Detection engineering
Correlation rules evaluated against the event stream. Disabling a rule stops it raising alerts but preserves the alerts it has already produced.
Rule library
19 of 19 rules shown
| Armed | Rule | Severity | Category | ATT&CK | Alerts |
|---|---|---|---|---|---|
| Bulk data egress A transfer far larger than the baseline for the host, to a destination not previously seen. The shape of exfiltration rather than backup. | Critical | Exfiltration | T1048Exfiltration | 2 | |
| Credential store access Direct access to a credential store or secrets material, outside the normal path applications use to retrieve them. | Critical | Credential Access | T1555Credential Access | 0 | |
| Impossible travel The same account authenticating from two countries closer together in time than travel between them would allow. Strong evidence that a credential is being used by someone other than its owner. | Critical | Credential Access | T1078.004Initial Access | 1 | |
| MFA method removed An authenticator unenrolled from an account. Frequently the first action after a takeover, to keep access once the password is reset. | Critical | Persistence | T1556.006Persistence | 0 | |
| Privileged account created A new account added directly to an administrative group. Legitimate provisioning goes through change control, so this warrants immediate confirmation. | Critical | Privilege Escalation | T1098Privilege Escalation | 0 | |
| Authentication failure burst followed by success A run of failed authentications for one account followed shortly by a success. The classic signature of a guessing attack that eventually landed. | High | Credential Access | T1110.001Credential Access | 0 | |
| Bulk containment by a single operator Several destructive automations executed by one operator in a short window. Legitimate during a live incident, worth a second pair of eyes at any other time. | High | Platform | T1531Impact | 0 | |
| Cloud access key created outside change hours A long-lived cloud credential minted outside the working window. Key creation is a normal action at an abnormal time. | High | Persistence | T1098.001Persistence | 1 | |
| Detection coverage reduced from the console A detection rule was disarmed or a suppression created. Both narrow what the platform reports, and an intruder who reaches the console will reach for exactly these controls before doing anything noisier. | High | Platform | T1562.001Defense Evasion | 0 | |
| Encoded PowerShell execution PowerShell invoked with a base64-encoded command block, a common wrapper for staged payloads that defeats plaintext command inspection. | High | Execution | T1059.001Execution | 1 | |
| Mass file access One principal reading far more files in a short window than normal use produces, consistent with staging data for collection. | High | Collection | T1005Collection | 1 | |
| Office application spawning a script interpreter A document application starting a shell or scripting host. Word does not legitimately need to launch PowerShell, so this is near-always macro execution. | High | Execution | T1204.002Execution | 1 | |
| Password spray against directory services One source address failing authentication repeatedly inside a short window, consistent with spraying a common password across many accounts. | High | Credential Access | T1110.003Credential Access | 1 | |
| Persistence mechanism created A scheduled task, service or run key established on a host, giving an intruder a way back after reboot. | High | Persistence | T1053.005Persistence | 0 | |
| Threat intelligence match An indicator from a threat intelligence feed observed in telemetry. Matching runs over the whole window each sweep, so intel added today surfaces activity already stored. | High | Threat Intelligence | T1071Command and Control | 0 | |
| Perimeter denial burst A single source address repeatedly blocked at the edge in a short window, consistent with scanning or a misconfigured integration. | Medium | Discovery | T1046Discovery | 0 | |
| Rare process execution A binary executed that is almost unseen across the estate. Rarity alone is not malice, but it is where unknown tooling surfaces first. | Medium | Execution | T1059Execution | 0 | |
| Repeated authorization failures in the console One operator hitting the permission boundary repeatedly. Usually confusion about a role, occasionally an account probing for what it can reach. | Medium | Platform | T1087Discovery | 0 | |
| Deprecated TLS negotiated A session negotiated on TLS 1.0 or 1.1. A hygiene finding rather than an intrusion, but it is how downgrade paths stay open. | Low | Hygiene | T1562Defense Evasion | 0 |