Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
361 detections
Filters
Last updated
All Time
Detection languages
221
34
32
25
24
Contributors
108
70
66
16
14
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
197
191
116
38
19
Products / Services
210
40
30
29
27
MITRE Techniques
238
171
151
80
77
CVEs
5
IDS Classtypes
4
3
1
IDS Protocols
8
Detects when a user authenticates via device code flow or performs device registration/ownership addition, followed by a bulk download of SharePoint or OneDrive files (25 or more distinct files) within a 60-minute window. This behavior can indicate session hijacking or unauthorized access where an attacker uses device code phishing to gain access and quickly exfiltrate cloud documents.
Detects a suspicious behavioral sequence in AWS CloudTrail logs from external IPs using the Boto3 user agent. The sequence starts with caller-identity validation (GetCallerIdentity), followed by a high volume of secret reads (Secrets Manager) or cloud storage object reads (S3), indicating automated reconnaissance, credential theft, or data exfiltration.
Box Shield Anomalous Download
Cortex XDR
Surfaces Box Shield anomalous download alerts with full context extraction, including download delta, historical baseline vs anomaly period comparison, and source IPs.
Detects Microsoft 365 activity (Exchange and SharePoint) initiated by known compromised service principal UUIDs associated with the ConnectWise supply-chain attack.
Box Shield Suspicious Location Access
Cortex XDR
Surfaces Box Shield suspicious location alerts with geographic context and accessed content details. Detects access from unusual or excluded geographic locations indicating potential compromised accounts or credential theft.
Box Shield Malicious Content Upload
Cortex XDR
Surfaces Box Shield malware detection alerts with file hash, upload path, source IP, and scan results for immediate correlation and threat response.
Detects a sequence of events where an account performs a device code flow sign-in, registers or joins a device, and accesses a high volume of files in SharePoint or OneDrive within a 24-hour window. This pattern is commonly associated with adversary techniques abusing device code flows for initial access and registering managed/compromised devices to access sensitive corporate data.
Correlates a device code flow sign-in event with bulk file downloads from SharePoint or OneDrive by the same user account within a 1-hour window. This behavior can indicate potential account compromise or misuse where an adversary uses device code phishing to authenticate and subsequently exfiltrate sensitive files.
Detects potential cloud storage object discovery activity in Azure Blob Storage by identifying anomalous listing or enumeration operations from callers, including high request counts, extensive container access, high failure rates, or anonymous authentication.
The following analytic detects a high volume of Amazon CloudWatch Logs read operations performed by the same AWS principal and account within a
five-minute period.
It identifies more than 500 DescribeLogGroups, DescribeLogStreams, DownloadLogEvents, FilterLogEvents, GetLogEvents, or GetQueryResults API calls.
This activity may indicate automated discovery or collection of operational, application, or security telemetry from CloudWatch Logs.
five-minute period.
It identifies more than 500 DescribeLogGroups, DescribeLogStreams, DownloadLogEvents, FilterLogEvents, GetLogEvents, or GetQueryResults API calls.
This activity may indicate automated discovery or collection of operational, application, or security telemetry from CloudWatch Logs.
Detects a pattern of previewing many files then downloading a subset. This is
browsing behaviour — an intruder assessing what is worth taking before taking it —
and it differs from normal use, where a user opens files they already know about.
The preview-to-download ratio is the discriminator, not the raw volume of either.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='PREVIEWED'
| duration 1h
| groupby user
| select user, distinct_count(file)
| having distinct_count_col1 > 30
browsing behaviour — an intruder assessing what is worth taking before taking it —
and it differs from normal use, where a user opens files they already know about.
The preview-to-download ratio is the discriminator, not the raw volume of either.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='PREVIEWED'
| duration 1h
| groupby user
| select user, distinct_count(file)
| having distinct_count_col1 > 30
Detects a Box account accessed from a source address with no prior history, followed
by substantial download activity. The combination is far stronger than either signal
alone: a new location by itself is routine for mobile users, and downloads by
themselves are routine for everyone.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='DOWNLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 25
by substantial download activity. The combination is far stronger than either signal
alone: a new location by itself is routine for mobile users, and downloads by
themselves are routine for everyone.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='DOWNLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 25
Builds a 28-day hourly baseline of mail and file access operations (MailItemsAccessed, FileAccessed, FileDownloaded and SearchQueryPerformed) for each application identity and action type in CloudAppEvents, counting hours with no activity as zero, then alerts on each complete hour in the latest window where the identity’s operation count exceeds its average by more than three standard deviations and reaches a minimum volume.
Application identities legitimately read data at high volume, so a per-identity statistical baseline separates abuse of granted permissions from normal machine traffic where fixed thresholds fail. Identities with no activity in the baseline period are excluded, and a sustained change in behaviour, such as a large synchronisation or recovery job, will produce one result for each hour it remains elevated.
The rule runs every 24 hours, as this is the only Defender custom detection frequency with a 30-day lookback, and tests the 25 complete hours ending two hours before each run, allowing for audit log ingestion delays while overlapping the previous run so that no hour is missed.
Where the display name matches the AccountId, Defender for Cloud Apps could not name the identity, which is common for Microsoft first-party services, so analysts should confirm the application before drawing conclusions.
Application identities legitimately read data at high volume, so a per-identity statistical baseline separates abuse of granted permissions from normal machine traffic where fixed thresholds fail. Identities with no activity in the baseline period are excluded, and a sustained change in behaviour, such as a large synchronisation or recovery job, will produce one result for each hour it remains elevated.
The rule runs every 24 hours, as this is the only Defender custom detection frequency with a 30-day lookback, and tests the 25 complete hours ending two hours before each run, allowing for audit log ingestion delays while overlapping the previous run so that no hour is missed.
Where the display name matches the AccountId, Defender for Cloud Apps could not name the identity, which is common for Microsoft first-party services, so analysts should confirm the application before drawing conclusions.
Detects established git actors (seen >7 days ago) originating from a newly observed source IP address (first seen within 24 hours) that perform a high volume of git operations (>=15) across multiple distinct repositories (>=10). This behavior often indicates compromised developer credentials being used to enumerate and clone source code repositories.
Detects anomalous AWS Bedrock activity indicative of LLMjacking by correlating multiple phases of an attack chain (Model Enablement, Reconnaissance, Probing, and Execution) performed by a single identity within a short timeframe. This rule identifies attackers leveraging stolen IAM credentials to discover available AI models, probe for vulnerabilities, and execute unauthorized inference requests at scale.
This rule detects anomalous activity associated with the Antino backdoor, which uses Microsoft OneDrive as a dead-drop command-and-control (C2) channel. It identifies specific file paths related to heartbeat check-ins, operator tool drops, and exfiltration retrieval, summarizing events by user and IP to highlight potential malicious persistent communication and data transfer patterns.
Detects an anomalous volume of file downloads from SharePoint or OneDrive by a user on an unmanaged, non-compliant device, shortly following a suspicious or risky sign-in event. The rule establishes a baseline for individual user behavior over 30 days and alerts when the current hourly download activity significantly exceeds that baseline.
This rule detects potentially compromised accounts by correlating suspicious authentication activity (such as risky sign-ins, impossible travel, or malicious OAuth/Mail-rule configurations) with a subsequent spike in SharePoint or OneDrive file access, downloads, or external link sharing within a one-hour window. This behavior is indicative of an adversary performing cloud-based data exfiltration after gaining unauthorized access to an account.
Detects anomalous high-volume download or 'GetObject' operations from a single identity across multiple cloud storage objects and buckets within a short time window, which is indicative of bulk data exfiltration.
Detects anomalous, high-volume mailbox read (MailItemsAccessed) activity for a specific user compared to their historical daily baseline. The rule triggers when access volume significantly exceeds baseline averages, particularly when the activity originates from an IP address not previously observed for that specific user, which is a common indicator of automated email exfiltration via stolen session token replay.
Detects an account performing a mass download or synchronization of files from SharePoint or OneDrive within a 30-minute window, occurring within two hours of a medium or high-risk Azure AD sign-in event. This pattern is indicative of potential account takeover and subsequent data exfiltration by an adversary using harvested credentials.
Page 1 of 18