Every published rule

This rule detects when an application is granted delegated or app role permissions for Microsoft Graph, Exchange, Sharepoint, or Azure AD

This rule detects the creation or patching of potential hostile RoleBinding/ClusterRoleBinding.

This rule detects that users were active from an IP address that has been identified as an anonymous proxy IP address.

This rule detects when the Secrets are Modified or Deleted.

This rule detects when PIM alerts are set to disabled.

This rule detects the deletion of one or more VPC Flow Logs in AWS Elastic Compute Cloud (EC2) through the DeleteFlowLogs API call. Adversaries may delete flow logs to evade detection or remove evidence of network activity, hindering forensic investigations and visibility into hostile operations.

This rule detects when a Container Registry is created or deleted.

This rule detects changes to the device registration policy.

This rule detects when a user has been assigned a privilege role and are not using that role.

This rule detects when a Firewall Rule Configuration is Modified or Deleted.

This rule detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove model safety controls and enable unsafe or unauthorized model responses.

This rule detects sign-ins where the device was non-compliant.

This rule detects automatic email forwarding to external domains in Google Workspace, which may indicate data leakage or misuse.

This rule detects a change in the AWS Identity Center (FKA AWS SSO) identity provider. A change in identity provider enables an adversary to establish persistent access or escalate privileges via user impersonation.

This rule detects device registration or join events where MFA was not performed.

This rule detects S3 Browser utility creating IAM User or AccessKey.

This rule detects when an account hasn't signed in during the past n number of days.

This rule detects when a VPN Tunnel Modified or Deleted in Google Cloud.

This rule detects suggests that the user's valid credentials have been leaked.

This rule detects S3 browser utility creating Inline IAM policy containing default S3 bucket name placeholder value of "<YOUR-BUCKET-NAME>".