Detection Packs
Detection packs provide pre-built detection content published and maintained by Anomali, enabling you to quickly deploy detection rules and saved searches without creating your own AQL queries. Each pack focuses on a specific detection theme, such as user and entity behavior or network anomalies, and is mapped to relevant MITRE ATT&CK techniques.
When you install a detection pack, its rules are added in a disabled state. The underlying detection logic is read-only, allowing Anomali to centrally deliver updates without modifying your operational configuration. You can customize operational settings such as the risk score, lookback window, and run schedule, while the detection logic itself remains protected. If you need to modify the detection logic, duplicate the rule to create a fully editable custom copy. See Duplicating Detection Rules for details.
To access available detection packs, navigate to ThreatStream Next Gen > Security Operations > Detection Rules and click Detection Packs.
Anomali offers the following detection packs out of the box:
| Detection Pack | Rules | Description |
|---|---|---|
| Application Activity | 88 | Detections covering application-layer activity including API calls, web resource access, OAuth and service principal operations, SaaS file and data actions, cloud API abuse patterns, and collaboration platform events. |
| Command and Control | 57 | Detections covering MITRE ATT&CK Command and Control (TA0011) techniques, including beaconing behaviour, remote access tool abuse, protocol tunnelling, covert channel use, multi-hop proxying, dynamic DNS, and data obfuscation techniques used by adversaries to maintain persistent, stealthy communication with compromised endpoints. |
| Credential Access | 55 | Detections for MITRE ATT&CK Credential Access and Discovery techniques covering credential dumping, brute force, password spraying, LSASS access, Kerberoasting, registry credential access, and Active Directory enumeration behaviors. |
| Discovery | 35 | Detections targeting OCSF Discovery category events, with a focus on Active Directory replication activity (event codes 4928-4936) and directory service object lifecycle events (5136, 5137, 5141, 4662). Covers building- block telemetry rules for AD replication failure and session monitoring, anomaly-based detections for unusual replication volume and timing, and targeted rules for DCSync-style credential dumping, rogue domain controllers, and sensitive directory object manipulation. |
| EDR | 38 | Detections targeting CrowdStrike Falcon and multi-vendor EDR telemetry across OCSF System Activity, Findings, Network Activity, Application Activity, and Identity and Access Management categories. Covers EDR alert severity tiers (informational through critical), CrowdStrike-specific API and console activity monitoring (policy changes, sensor management, bulk detection closure, API access anomalies), process execution detections for living-off-the-land binaries and credential dumping tools, firewall-based network anomaly detections, CrowdStrike Identity Protection incident surfaces, and XDR finding enrichment rules for credential access, defence evasion, lateral movement, persistence, and privilege escalation tactics. |
| Findings | 35 | Detections focused on security findings from vulnerability scanners, endpoint detection platforms (CrowdStrike), identity risk engines (Microsoft Entra ID Identity Protection), firewall threat feeds, and cloud security posture tools (GCP Security Command Center). Covers vulnerability prioritisation, risky sign-in analysis, firewall threat activity, and cloud security finding enumeration. |
| Identity & Access Management | 80 | Detections covering identity lifecycle events, authentication anomalies, access control changes, MFA abuse, privileged account activity, and cloud IAM operations across on-premises Active Directory, Microsoft Entra ID, AWS IAM, and GCP IAP environments. |
| Network Activity | 131 | Foundational network activity detections covering inbound and outbound connections, protocol-specific traffic, threat intelligence matches, tunnelling, exfiltration patterns, and anomalous network behaviour across the OCSF Network Activity category. |
| System Activity | 42 | Detections covering operating system-level activity including process launches, file system operations, registry modifications, scheduled tasks, and system-integrity events across Windows and Linux endpoints. |
| Windows | 51 | Core detection coverage for Windows endpoint and identity activity, including process execution, registry modifications, authentication events, account and group management, firewall changes, file deletions, service installations, scheduled tasks, and network-based DNS anomalies. Designed to provide broad baseline visibility across Windows environments using OCSF-normalised telemetry from Windows Event Logs and Sysmon. |
For details on installation and management of pre-built detection rules, see Managing Pre-Built Detection Rules.