Browse Rules

Deprecated - Unusual Discovery Activity by User

This rule leverages alert data from various Discovery building block rules to alert on signals with unusual unique host.id and user.id entries.

GitHub Repo Created

A new GitHub repository was created.

GitHub PAT Access Revoked

Access to private GitHub organization resources was revoked for a PAT.

GitHub User Blocked From Organization

A GitHub user was blocked from access to an organization.

New User Added To GitHub Organization

A new user was added to a GitHub organization.

Unusual Process Extension

Identifies processes running with unusual extensions that are not typically valid for Windows executables.

Member Removed From GitHub Organization

A member was removed or their invitation to join was removed from a GitHub Organization.

New Okta Authentication Behavior Detected

Detects events where Okta behavior detection has identified a new authentication behavior.

System Network Connections Discovery

Adversaries may attempt to get a listing of network connections to or from a compromised system.

Execution of an Unsigned Service

This rule identifies the execution of unsigned executables via service control manager (SCM). Adversaries may abuse SCM to execute malware or escalate privileges.

Compression DLL Loaded by Unusual Process

Identifies the image load of a compression DLL. Adversaries will often compress and encrypt data in preparation for exfiltration.

File with Suspicious Extension Downloaded

Identifies unusual files downloaded from outside the local network that have the potential to be abused for code execution.

Archive File with Unusual Extension

Identifies the creation of an archive file with an unusual extension. Attackers may attempt to evade detection by masquerading files using the file extension values used by image, audio, or document file types.

Memory Dump File with Unusual Extension

Identifies the creation of a memory dump file with an unusual extension, which can indicate an attempt to disguise a memory dump as another file type to bypass security defenses.

First Occurrence of GitHub User Interaction with Private Repo

Detects a new private repo interaction for a GitHub user not seen in the last 14 days.

Windows Account or Group Discovery

This rule identifies the execution of commands that enumerates account or group information. Adversaries may use built-in applications to get a listing of local system or domain accounts and groups.

First Occurrence of IP Address For GitHub User

Detects a new IP address used for a GitHub user not previously seen in the last 14 days.

Remote System Discovery Commands

Discovery of remote system information using built-in commands, which may be used to move laterally.

Shortcut File Written or Modified on Startup Folder

Identifies shortcut files written to or modified in the startup folder. Adversaries may use this technique to maintain persistence.

Executable File with Unusual Extension

Identifies the creation or modification of an executable file with an unexpected file extension. Attackers may attempt to evade detection by masquerading files using the file extension values used by image, audio, or document file types.

Account or Group Discovery via Built-In Tools

Adversaries may use built-in applications to get a listing of local system or domain accounts and groups.

Deprecated - Creation of Kernel Module

Identifies activity related to loading kernel modules on Linux via creation of new ko files in the LKM directory.

First Occurrence GitHub Event for a Personal Access Token (PAT)

Detects a first occurrence event for a personal access token (PAT) not seen in the last 14 days.

First Occurrence of User-Agent For a GitHub User

Detects a new user agent used for a GitHub user not previously seen in the last 14 days.

Image Loaded with Invalid Signature

Identifies binaries that are loaded and with an invalid code signature. This may indicate an attempt to masquerade as a signed binary.