Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,259 detections
Filters
Last updated
All Time
Detection languages
1,550
1,190
352
288
225
Contributors
792
520
494
354
298
Categories
1,717
1,495
401
382
376
Platforms
3,058
530
334
314
258
Products / Services
778
656
633
283
238
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
4,259
CVEs
6
6
6
5
5
IDS Classtypes
75
63
37
23
9
IDS Protocols
127
66
6
4
4
This rule detects when an SNMP OID request is made to an OpenCanary honeypot's SNMP service. This indicates an adversary is likely performing reconnaissance to gather information about the network or devices, potentially looking for vulnerabilities or sensitive data.
This rule detects when a single user generates an excessive number of 'Permission Denied' events within a one-hour timeframe in Google Cloud Platform (GCP). Specifically, it looks for more than 5 'BLOCK' actions with a severity of 'ERROR' and a status code of '7' (which typically indicates 'Permission Denied' in GCP API errors) from a single user. Additionally, it requires these events to span across more than one target application and more than one product event type, which helps to reduce false positives by indicating broader activity rather than a single, isolated error.
Detects the creation of new files with the ".evtx" extension in non-common or non-standard locations. This could indicate tampering with default EVTX locations to evade security controls or exfiltration of event logs to search for sensitive information. Note that backup software and legitimate administrators might perform similar actions during troubleshooting.
This rule detects when an Entra ID application has a significant increase in the number of assigned permissions within a short timeframe (5 minutes). This could indicate a "greedy permission grab" by an attacker attempting to escalate privileges or gain broader access to resources. The rule specifically looks for an increase of more than 8 permissions compared to the previous state. It does not compare the specific permissions, only the count.
This rule detects an excessive number of 'AccessDenied' events within a one-hour timeframe originating from a single AWS IAM user. This behavior can indicate an adversary attempting to discover cloud infrastructure and resources by making numerous API calls that they do not have permissions for. The rule specifically looks for more than 5 'AccessDenied' events, involving more than one target application and more than one product event type, from the same user within an hour.
This rule detects an excessive number of successful AWS API calls related to discovery activities (e.g., Describe*, List*, Get*) originating from a single IAM user within a 5-minute timeframe. This behavior can indicate an adversary attempting to map out the cloud environment after gaining initial access.
Detects when an existing password policy is updated or deleted in an AWS account. This could indicate an adversary attempting to weaken password requirements to facilitate brute-force attacks or to remove obstacles for credential reuse.
This rule detects when an EC2 instance makes a high number of API calls within a 5-minute window. The rule specifically looks for API calls originating from an assumed role associated with an EC2 instance, identified by a user ID matching the pattern `/i-.*$/`. A high number is defined as more than 7 distinct product event types within the specified timeframe. This behavior can indicate reconnaissance or other malicious activity from a compromised instance.
This rule detects the creation of new applications within Microsoft Entra ID (formerly Azure AD). While application creation is a legitimate administrative activity, it does not occur frequently. Monitoring this event can help identify unauthorized or suspicious application registrations that could be used for persistence, privilege escalation, or other malicious activities within the cloud environment.
This rule detects when a permission on a pre-defined watchlist is applied to an Entra ID application. It specifically looks for 'Update application.' events in Office 365 logs where the 'NewValue_EntitlementId-' or 'OldValue_EntitlementId-' labels indicate a change in application permissions. The rule leverages a watchlist named 'msgraph_watchlist_permissions' to identify sensitive or suspicious permission changes.
Detects when an excessive number of permissions are assigned to an Entra ID application within a short time window, calculated as a percentage increase from existing permissions. This could indicate a "greedy permission grab" by an attacker attempting to escalate privileges or gain broader access within the Entra ID environment. The rule specifically looks for updates to application permissions where the percentage increase of new permissions over old permissions exceeds a 70% threshold.
Detects excessive PermissionDenied events within an hour timeframe from a user
Detects instances where an SNMP service on an OpenCanary node has had an OID request.
Detects external IP address lookups by non-browser processes via services such as "api.ipify.org". This could be indicative of potential post compromise internet test activity.
Detects excessive AccessDenied events within an hour timeframe from an IAM User
Detect when an EC2 instance makes high number of API calls.
Detects excessive successful events within a 5 minute timeframe from an IAM User.
Detects when an existing password policy is updated or deleted in an AWS account.
Detects enumeration of local system accounts on Linux. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior. The rule identifies common commands and file accesses used for this purpose, such as 'lastlog', 'id', 'lsof -u', and utilities like 'cat', 'head', 'tail' accessing '/etc/passwd', '/etc/shadow', or '/etc/sudoers'.
This rule detects the execution of common Linux utilities used for process discovery. Adversaries often use these commands (atop, htop, pgrep, ps, pstree, top) to gather information about running processes on a system, which helps them understand the environment and plan subsequent actions. This information can reveal common software or applications running on systems within the network.
Detects attempts to query the contents of the event log using command line utilities such as `wevtutil.exe`, `wmic.exe`, and PowerShell cmdlets like `Get-WinEvent` or `Get-EventLog`. Attackers use this technique to find sensitive information in logs, such as credentials, usernames, or IP addresses.
Page 181 of 203