Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,123 detections
Filters
Last updated
All Time
Detection languages
1,062
796
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
219
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
3,123
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Identifies when a DNS Zone is modified or deleted in Google Cloud.
Identifies when a application gateway is modified or deleted.
Identifies when a application security group is modified or deleted.
Identifies when a network security configuration is modified or deleted.
Detects when storage bucket is modified or deleted in Google Cloud.
Identifies when sensitive information is re-identified in google Cloud.
Identifies when a VPN Tunnel Modified or Deleted in Google Cloud.
Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.
Detects command line parameters or strings often used by crypto miners
Identifies when an EKS cluster is created or deleted.
Identifies when a key vault is modified or deleted.
Identifies when secrets are modified or deleted in Azure.
Identifies when a Point-to-site VPN is Modified or Deleted.
Identifies when a VPN connection is modified or deleted.
Identifies when a service account is disabled or deleted in Google Cloud.
Identifies when a service account is modified in Google Cloud.
Detects process connections to a Monero crypto mining pool
Detects execution of the "groupdel" binary. Which is used to delete a group. This is sometimes abused by threat actors in order to cover their tracks
Detects events in which a history file gets deleted, e.g. the ~/bash_history to remove traces of malicious activity
Detects execution of the "userdel" binary. Which is used to delete a user account and related files. This is sometimes abused by threat actors in order to cover their tracks
Nginx Core Dump
Sigma
Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts.
Page 128 of 149