Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
276 detections
Filters
Last updated
All Time
Detection languages
119
62
41
18
11
Contributors
55
47
38
31
18
Categories
165
71
63
63
48
Platforms
39,936
7,266
6,535
3,866
3,647
276
Products / Services
182
37
34
31
25
MITRE Techniques
91
65
61
59
52
CVEs
5
5
5
5
2
IDS Classtypes
4
3
2
2
1
IDS Protocols
11
Identifies when an Azure Kubernetes Pod is deleted. This activity could indicate an attempt to disrupt services, evade detection, or remove evidence by an attacker. Monitoring these deletions is crucial for maintaining the integrity and availability of Kubernetes deployments.
Detects when events are deleted in Azure Kubernetes. An adversary may delete events in Azure Kubernetes in an attempt to evade detection by removing forensic evidence.
This rule identifies when Kubernetes secrets are modified or deleted within a Google Cloud Platform (GCP) environment. It specifically looks for audit log entries related to the creation, update, patch, or deletion of Kubernetes secrets.
Page 14 of 14