Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,932
7,263
6,535
3,865
3,643
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
This rule detects failed user login attempts within Bitbucket. It specifically looks for audit events categorized as 'Authentication' with the action 'User login failed'. This type of event can indicate various activities, including legitimate users mistyping passwords, or malicious actors attempting to brute-force credentials or perform credential stuffing attacks against Bitbucket accounts.
This rule detects when Okta identifies new or unusual activity within the Admin Console. It specifically looks for 'policy.evaluate_sign_on' events targeting the 'Okta Admin Console' where Okta's internal heuristics (debugcontext.debugdata.behaviors or debugcontext.debugdata.logonlysecuritydata) flag the activity as 'POSITIVE' for unusual behavior. This can indicate an adversary attempting to gain or maintain access to administrative functions, or an administrator performing actions that are outside their typical patterns.
This rule detects when Okta FastPass successfully identifies and prevents an authentication attempt originating from a known phishing site. It specifically looks for Okta System Log events where the outcome reason is 'FastPass declined phishing attempt', the outcome result is 'FAILURE', and the event type is 'user.authentication.auth_via_mfa'. This indicates that a user attempted to authenticate via MFA, but Okta FastPass intervened due to a detected phishing attempt.
Detects when a global secret scanning rule is deleted in Bitbucket. This activity could indicate an adversary attempting to disable security controls to prevent detection of sensitive information exposure.
Detects when a secret scanning allowlist rule is added for projects in Bitbucket. This could indicate an attempt to bypass security controls by allowing certain secrets to be ignored by the scanning mechanism.
This rule detects when a secret scanning rule is deleted within Bitbucket for either a project or a repository. This action could indicate an attempt to bypass security controls by disabling mechanisms designed to detect sensitive information in code.
Detects when a GitHub repository or an organization is transferred to another location. This activity can indicate an attempt to exfiltrate sensitive data, establish persistence in a new location, or disrupt operations by moving critical assets. The rule specifically monitors GitHub audit logs for actions such as 'migration.create' (creation of a migration file for data transfer), 'org.transfer_outgoing' or 'org.transfer' (transfer of an organization between enterprise accounts), and 'repo.transfer_outgoing' (transfer of a repository to another network).
This rule detects when an application within the Okta environment is either modified or deleted. This activity can indicate administrative changes, potential misconfigurations, or malicious activity aimed at disrupting services or altering access controls.
Detects when the secret scanning feature is disabled for a GitHub enterprise or repository. This action can indicate an attempt to evade security monitoring and hide the introduction of sensitive information into codebases.
Detects when a new identity provider is created in Okta. This activity can be a legitimate administrative action but could also indicate an attacker attempting to establish persistence or bypass authentication mechanisms by creating a rogue identity provider.
Detects attempts to export user permission data from Bitbucket, which could indicate reconnaissance or data collection activities by an adversary.
Detects when a user in OneLogin assumes the identity of another user account. This could indicate an attacker using compromised credentials to impersonate another user or an insider abusing privileges.
This rule detects attempts by an unauthorized user to trigger a full data export from Bitbucket. This activity could indicate an adversary attempting to collect sensitive information, such as source code or credentials, from the code repository.
This rule detects attempts to export user details from Bitbucket, including successful exports, failed attempts, and the initiation of such exports. This activity could indicate an adversary attempting to collect sensitive user information for further reconnaissance or data exfiltration.
This rule detects when a Multi-Factor Authentication (MFA) factor is deactivated or all MFA factors are reset for a user within Okta. This activity can indicate an adversary attempting to bypass or disable MFA to gain persistent access to an account.
Detects when an Okta Network Zone is deactivated or deleted. This activity can indicate an attempt to bypass network-based security controls, potentially allowing unauthorized access from untrusted IP ranges or locations. It could be a precursor to other malicious activities or an attempt to hinder forensic investigation.
Detects when a user attempts to access an application in Okta without proper authorization. This could indicate an attacker trying to gain unauthorized access to resources or a legitimate user attempting to access an application they do not have permissions for.
Detects when an Okta user session starts from an IP address associated with an anonymizing proxy service. This could indicate an attempt to bypass security controls or obscure the true origin of the access.
Detects when a user account in Okta is locked out due to exceeding the maximum number of sign-in attempts. This can indicate brute-force attacks, password spraying, or legitimate users forgetting their passwords.
Detects the creation of new user accounts within Okta. This rule specifically looks for the 'user.lifecycle.create' event type in Okta logs, indicating that a new user account has been provisioned in the identity management system.
Detects when an Okta application Sign-on Policy is modified or deleted. This could indicate an adversary attempting to weaken security controls to gain unauthorized access or maintain persistence.
Page 125 of 142