Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,154 detections
Filters
Last updated
All Time
Detection languages
695
181
114
75
54
Contributors
328
252
122
76
71
Categories
726
701
220
196
148
Platforms
1,121
187
161
59
51
Products / Services
10,670
9,758
6,693
4,421
3,749
1,154
MITRE Techniques
700
429
360
209
198
CVEs
2
2
1
1
1
IDS Classtypes
4
3
1
1
IDS Protocols
8
Identifies when a Point-to-site VPN is Modified or Deleted in Azure. This could indicate an attacker attempting to disrupt network access or cover their tracks by removing or altering VPN configurations.
This rule identifies when a suppression rule is created in Azure. Adversaries might create suppression rules to evade detection by preventing security alerts from being generated or displayed for their malicious activities.
Detects when highly privileged delegated permissions are granted on behalf of all users in Azure Active Directory. This can indicate an attempt to gain broad access to resources by an application.
Identifies when a application gateway is modified or deleted.
Identifies when a application security group is modified or deleted.
Identifies when a key vault is modified or deleted.
Identifies when secrets are modified or deleted in Azure.
Identifies when a network security configuration is modified or deleted.
Identifies when a VPN connection is modified or deleted.
Identifies when a device or device configuration in azure is modified or deleted.
Identifies when DNS zone is modified or deleted.
Identifies when a Keyvault Key is modified or deleted in Azure.
Identifies when a Azure Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate.
Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs.
An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.
Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs.
An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.
Identifies the deletion of Azure Kubernetes Pods.
Identifies when a Firewall Rule Configuration is Modified or Deleted.
Identifies when a Point-to-site VPN is Modified or Deleted.
Identifies when a virtual network device is being modified or deleted.
This can be a network interface, network virtual appliance, virtual hub, or virtual router.
This can be a network interface, network virtual appliance, virtual hub, or virtual router.
Identifies when a new cloudshell is created inside of Azure portal.
Identifies when a suppression rule is created in Azure. Adversary's could attempt this to evade detection.
Identifies when a Virtual Network is modified or deleted in Azure.
Page 55 of 55