Search and filter across all detection sources
643 rules
Rundll32 Registered COM Objects
load malicious registered COM objects
PROD (TM002.1) - OBJECT - Created or Deleted a Tier Level Object
A Tier Model object was created or deleted
[CyberArk] External Object Operation
[VEEAM] Object Storage Deleted
AWSCloudTrail - S3 object publicly exposed
Detects S3 object ACL changes that expose objects to public or broadly authenticated users. This can result in unintended data disclosure from object-level permissions.
PROD (TM004.1) - OBJECT - Enabled, Disabled, Unlocked, or Password Reset of a Tier Level Object
A Tier Model object has been modified to Enable, Disable, or Unlock of a Tier Level Object.
AD Object WriteDAC Access
Detects WRITE_DAC access to a domain object
[Barracuda] WAF Object Depth Exceeded
[CyberArk] Object content validated failed
[DUO] admin created an object
[DUO] admin deleted an object
[VEEAM] Objects for Job Deleted
Cynerio - IoT - Default password
User signed in using default credentials
Cynerio - IoT - Weak password
User signed in using weak credentials
Object Marked as Clean
Detects when an object is marked as clean.
Objects for Protection Group Changed
Detects when protection group objects are updated.
Unexpected event occurred on synchronization object
Contains_UserForm_Object [maldocs]
Detect UserForm object in MS Office document
[AS400] AUTFAIL - Not authorized to object
[Barracuda] WAF Max Object Child Exceeded
[Barracuda] WAF Max Object Keys Exceeded
[MCAS] ALERT_CABINET_EVENT_MATCH_OBJECT