Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,124 detections
Filters
Last updated
All Time
Detection languages
1,063
796
474
242
137
Contributors
463
427
399
318
291
Categories
927
772
637
574
311
Platforms
2,113
365
219
214
142
Products / Services
488
482
389
167
150
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,124
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects when a Google Cloud Storage bucket is modified or deleted. This includes operations such as deleting a bucket, inserting (creating) a bucket, or updating/patching a bucket's properties. Such activities can indicate unauthorized access, data manipulation, or attempts to disrupt services.
Detects the execution of the 'userdel' binary, which is used to delete a user account and associated files. This activity can be abused by threat actors to remove accounts, hindering forensic analysis and covering their tracks.
Identifies when a network security configuration in Azure is modified or deleted. This could indicate an adversary attempting to bypass security controls, establish persistence, or impact the availability of resources.
Identifies when the default Amazon Elastic Block Store (EBS) encryption is disabled in a specific AWS region. Disabling default encryption does not affect existing volumes but means newly created volumes will not be encrypted by default, potentially impacting data confidentiality and integrity.
This rule detects attempts to shut down or reboot a Linux system using common commands like 'shutdown', 'reboot', 'halt', 'poweroff', or by using 'init' or 'telinit' with specific runlevel arguments (0 for halt/shutdown, 6 for reboot). Adversaries may use these methods to disrupt system availability or aid in the destruction of data.
Detects the use of the bcdedit command to tamper with the boot configuration data. This technique is often times used by malware or attackers as a destructive way before launching ransomware. Specifically, it looks for commands that disable boot status policy to ignore all failures and disable recovery enabled.
Detects access to files and shares with specific names and extensions associated with BlueSky ransomware, indicating a potential or active encryption attempt. The rule looks for files ending with '.bluesky' or containing 'DECRYPT FILES BLUESKY' in their names, across both local file access events (EventID 4663, 4656) and network share access events (EventID 5145).
Detects modifications to the Windows Registry that disable the System Restore functionality. This is achieved by setting specific registry values ('DisableConfig' or 'DisableSR') to '1' (DWORD 0x00000001) within the System Restore related registry paths.
This rule identifies when a device or device configuration is modified or deleted within Azure. This activity is logged in Azure Activity Logs and can indicate administrative changes, potential misconfigurations, or malicious activity aimed at impacting the availability or integrity of cloud resources.
Detects when Microsoft Cloud App Security reports that a user has uploaded files to the cloud that are potentially infected with ransomware. This indicates a possible ransomware attack attempting to encrypt or exfiltrate data via cloud storage.
This rule detects when an Nginx worker process crashes and generates a core dump, indicated by the log message 'exited on signal 6 (core dumped)'. This event can signify a serious underlying problem with the Nginx configuration, a plugin, or potentially an exploitation attempt targeting the Nginx server. Core dumps contain the memory state of the process at the time of the crash, which can be valuable for debugging but also sensitive if exposed.
This rule detects attempts to delete Volume Shadow Copies using PowerShell and WMI. Adversaries often delete shadow copies to prevent system recovery and hinder forensic analysis, especially in ransomware attacks. The rule specifically looks for PowerShell commands that interact with 'Win32_ShadowCopy' via 'Get-WmiObject' and then perform a 'Delete()' operation or use 'Remove-WmiObject'.
Detects when multi-factor authentication (MFA) is disabled in Google Workspace. This could indicate an adversary attempting to weaken security controls for persistent access or to facilitate further compromise.
Detects when the 'firmwarepasswd' utility is executed on macOS with commands to set, delete, or check the firmware password. This activity can indicate an attempt to manipulate the system's firmware security settings, potentially for malicious purposes such as preventing unauthorized OS installations or recovery, or to lock out legitimate users. The rule notes that this command is disabled on Apple Silicon-based Macs.
This rule detects the exploitation of a specific NTFS vulnerability that causes file system corruption. The detection is based on Windows System event logs, specifically Event ID 55 from the 'Ntfs' provider, indicating a corrupted file record with the file name being a single backslash.
Identifies when an Azure Application Security Group is modified or deleted. This could indicate an attempt to alter network access controls, potentially to bypass security measures or disrupt services.
Detects when a Google Cloud SQL database instance or its user accounts are created, deleted, or modified. This can indicate malicious activity such as data destruction, unauthorized access attempts, or attempts to disrupt services.
Detects outbound network connections to known cryptocurrency mining pool domains. This activity is often indicative of resource hijacking (cryptojacking) where an attacker uses a compromised system's resources to mine cryptocurrency without the owner's consent. The rule specifically targets a comprehensive list of domains associated with various mining pools, primarily for Monero (XMR) and other cryptocurrencies.
This rule detects instances where Sysmon's FileBlockShredding event (EventID 28) is triggered. This event indicates that a file shredding operation was attempted but blocked due to a configured policy violation. This could be an attempt by an adversary to destroy evidence or render data unrecoverable.
This rule detects when a user or entity makes changes to Amazon S3 bucket data management configurations. This includes modifications to logging, website hosting, encryption, lifecycle policies, replication configurations, and object restoration. Such changes could indicate an attempt to tamper with data integrity, availability, or exfiltration mechanisms within S3.
This rule identifies when an application is deleted in Azure. This could indicate an attempt by an adversary to remove traces of their activity, disrupt services, or impact the availability of applications.
Page 124 of 149