Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
503 detections
Filters
Last updated
All Time
Detection languages
406
57
14
12
12
Contributors
387
54
19
13
12
Categories
146
108
66
45
35
Platforms
396
33
19
18
13
Products / Services
205
137
62
40
31
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
2
1
Detects when a GitHub repository is archived or unarchived, which may indicate unauthorized changes to repository status.
Identifies when Rule Collections (Application, NAT, and Network) is being modified or deleted.
Identifies when a Firewall Policy is Modified or Deleted.
Monitor and alert on conditional access changes where non approved actor removed CA Policy.
Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare "old" vs "new" value.
Monitor and alert for changes to the device registration policy.
Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.
Detects disabling of Multi Factor Authentication.
Detects the addition of a new Federated Domain.
Detects when an attempt at deactivating or resetting MFA.
Detects removing immutable file attribute.
Detect changes of syslog daemons configuration files
Detects the execution of 'auditctl' with the '-D' command line parameter, which deletes all configured audit rules and watches on Linux systems.
This technique is commonly used by attackers to disable audit logging and cover their tracks by removing monitoring capabilities.
Removal of audit rules can significantly impair detection of malicious activities on the affected system.
This technique is commonly used by attackers to disable audit logging and cover their tracks by removing monitoring capabilities.
Removal of audit rules can significantly impair detection of malicious activities on the affected system.
Detects usage of the 'chattr' utility to remove immutable file attribute.
Detects chmod targeting files in sensitive directory paths on Linux systems.
Attackers may use chmod to change permissions of files in these directories to maintain persistence, escalate privileges, or disrupt system operations.
Attackers may use chmod to change permissions of files in these directories to maintain persistence, escalate privileges, or disrupt system operations.
Detects logs clearing attempts on Linux systems via utilities such as 'rm', 'rmdir', 'shred', and 'unlink' targeting log files and directories.
Adversaries often try to clear logs to cover their tracks after performing malicious activities.
Adversaries often try to clear logs to cover their tracks after performing malicious activities.
Detects specific commands commonly used to remove or empty the syslog. Which is a technique often used by attacker as a method to hide their tracks
Detects installation of suspicious packages using system installation utilities
Detect use of iptables to flush all firewall rules, tables and chains and allow all network traffic
Detects disabling security tools
Detects when the macOS Script Editor utility spawns an unusual child process.
Page 20 of 24