Browse Rules

Search and filter across all detection sources

341 rules

sagan medium other

[CROWDSTRIKE] Suspicious Impact: Data encrypted for impact activity observed - Critical

[CROWDSTRIKE] Suspicious Impact: Data encrypted for impact activity observed - Critical
sagan critical other

[CROWDSTRIKE] Impact Tactic Catchall

[CROWDSTRIKE] Impact Tactic Catchall
sublime medium mql

PhaaS: Impact Solutions (Impact Vector Suite)

Identifies the use of the Impact Solutions PhaaS. Impact Vector Suite is a full-spectrum payload delivery platform, engineered for stealth-optimized execution across all major deployment vectors.

sagan medium other

[MICROSOFT_DEFENDER_ENDPOINT] Impact High Alert Detected

[MICROSOFT_DEFENDER_ENDPOINT] Impact High Alert Detected
sagan medium other

[MICROSOFT_DEFENDER_ENDPOINT] Impact Informational Alert Detected

[MICROSOFT_DEFENDER_ENDPOINT] Impact Informational Alert Detected
sagan medium other

[MICROSOFT_DEFENDER_ENDPOINT] Impact Low Alert Detected

[MICROSOFT_DEFENDER_ENDPOINT] Impact Low Alert Detected
sagan medium other

[MICROSOFT_DEFENDER_ENDPOINT] Impact Medium Alert Detected

[MICROSOFT_DEFENDER_ENDPOINT] Impact Medium Alert Detected
sagan critical other

[AWS-GUARDDUTY] GuardDuty event detected (Impact:EC2/PortSweep)

[AWS-GUARDDUTY] GuardDuty event detected (Impact:EC2/PortSweep)
sagan critical other

[AWS-GUARDDUTY] GuardDuty event detected (Impact:EC2/WinRMBruteForce)

[AWS-GUARDDUTY] GuardDuty event detected (Impact:EC2/WinRMBruteForce)
sagan critical other

[AWS-GUARDDUTY] GuardDuty event detected (Impact:IAMUser/AnomalousBehavior)

[AWS-GUARDDUTY] GuardDuty event detected (Impact:IAMUser/AnomalousBehavior)
sagan critical other

[AWS-GUARDDUTY] GuardDuty event detected (Impact:Kubernetes/MaliciousIPCaller)

[AWS-GUARDDUTY] GuardDuty event detected (Impact:Kubernetes/MaliciousIPCaller)
sagan critical other

[AWS-GUARDDUTY] GuardDuty event detected (Impact:Kubernetes/SuccessfulAnonymousAccess)

[AWS-GUARDDUTY] GuardDuty event detected (Impact:Kubernetes/SuccessfulAnonymousAccess)
sagan critical other

[AWS-GUARDDUTY] GuardDuty event detected (Impact:Kubernetes/TorIPCaller)

[AWS-GUARDDUTY] GuardDuty event detected (Impact:Kubernetes/TorIPCaller)
sagan critical other

[AWS-GUARDDUTY] GuardDuty event detected (Impact:S3/MaliciousIPCaller)

[AWS-GUARDDUTY] GuardDuty event detected (Impact:S3/MaliciousIPCaller)
sagan critical other

[AWS-GUARDDUTY] GuardDuty event detected (Impact:EC2/AbusedDomainRequest.Reputation)

[AWS-GUARDDUTY] GuardDuty event detected (Impact:EC2/AbusedDomainRequest.Reputation)
sagan critical other

[AWS-GUARDDUTY] GuardDuty event detected (Impact:EC2/BitcoinDomainRequest.Reputation)

[AWS-GUARDDUTY] GuardDuty event detected (Impact:EC2/BitcoinDomainRequest.Reputation)
sagan critical other

[AWS-GUARDDUTY] GuardDuty event detected (Impact:EC2/MaliciousDomainRequest.Reputation)

[AWS-GUARDDUTY] GuardDuty event detected (Impact:EC2/MaliciousDomainRequest.Reputation)
sagan critical other

[AWS-GUARDDUTY] GuardDuty event detected (Impact:EC2/SuspiciousDomainRequest.Reputation)

[AWS-GUARDDUTY] GuardDuty event detected (Impact:EC2/SuspiciousDomainRequest.Reputation)
sagan critical other

[AWS-GUARDDUTY] GuardDuty event detected (Impact:Kubernetes/MaliciousIPCaller.Custom)

[AWS-GUARDDUTY] GuardDuty event detected (Impact:Kubernetes/MaliciousIPCaller.Custom)
sagan critical other

[AWS-GUARDDUTY] GuardDuty event detected (Impact:S3/AnomalousBehavior.Delete)

[AWS-GUARDDUTY] GuardDuty event detected (Impact:S3/AnomalousBehavior.Delete)
sagan critical other

[AWS-GUARDDUTY] GuardDuty event detected (Impact:S3/AnomalousBehavior.Permission)

[AWS-GUARDDUTY] GuardDuty event detected (Impact:S3/AnomalousBehavior.Permission)
sagan critical other

[AWS-GUARDDUTY] GuardDuty event detected (Impact:S3/AnomalousBehavior.Write)

[AWS-GUARDDUTY] GuardDuty event detected (Impact:S3/AnomalousBehavior.Write)
sagan medium other

[CROWDSTRIKE] Possible Impact Blocked - A Process Deleted A System Backup

[CROWDSTRIKE] Possible Impact Blocked - A Process Deleted A System Backup
sagan medium other

[CROWDSTRIKE] Possible Impact Detected - A Process Deleted A System Backup

[CROWDSTRIKE] Possible Impact Detected - A Process Deleted A System Backup
sagan medium other

[CROWDSTRIKE] Possible Impact Killed - A Process Deleted A System Backup

[CROWDSTRIKE] Possible Impact Killed - A Process Deleted A System Backup