access to high-privileged security principals.
Detects scenarios where a user registers a new WebAuthn/Passkey credential and subsequently performs a sign-in from a different network or device shortly after, preceded by a sign-in from a risky or non-passkey-based method. This pattern is often associated with credential abuse or MFA registration hijacking.
Detects scenarios where a user registers a new WebAuthn/Passkey credential and subsequently performs a sign-in from a different network or device shortly after, preceded by a sign-in from a risky or non-passkey-based method. This pattern is often associated with credential abuse or MFA registration hijacking.
Page 6 of 40