Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
141 detections
Filters
Last updated
All Time
Detection languages
83
36
9
6
3
Contributors
40
27
26
15
5
Categories
111
92
23
16
13
Platforms
74
46
16
16
9
Products / Services
64
64
34
29
12
MITRE Techniques
18,116
15,638
12,586
8,396
6,226
IDS Classtypes
1
IDS Protocols
1
Detects unauthorized or suspicious use of USSD codes by the corporate MDM agent to modify call-forwarding settings. This activity is indicative of a compromise where an attacker uses an MDM-controlled device to intercept calls or divert communications.
Detects unauthorized or suspicious use of USSD codes by the corporate MDM agent to modify call-forwarding settings. This activity is indicative of a compromise where an attacker uses an MDM-controlled device to intercept calls or divert communications.
Detects unauthorized or suspicious use of USSD codes by the corporate MDM agent to modify call-forwarding settings. This activity is indicative of a compromise where an attacker uses an MDM-controlled device to intercept calls or divert communications.
This rule detects modifications to Group Policy Objects (GPOs) that are either explicitly marked as malicious based on known indicators (GUIDs or 'PAYLOAD' strings) or involve unauthorized modifications to domain-root or organizational unit GPO links. It monitors Active Directory security event logs for object changes.
Detects unauthorized creation, modification, or deletion of Group Policy Objects (GPOs) at the Active Directory domain root. This activity is a high-confidence indicator of potential persistence or domain-wide configuration tampering, often observed during ransomware attacks or privilege escalation attempts where attackers weaponize Group Policy.
This rule monitors for a variety of indicators associated with malicious activity, including connections to known malicious IP addresses, the presence of specific malicious file hashes or filenames, modifications to Windows system policies (specifically Legal Notice configuration), and changes to Active Directory Group Policy Objects using specified GUIDs.
Detects unauthorized or suspicious use of USSD codes by the corporate MDM agent to modify call-forwarding settings. This activity is indicative of a compromise where an attacker uses an MDM-controlled device to intercept calls or divert communications.
This rule detects modifications to the security descriptors (ACLs) of sensitive Active Directory objects, specifically targeting additions of powerful rights like GenericAll, GenericWrite, WriteDacl, or ForceChangePassword. Monitoring these changes on privileged objects such as Domain Admins, Enterprise Admins, and Domain Controllers is critical for detecting potential privilege escalation or persistence efforts.
This rule monitors for a variety of indicators associated with malicious activity, including connections to known malicious IP addresses, the presence of specific malicious file hashes or filenames, modifications to Windows system policies (specifically Legal Notice configuration), and changes to Active Directory Group Policy Objects using specified GUIDs.
This rule detects modifications to the security descriptors (ACLs) of sensitive Active Directory objects, specifically targeting additions of powerful rights like GenericAll, GenericWrite, WriteDacl, or ForceChangePassword. Monitoring these changes on privileged objects such as Domain Admins, Enterprise Admins, and Domain Controllers is critical for detecting potential privilege escalation or persistence efforts.
Detects protected-branch configuration changes on the gnutls_3_7_x release branch that weaken push/merge controls (developers_can_push/merge enabled), reducing supply-chain code-review protections.
This rule detects modifications to the security descriptors (ACLs) of sensitive Active Directory objects, specifically targeting additions of powerful rights like GenericAll, GenericWrite, WriteDacl, or ForceChangePassword. Monitoring these changes on privileged objects such as Domain Admins, Enterprise Admins, and Domain Controllers is critical for detecting potential privilege escalation or persistence efforts.
This rule detects administrative changes to domain federation settings or domain authentication configurations within an Azure Active Directory (Microsoft Entra ID) environment. These modifications can be used to establish persistence or facilitate identity-based attacks, such as domain-wide impersonation, by altering how identities are authenticated.
Detects protected-branch configuration changes on the gnutls_3_7_x release branch that weaken push/merge controls (developers_can_push/merge enabled), reducing supply-chain code-review protections.
This rule detects modifications to the security descriptors (ACLs) of sensitive Active Directory objects, specifically targeting additions of powerful rights like GenericAll, GenericWrite, WriteDacl, or ForceChangePassword. Monitoring these changes on privileged objects such as Domain Admins, Enterprise Admins, and Domain Controllers is critical for detecting potential privilege escalation or persistence efforts.
Detects protected-branch configuration changes on the gnutls_3_7_x release branch that weaken push/merge controls (developers_can_push/merge enabled), reducing supply-chain code-review protections.
Detects protected-branch configuration changes on the gnutls_3_7_x release branch that weaken push/merge controls (developers_can_push/merge enabled), reducing supply-chain code-review protections.
Detects protected-branch configuration changes on the gnutls_3_7_x release branch that weaken push/merge controls (developers_can_push/merge enabled), reducing supply-chain code-review protections.
AWS Route 53 DNS Record Modification
Cortex XDR
Detects modifications to AWS Route 53 DNS resource record sets. Monitoring these changes is critical for identifying potential DNS hijacking, traffic redirection, or unauthorized infrastructure configuration changes within the AWS environment.
Detects the creation of a new Group Policy Object (GPO) in Active Directory by monitoring Windows Security Event ID 5137 where the object class is 'groupPolicyContainer'. While typically an administrative task, the creation of new GPOs can be a precursor to malicious configuration changes or domain persistence via Group Policy modification.
Detects a successful Microsoft Entra audit event where a new partner tenant is added to cross-tenant access settings. This change impacts trust-related configuration and inter-tenant access policies, requiring validation against approved organizational changes.
Page 3 of 7