Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
361 detections
Filters
Last updated
All Time
Detection languages
221
34
32
25
24
Contributors
108
70
66
16
14
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
197
191
116
38
19
Products / Services
210
40
30
29
27
MITRE Techniques
238
171
151
80
77
CVEs
5
IDS Classtypes
4
3
1
IDS Protocols
8
Detects rapid mass-cloning or downloading of private GitHub repositories shortly after an OAuth token authorization, originating from IP addresses or countries not previously associated with the user account. This behavior is indicative of unauthorized bulk data extraction using compromised credentials, consistent with threat actor activity (e.g., TeamPCP/UNC6780).
Detects rapid, bulk cloning or downloading of GitHub repositories containing sensitive data (e.g., consensus algorithms, PII, internal blocklists). This behavior is characteristic of unauthorized data exfiltration, specifically tracking activity involving suspicious OAuth token prefixes (gho_) and rapid high-volume access to sensitive organizational assets within a short timeframe.
This rule monitors for high-frequency download or access events of files associated with AI development, such as model weights (.pt, .ckpt, .safetensors, .h5, .onnx, .pkl, .pb), checkpoints, and research datasets from cloud storage. It triggers when an account accesses or downloads 20 or more unique AI-related files within a 60-minute window, which is indicative of unauthorized data exfiltration of intellectual property.
Detects an anomalous burst of git clone, fetch, or download events performed by a single GitHub user account against a large number of private repositories within a short timeframe (15-minute window). This pattern often indicates unauthorized bulk collection or exfiltration of sensitive source code by an actor using a valid account.
Detects a service principal or user account performing a burst of 'ListKeys' operations across multiple Azure Storage accounts. This behavior is indicative of an attacker attempting to dump access keys for multiple storage accounts after initial compromise or privilege escalation to gain further access to sensitive cloud data.
Detects a service principal or user account performing a burst of 'ListKeys' operations across multiple Azure Storage accounts. This behavior is indicative of an attacker attempting to dump access keys for multiple storage accounts after initial compromise or privilege escalation to gain further access to sensitive cloud data.
Detects rapid mass-cloning or downloading of private GitHub repositories shortly after an OAuth token authorization, originating from IP addresses or countries not previously associated with the user account. This behavior is indicative of unauthorized bulk data extraction using compromised credentials, consistent with threat actor activity (e.g., TeamPCP/UNC6780).
Detects rapid mass-cloning or downloading of private GitHub repositories shortly after an OAuth token authorization, originating from IP addresses or countries not previously associated with the user account. This behavior is indicative of unauthorized bulk data extraction using compromised credentials, consistent with threat actor activity (e.g., TeamPCP/UNC6780).
Detects the creation and immediate deletion of a GitHub OAuth token that is used to clone or fetch a large volume of private repositories within a short lifespan. This behavior is indicative of an adversary using a temporary, ephemeral token to perform rapid data exfiltration or mass reconnaissance on source code repositories.
This rule correlates the receipt of a potential extortion-themed email (containing keywords related to ransom, bitcoin, or data leaks and mentioning cloud platforms like SharePoint, OneDrive, or Box) with a subsequent bulk access event of mail items by the same recipient using a specific client application identifier. This pattern is indicative of an attacker attempting to extort a user or organization following the unauthorized exfiltration or access of sensitive email data stored in cloud services.
Detects high-frequency access to mail items via specific client applications, or high-frequency file downloads/access within SharePoint and OneDrive. These patterns may indicate suspicious data collection or exfiltration attempts by a compromised account.
Detects high-volume, diverse administrative and discovery activities in cloud environments, including SharePoint site enumeration, Azure AD user/identity discovery, and suspicious access to mail items via specific client applications, potentially indicating post-compromise reconnaissance or data harvesting.
Detects bulk read operations on AWS Secrets Manager or similar cloud secret stores where the accessed resources contain keywords related to cryptocurrency custody, private keys, or wallet material. This pattern is indicative of unauthorized exfiltration attempts by threat actors such as Slim Spider targeting digital asset infrastructure.
Detects a single identity listing access keys for a high volume (20+) of Azure Storage Accounts within a 15-minute window. This behavior is indicative of credential harvesting, reconnaissance, or automated exfiltration attempts targeting storage resources.
Detects anomalous, high-volume file access or download activity in Microsoft SharePoint Online or OneDrive for Business originating from a 'python-httpx' user agent. This pattern often indicates automated data collection or exfiltration attempts using programmatic tools.
Detects anomalous, high-volume file access or preview activity in OneDrive or SharePoint from non-browser user agents. This pattern is indicative of potential data exfiltration where adversaries use scripted clients or APIs to mass-read or preview files, bypassing traditional download-based alerts.
This rule detects a suspicious sequence of AWS CloudTrail events where a single identity performs a burst of discovery and enumeration activities (reconnaissance) followed shortly by requests to access sensitive secrets, credentials, or sensitive files (e.g., .env files). This pattern is indicative of an attacker who has gained initial access and is pivoting to identify and exfiltrate credentials.
Detects anomalous 'Bind' operations in Microsoft 365 Exchange Online audit logs where the user-agent string includes 'Firefox/131.0' and 'Client=REST' while using specific Microsoft Outlook ClientAppId and APIId parameters. This pattern has been observed in automated, cross-tenant mailbox exfiltration campaigns targeting sensitive payroll and financial documentation.
Detects high-volume file and data access events within Microsoft 365 services (SharePoint, OneDrive, Exchange) originating from Python-based user agents (e.g., 'python-requests', 'python-httpx'). This pattern is indicative of automated scraping, data exfiltration, or bulk activity performed by unauthorized scripts.
Detects high-volume file access or download activity by a single user in SharePoint or OneDrive over a 15-minute window. This behavior is indicative of bulk cloud data exfiltration often associated with extortion campaigns.
This rule detects unauthorized mailbox access by identifying specific ClientAppId and API ID pairs known to be associated with an Office 365 email exfiltration toolkit. This activity is indicative of an attacker attempting to programmatically access or exfiltrate sensitive email data from the organization's environment.
Page 4 of 18