Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,124 detections
Filters
Last updated
All Time
Detection languages
1,063
796
474
242
137
Contributors
463
427
399
318
291
Categories
927
772
637
574
311
Platforms
2,113
365
219
214
142
Products / Services
488
482
389
167
150
MITRE Techniques
18,123
15,646
12,594
8,402
6,230
3,124
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Delete Entra ID application. This is a soft delete, can still be recovered.
Deletion of Entra ID application with no recovery of the application.
Detects when a group is deleted.
Detects when a group is deleted.
Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.
Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.
This rule detects when multiple HMAC (Hash-based Message Authentication Code) authentication keys are deleted from Google Cloud Storage settings within a one-hour window by the same user. HMAC keys are used for programmatic access to Cloud Storage, and their deletion can indicate an attempt to disrupt legitimate access, cover tracks, or impact service availability.
Detects when a user deletes multiple secrets or secret versions from Google Cloud Platform (GCP) Secret Manager within a one-hour period. This activity could indicate an attempt to destroy critical data or disrupt services.
This rule detects when an OpenCanary honeypot's NTP service receives a 'monlist' request. The 'monlist' command is a deprecated feature in NTP that can be abused for amplification attacks (Network Denial of Service). Detecting this activity on a honeypot indicates an adversary is likely scanning for vulnerable NTP servers or attempting to use the honeypot in an amplification attack.
This rule detects when a single user disables or destroys 10 or more Google Cloud KMS (Key Management Service) crypto key versions within a one-hour period. This activity could indicate an attacker attempting to destroy data encrypted by these keys, leading to data unavailability or integrity issues. The rule specifically looks for 'DestroyCryptoKeyVersion' events or 'UpdateCryptoKeyVersion' events where the key version state is changed to 'DISABLED'.
This rule detects when a single user disables multiple Google Cloud Platform (GCP) Service APIs within a short period (1 hour). Specifically, it triggers if a user performs more than 5 'DisableService' actions on 'serviceusage.googleapis.com' within an hour. This activity could indicate an attempt to disrupt cloud services or evade detection by disabling security-related APIs.
Identifies when a user deletes multiple files from Google Drive within a one-hour period. This activity may indicate an attempt at data destruction or an insider threat activity.
Detects when an AWS Backup Plan or Backup Selection is deleted. This activity can indicate an adversary attempting to inhibit system recovery by removing backup configurations, potentially as a precursor to data destruction or encryption for impact.
This rule detects cryptocurrency mining activity within Amazon EC2, AWS Lambda, or Amazon EKS Runtimes, as reported by AWS GuardDuty. It specifically looks for GuardDuty findings related to 'CryptoCurrency', 'CryptoMinerExecuted', or 'BitcoinDomainRequest' and filters out sample findings.
Detects when an AWS Key Management Service (KMS) key is disabled or scheduled for deletion. This activity can indicate an attempt to disrupt services, destroy data, or hinder forensic analysis by making encrypted data inaccessible.
This rule detects Denial of Service (DoS) activity originating from an Amazon EC2 instance, as identified by AWS GuardDuty. It specifically looks for GuardDuty findings where the product event type indicates a DenialOfService event and filters out any sample findings.
Detects when an Amazon Simple Email Service (SES) configuration is modified, which could indicate an attacker attempting to propagate phishing email campaigns. This includes the creation, deletion, or verification of email identities and domains, as well as enabling sending for accounts or configuration sets.
Detects command line patterns used by BlackByte ransomware in different operations, including execution from the Public user directory, attempts to delete Task Manager, disable services, and use obfuscated PowerShell commands.
Detect when multiple HMAC authentication keys are deleted from GCP Storage settings.
Identifies when a user deletes multiple files from Google Drive, which may indicate data destruction.
Detects instances where an NTP service on an OpenCanary node has had a NTP monlist request.
Page 121 of 149