Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,397 detections
Filters
Last updated
All Time
Detection languages
3,122
2,721
773
497
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,691
1,318
905
813
745
Platforms
5,923
913
884
299
280
Products / Services
1,616
1,400
1,084
454
419
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This rule detects modifications to the user data script of an EC2 instance in AWS. User data scripts are executed when an EC2 instance is launched and can be used to perform initial setup, install software, or run other commands. An adversary modifying this script could achieve persistence or privilege escalation by injecting malicious commands that run upon the next instance boot.
ServiceDLL Hijack
Sigma
Detects changes to the "ServiceDLL" value related to a service in the registry. This is often used as a method of persistence by adversaries to execute malicious payloads as part of persistence or privilege escalation. The rule specifically looks for modifications to the ServiceDll registry key within the Windows Services hive, while filtering out common legitimate modifications related to printing, domain controllers, and system updates.
This rule identifies when a user account is unsuspended within Google Workspace. Unsuspending an account can be a legitimate administrative action, but it can also indicate an adversary reactivating a previously disabled account to regain access or enable further malicious activity. Monitoring this activity is crucial for detecting potential account takeover or persistence mechanisms.
This rule detects when a Google Cloud Workload Identity Pool is either disabled or deleted. Workload Identity Pools are used to manage external identities (e.g., from AWS, Azure, or on-premises identity providers) that need to access Google Cloud resources. Disabling or deleting a Workload Identity Pool will immediately revoke access for all federated identities associated with that pool, potentially leading to a denial of service for legitimate users or indicating an attempt by an attacker to disrupt operations or remove traces of their access. The rule specifically looks for the 'google.iam.v1.WorkloadIdentityPools.DeleteWorkloadIdentityPool' event or an 'google.iam.v1.WorkloadIdentityPools.UpdateWorkloadIdentityPool' event where the 'req_identityPool_disabled' attribute is set to 'true'.
This rule detects when a new service account key is either created within a monitored Google Cloud project or uploaded to it. This activity is significant because service account keys grant programmatic access to Google Cloud resources and can be used for persistence by adversaries if compromised or maliciously created.
Detects AWS IAM activities originating from an EC2 instance that could be used to retain access or escalate privileges. This includes actions like creating users, attaching policies, creating/updating login profiles, creating access keys, creating groups, and creating roles.
This rule detects a specific privilege escalation scenario in AWS where a user creates a new access key for another user and then immediately uses that newly created access key from the same IP address to perform further actions. This behavior indicates an attempt to escalate privileges by leveraging a newly generated credential.
Identifies when an administrator role is assigned to a user account in Google Workspace. Security teams can monitor for the malicious or accidental assignment of administrator privileges to prevent unauthorized access to data. The rule specifically looks for `USER_RESOURCE_UPDATE_PERMISSIONS` events with `ASSIGN_ROLE` as the product event type and `DELEGATED_ADMIN_SETTINGS` in the security result category details. It also calculates a higher risk score if the assigned role is `_SEED_ADMIN_ROLE`.
This rule detects AWS IAM activities associated with the S3 Browser utility. Specifically, it looks for attempts to create new users (`CreateUser`), create login profiles (`CreateLoginProfile`), create access keys (`CreateAccessKey`), or put user policies (`PutUserPolicy`) within AWS IAM. The detection is triggered when these actions are performed and the HTTP user agent string in the CloudTrail log indicates the use of 'S3 Browser'. This combination of actions and user agent suggests potential account manipulation for persistence or privilege escalation within an AWS environment.
This rule detects the creation, modification, copying, or moving of Windows shortcut (.lnk) files into sensitive user directories such as Desktop, Documents, and Start Menu folders. Adversaries often use .lnk files for persistence, execution, or to deliver malicious payloads, especially when placed in locations that are frequently accessed or automatically executed by the system or user.
Detects the creation or update of a scheduled task to run with "NT AUTHORITY\SYSTEM" privileges
This rule detects successful API executions within Google Cloud Platform (GCP) that originate from an IP address identified as a Tor exit node. It correlates GCP Cloud Audit logs, specifically looking for 'ALLOW' actions, with a GCTI (Google Cloud Threat Intelligence) feed that lists known Tor exit node IP addresses. The rule also calculates a risk score, with additional weight given if the originating IP is from certain high-risk countries (Cuba, Iran, North Korea, Russia, Syria).
This rule detects when an Okta end-user reports suspicious activity on their account. This could indicate that the user's account has been compromised or is being targeted by an attacker. The rule specifically looks for the 'user.account.report_suspicious_activity_by_enduser' event type in Okta logs. The risk score is increased if the suspicious activity event type is related to an MFA enrollment notification being sent, suggesting a potential attempt to enroll an unauthorized MFA device.
Detects when a single user successfully logs into Okta from multiple distinct cities within a 24-hour period. This behavior can indicate a compromised account being used by an attacker from a different geographical location than the legitimate user, or a user traveling rapidly between distant locations. The rule also incorporates risk scoring based on Okta ThreatInsight and logins from suspicious countries.
This rule detects multiple failed login attempts from different users originating from the same IP address within a one-hour window in OneLogin. It specifically looks for 'USER_LOGIN' events with a 'BLOCK' security result and a product event type of '6' (user failed authentication). The rule also calculates a risk score, which is increased if the originating IP address is from certain unauthorized geographies (Cuba, Iran, North Korea, Russia, Syria). This behavior is indicative of potential brute-force attacks or credential stuffing attempts against multiple user accounts from a single source.
This rule detects administrative actions related to AWS SAML Identity Providers. Specifically, it triggers when a SAML provider is created, updated, or deleted within an AWS environment. Monitoring these events is crucial as SAML providers are used for federated access, and unauthorized changes could indicate attempts at persistence, privilege escalation, or defense evasion by manipulating authentication mechanisms.
This rule detects the creation of a new API token within the Okta identity platform. API tokens can be used for programmatic access to Okta and, if compromised, can lead to unauthorized access, persistence, or privilege escalation. The rule specifically looks for 'system.api_token.create' events with a successful 'ALLOW' action.
This rule detects when the AWS IAM AdministratorAccess policy is attached to a user, group, or role. This action grants full administrative privileges and can be used by an attacker for privilege escalation, persistence, or to establish initial access within an AWS environment. The rule specifically looks for CloudTrail events indicating policy attachment actions (AttachUserPolicy, AttachGroupPolicy, AttachRolePolicy) where the target resource is the predefined 'AdministratorAccess' policy and the action was allowed.
This rule detects when a user is assigned 'Super user' privileges within the OneLogin SSO system. It specifically looks for events where the event type is 'USER_CHANGE_PERMISSIONS', the product is 'ONELOGIN_SSO', the vendor is 'ONELOGIN', the product event type indicates a permission grant (code 72), and the target resource name is 'Super user'. This indicates a significant privilege escalation within the identity provider.
This rule detects successful user authentications to Okta that occur outside of typical business hours or on weekends. It specifically flags logins on Saturdays and Sundays, and logins between 8 PM and 7 AM UTC on weekdays. The rule calculates a risk score based on the day and time of the login, with higher scores for weekend logins and late-night/early-morning logins.
This rule detects the creation, modification, or deletion of scheduled tasks using specific task names known to be associated with the SVR-attributed GraphicalProton backdoor. The task names are designed to mimic legitimate Windows services to evade detection.
Page 381 of 400