Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,124 detections
Filters
Last updated
All Time
Detection languages
1,063
796
474
242
137
Contributors
463
427
399
318
291
Categories
927
772
637
574
311
Platforms
2,113
365
219
214
142
Products / Services
488
482
389
167
150
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,124
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Identifies when a Kubernetes account accesses sensitive objects such as ConfigMaps or Secrets within Azure Kubernetes Service. This rule specifically looks for write or delete operations on these objects, which could indicate unauthorized access or malicious activity.
Detects a highly relevant Antivirus alert that reports ransomware. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place. The rule specifically looks for signatures containing common ransomware family names and keywords.
Identifies when a service account in Azure Kubernetes Service is modified or deleted. This could indicate an adversary attempting to disrupt services, remove access, or manipulate accounts for persistence or privilege escalation within the Kubernetes cluster.
This rule identifies when an Azure Kubernetes network policy is modified or deleted. Network policies control the traffic flow between pods/namespaces and to/from external network endpoints. Unauthorized modification or deletion of these policies can lead to security vulnerabilities, such as allowing unauthorized network access to sensitive services or disrupting legitimate communication within the cluster, potentially leading to a denial of service or data exfiltration.
Detects the launch of specific utilities (like ntdsutil, vssadmin, diskshadow, esentutl) on key servers. These utilities can be used by adversaries to access or copy the Active Directory domain database (NTDS.dit) or inhibit system recovery, which are common techniques for credential dumping and persistence.
Detects the removal of a deployment from a Kubernetes cluster. This could indicate disruptive activity aiming to impact business operations.
Detects when an Azure Kubernetes Cluster is created or deleted. This activity can indicate significant infrastructure changes, either legitimate or malicious. Monitoring these operations is crucial for maintaining the security and integrity of containerized environments.
Detects suspicious log entries in Linux log files
Detects the execution of 'gpg.exe' or 'gpg2.exe' from uncommon locations. This activity is often associated with ransomware and loaders that use GnuPG for encrypting or decrypting data.
Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes, or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.
Detects the invocation of MS SQL transactions that are destructive towards table or database data, such as "DROP TABLE" or "DROP DATABASE".
Yara rule that detects VanHelsing ransomware.
Identifies when a Azure Kubernetes network policy is modified or deleted.
Detects suspicious log entries in Linux log files
Detects the execution of the "esxcli" command with the "vm" and "kill" flags, indicating an attempt to terminate or shut down a specific virtual machine on an ESXi hypervisor. This activity can be indicative of malicious actions such as ransomware attacks targeting virtualized environments.
Detects suspicious SQL query keywords that are often used during reconnaissance, data exfiltration, or destructive activities. This includes keywords like 'drop', 'truncate', 'dump', and 'select *', which can indicate attempts to manipulate database structures, extract sensitive information, or perform denial-of-service attacks.
Detects the removal of a deployment from a Kubernetes cluster.
This could indicate disruptive activity aiming to impact business operations.
This could indicate disruptive activity aiming to impact business operations.
Detects when a Container Registry is created or deleted.
Detects when a Azure Kubernetes Cluster is created or deleted.
Identifies when ClusterRoles/Roles are being modified or deleted.
Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.
Page 114 of 149