Detection rules

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

11,453
detections

Search detections

Filters

Showing 30 of 11,453

Identifies deletion of a Pulumi stack. Stack deletion is a destructive operation that removes the stack's infrastructure state, and may be legitimate maintenance or unauthorized activity.

T1485

Licence: MIT License
Published: Oct 16, 2026

LowMicrosoft Sentinel analytics

Pulumi Cloud - Organization membership change

Identifies changes to Pulumi Cloud organization membership, including members being added, removed, or having their roles changed. These events track access control changes to the infrastructure management platform and should correspond to expected administrative activity.

T1098

Licence: MIT License
Published: Oct 16, 2026

MediumMicrosoft Sentinel analytics

Pulumi Cloud - Excessive authentication failures

Identifies more than five failed Pulumi Cloud login attempts (user-login-failed events) from a single IP address within a one-hour window. This may indicate a brute force attack or an attempt to use compromised credentials.

T1110

Licence: MIT License
Published: Oct 16, 2026

MediumMicrosoft Sentinel analytics

GitLab - TI - Connection from Malicious IP

This query correlates Threat Intelligence data from Microsoft Sentinel with GitLab NGINX Access Logs (available in GitLab CE as well) to identify access from potentially TI-flagged IPs.

T1078

Licence: MIT License
Published: Oct 16, 2026

MediumMicrosoft Sentinel analytics

GitLab - Local Auth - No MFA

This query checks GitLab Audit Logs to see if a user authenticated without MFA. Ot might mean that MFA was disabled for the GitLab server or that an external authentication provider was bypassed. This rule focuses on 'admin' privileges but the parameter can be adapted to also include all users.

T1110

Licence: MIT License
Published: Oct 16, 2026

MediumMicrosoft Sentinel analytics

GitLab - Brute-force Attempts

This query relies on GitLab Application Logs to get failed logins to highlight brute-force attempts from different IP addresses in a short space of time.

T1110

Licence: MIT License
Published: Oct 16, 2026

MediumSigmaHQ

Nslookup PowerShell Download Cradle - ProcessCreation

Detects suspicious powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records

T1071.004

Written by: Nasreddine Bencherchali (Nextron Systems)Attributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 15, 2026

MediumSigmaHQ

EVTX Created In Uncommon Location

Detects the creation of new files with the ".evtx" extension in non-common or non-standard location. This could indicate tampering with default EVTX locations in order to evade security controls or simply exfiltration of event log to search for sensitive information within. Note that backup software and legitimate administrator might perform similar actions during troubleshooting.

T1685.001

Written by: D3F7A5105Attributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 15, 2026

HighSigmaHQ

Exchange PowerShell Cmdlet History Deleted

Detects the deletion of the Exchange PowerShell cmdlet History logs which may indicate an attempt to destroy forensic evidence

T1070

Written by: Nasreddine Bencherchali (Nextron Systems)Attributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 15, 2026

Detection rules

Description

Detection logic

Detection requirements

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules