Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
361 detections
Filters
Last updated
All Time
Detection languages
221
34
32
25
24
Contributors
108
70
66
16
14
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
197
191
116
38
19
Products / Services
210
40
30
29
27
MITRE Techniques
238
171
151
80
77
CVEs
5
IDS Classtypes
4
3
1
IDS Protocols
8
Detects the use of open-source secret-scanning tools (e.g., TruffleHog) by identifying their specific User-Agent strings in AWS CloudTrail logs during GetCallerIdentity calls, followed by suspicious enumeration activity (ListBuckets, ListSecrets, ListAccessKeys) from the same source IP. This behavior is indicative of threat actors validating stolen credentials for unauthorized access to cloud resources.
Detects a service principal or user account performing a burst of 'ListKeys' operations across multiple Azure Storage accounts. This behavior is indicative of an attacker attempting to dump access keys for multiple storage accounts after initial compromise or privilege escalation to gain further access to sensitive cloud data.
Detects anomalous, unauthorized access to machine learning model artifacts (e.g., .onnx, .pt, .h5) within object storage or model registries. The rule identifies suspicious patterns including high-volume file reads by non-ML team identities, lack of multi-factor authentication, or access from geolocations outside approved operating regions, indicative of potential model exfiltration or intellectual property theft.
Detects usage of AWS CloudShell followed by S3 data-plane activity (GetObject/PutObject) from users without a documented baseline or exhibiting geographic anomalies. This pattern is indicative of potential misuse of a pre-authenticated execution context to perform unauthorized data staging or access, often evading host-based EDR monitoring.
Detects an anomalous volume of file downloads from cloud storage platforms (SharePoint, OneDrive, Google Drive, Box) occurring within two hours of a high or medium risk sign-in event, including impossible travel or token replay scenarios. This pattern is indicative of potential data exfiltration by an actor using compromised credentials.
Detects a service principal or user account performing a burst of 'ListKeys' operations across multiple Azure Storage accounts. This behavior is indicative of an attacker attempting to dump access keys for multiple storage accounts after initial compromise or privilege escalation to gain further access to sensitive cloud data.
Detects a service principal or user account performing a burst of 'ListKeys' operations across multiple Azure Storage accounts. This behavior is indicative of an attacker attempting to dump access keys for multiple storage accounts after initial compromise or privilege escalation to gain further access to sensitive cloud data.
Detects anomalous AWS IAM and Secrets Manager API activity indicative of credential abuse following suspected exposure. The rule identifies suspicious patterns such as unauthorized enumeration of access keys, secret retrieval, and creation of new keys by non-service principals, reflecting activity associated with ShinyHunters-style operations where compromised credentials are abused.
Detects the ingestion of documents into production RAG (Retrieval-Augmented Generation) indexes from untrusted or external-facing sources, which may indicate an attempt to perform RAG poisoning attacks.
Detects anomalous, high-volume file access or preview activity in OneDrive or SharePoint from non-browser user agents. This pattern is indicative of potential data exfiltration where adversaries use scripted clients or APIs to mass-read or preview files, bypassing traditional download-based alerts.
Detects anomalous, high-volume file access or preview activity in OneDrive or SharePoint from non-browser user agents. This pattern is indicative of potential data exfiltration where adversaries use scripted clients or APIs to mass-read or preview files, bypassing traditional download-based alerts.
Detects automated mailbox monitoring (mailbox access cadence) followed by searches for sensitive finance-related keywords (e.g., invoice, payment, wire, ACH). This pattern is characteristic of a 'Box Monitor' or 'Inbox Monitor' actor, which maintains persistence via API polling to exfiltrate financial information from a compromised account.
This rule monitors for high-frequency download or access events of files associated with AI development, such as model weights (.pt, .ckpt, .safetensors, .h5, .onnx, .pkl, .pb), checkpoints, and research datasets from cloud storage. It triggers when an account accesses or downloads 20 or more unique AI-related files within a 60-minute window, which is indicative of unauthorized data exfiltration of intellectual property.
Detects a single identity listing access keys for a high volume (20+) of Azure Storage Accounts within a 15-minute window. This behavior is indicative of credential harvesting, reconnaissance, or automated exfiltration attempts targeting storage resources.
This rule detects the use of browser-based cloud shells (AWS CloudShell, Azure Cloud Shell) as an entry point for post-exploitation activities, specifically tracking when these sessions are followed by object storage operations (S3 PutObject/GetObject or equivalent Azure Blob operations) within the same session context. This pattern is indicative of attackers using ephemeral cloud shells to stage stolen data or download offensive tooling, thereby bypassing host-based EDR monitoring.
This rule detects the use of browser-based cloud shells (AWS CloudShell, Azure Cloud Shell) as an entry point for post-exploitation activities, specifically tracking when these sessions are followed by object storage operations (S3 PutObject/GetObject or equivalent Azure Blob operations) within the same session context. This pattern is indicative of attackers using ephemeral cloud shells to stage stolen data or download offensive tooling, thereby bypassing host-based EDR monitoring.
This rule detects potentially compromised accounts by correlating suspicious authentication activity (such as risky sign-ins, impossible travel, or malicious OAuth/Mail-rule configurations) with a subsequent spike in SharePoint or OneDrive file access, downloads, or external link sharing within a one-hour window. This behavior is indicative of an adversary performing cloud-based data exfiltration after gaining unauthorized access to an account.
Detects high-volume file download activity in Office 365/SharePoint/OneDrive audit logs. The rule correlates download spikes with users who have recently triggered security alerts related to session hijacking, token theft, or risky sign-ins, which are indicators of a potential cloud account takeover scenario.
Detects bulk mailbox export or content search operations performed by an identity shortly after a high-risk sign-in event. This pattern is indicative of potential account takeover where an adversary attempts to harvest sensitive email data at scale for BEC or extortion.
Detects an anomalous volume of file access or synchronization activity on cloud document platforms (Microsoft SharePoint, OneDrive, or Google Drive) that occurs following a high-severity risky sign-in event. The rule specifically flags potential exfiltration patterns such as large volumes of data transfer or numerous file accesses, especially if associated with unmanaged devices or connections to known personal/external file-sharing services.
Detects the creation of anonymous or guest-access sharing links for SharePoint items that are classified as sensitive (having a sensitivity label applied). This activity could indicate potential data exfiltration or unauthorized sharing of protected corporate information.
Page 2 of 18