Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,936
7,266
6,537
3,866
3,647
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects when a user creates action secret for the organization, environment, codespaces or repository.
Detects delete action in the Github audit logs for codespaces, environment, project and repo.
Detects when an the Administrator role is assigned to an user or group.
Detects when an application is modified or deleted.
Detects when Okta FastPass prevents a known phishing site.
Detects when a new identity provider is created for Okta.
Detects when an Okta policy is modified or deleted.
Detects when an Policy Rule is Modified or Deleted.
Detects when unauthorized access to app occurs.
Detects when an user account is locked out.
sap impossible travel
YARA-L
Identifies two successful logons for the same User ID from two different geographic locations in a timeframe that is physically impossible to travel between, indicating credential sharing or theft.
Detects user authentication failure events.
Please note that this rule can be noisy and it is recommended to use with correlation based on "author.name" field.
Please note that this rule can be noisy and it is recommended to use with correlation based on "author.name" field.
Detects when a GitHub repository is archived or unarchived, which may indicate unauthorized changes to repository status.
A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com.
This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected,
it should be validated from GitHub UI because the log entry may not provide full context.
This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected,
it should be validated from GitHub UI because the log entry may not provide full context.
Detects when changes are made to the SSH certificate configuration of the organization.
Detects when a successful MFA authentication occurs due to the use of a bypass code.
A bypass code is a temporary passcode created by an administrator for a specific user to access a Duo-protected application. These are generally used as "backup codes," so that enrolled users who are having problems with their mobile devices (e.g., mobile service is disrupted, the device is lost or stolen, etc.) or who temporarily can't use their enrolled devices (on a plane without mobile data services) can still access their Duo-protected systems.
A bypass code is a temporary passcode created by an administrator for a specific user to access a Duo-protected application. These are generally used as "backup codes," so that enrolled users who are having problems with their mobile devices (e.g., mobile service is disrupted, the device is lost or stolen, etc.) or who temporarily can't use their enrolled devices (on a plane without mobile data services) can still access their Duo-protected systems.
Detects when an attempt at deactivating or resetting MFA.
Detects when a new admin role assignment is created. Which could be a sign of privilege escalation or persistence
Detects when a API token is created
Detects when a API Token is revoked.
Detects when an application Sign-on Policy is modified or deleted.
Page 119 of 142