Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
503 detections
Filters
Last updated
All Time
Detection languages
406
57
14
12
12
Contributors
387
54
19
13
12
Categories
146
108
66
45
35
Platforms
396
33
19
18
13
Products / Services
205
137
62
40
31
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
2
1
Detect malicious GPO modifications can be used to implement many other malicious behaviors.
Remove the Zone.Identifier alternate data stream which identifies the file as downloaded from the internet.
Detects the restoration of files from the defender quarantine
Detect malicious GPO modifications can be used to implement many other malicious behaviors.
Detects when a rule has been added to the Windows Firewall exception list
Detects attempts to install unsigned MSIX/AppX packages using the -AllowUnsigned parameter via AppXDeployment-Server events
Detects the execution of the Cortex XDR agent administration tool (Cytool) with the 'protect disable' command line argument. This indicates an attempt to manually disable the security agent's protective features on an endpoint, which is a common technique used by adversaries to impair security controls.
Detects completed administrative actions within the Cortex management console that result in a pause of endpoint protection. This action reduces security coverage on the targeted host and requires validation to ensure it aligns with authorized maintenance, troubleshooting, or incident response activities.
Detects the creation of a new Group Policy Object (GPO) in Active Directory by monitoring Windows Security Event ID 5137 where the object class is 'groupPolicyContainer'. While typically an administrative task, the creation of new GPOs can be a precursor to malicious configuration changes or domain persistence via Group Policy modification.
Cortex Agent Exception Rule Created
Cortex XDR
Detects the creation of a new exception rule within the Cortex endpoint agent management configuration. Exception rules can be used to exclude specific files, processes, or behaviors from security prevention policies, potentially leading to a reduction in defensive coverage.
Detects a successful Microsoft Entra audit event where a new partner tenant is added to cross-tenant access settings. This change impacts trust-related configuration and inter-tenant access policies, requiring validation against approved organizational changes.
Detects coordinated activity where a PowerShell process executes multiple distinct administrative utilities (such as wevtutil, vssadmin, wbadmin, or bcdedit) to perform destructive actions like clearing event logs, deleting shadow copies, or disabling system recovery settings. This rule uses correlation to identify sequences of at least three distinct commands and utilities, reducing false positives associated with single administrative tasks.
Detects a Windows Registry modification where the EnableLUA value under HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System is set to 0, which disables the User Account Control (UAC) feature. This modification weakens system security by disabling Admin Approval Mode for administrators.
Detects the deletion of an Active Directory Group Policy Object (GPO) by monitoring Windows Security Event ID 5141 where the deleted object class is 'groupPolicyContainer'. This activity may indicate an attempt to weaken domain security controls or impair defenses.
Detects modifications to Active Directory objects of the class 'groupPolicyContainer' by monitoring Windows Security Event ID 5136. Unauthorized or unexpected GPO modifications can be used by attackers to weaken security controls, establish persistence, or facilitate privilege escalation across a domain.
Imperva Protected Site Removed from WAF
Cortex XDR
Detects an audit event in Imperva Cloud WAF indicating that a protected site configuration has been removed. This action results in the loss of application-protection coverage for the specific site and may indicate unauthorized defensive impairment.
Detects completed administrative actions associated with uninstalling the Cortex XDR endpoint agent. This operation significantly reduces security visibility and defense capabilities on the affected device and requires verification as an authorized action.
Imperva Site WAF Protection Disabled
Cortex XDR
Detects an audit event in Imperva Cloud WAF where a site's protection state is changed to disabled. Disabling WAF protection reduces the security posture of the protected application and may indicate an attempt to impair defensive controls.
A Compute Engine image created from a disk, which can be used to copy VM disk data out of the environment
Detects potentially suspicious loading of the Offline Registry Library (offreg.dll).
Offreg.dll enables direct read/write access to offline registry hives without invoking the Windows Registry API,
bypassing its associated audit logging and telemetry. Attackers may abuse this to stealthily modify registry hives
while evading detection mechanisms that rely on standard registry event logs.
Offreg.dll enables direct read/write access to offline registry hives without invoking the Windows Registry API,
bypassing its associated audit logging and telemetry. Attackers may abuse this to stealthily modify registry hives
while evading detection mechanisms that rely on standard registry event logs.
Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken
model safety controls and allow unsafe or unauthorized model responses.
model safety controls and allow unsafe or unauthorized model responses.
Page 7 of 24