Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
361 detections
Filters
Last updated
All Time
Detection languages
221
34
32
25
24
Contributors
108
70
66
16
14
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
197
191
116
38
19
Products / Services
210
40
30
29
27
MITRE Techniques
238
171
151
80
77
CVEs
5
IDS Classtypes
4
3
1
IDS Protocols
8
This rule detects potentially unauthorized access or downloading of files from SharePoint and OneDrive, as well as specific MailItemsAccessed events associated with known exfiltration toolkit patterns within Microsoft 365. It flags individual events matching these criteria as a baseline for identifying suspicious data access behaviors.
Detects sign-ins to Office Home or Office365 applications from unmanaged or unknown devices, followed by an unusual amount or variety of activity within SharePoint Online or OneDrive for Business within a two-hour window. This behavior is indicative of potential unauthorized access or account compromise where an actor is using a non-corporate device to interact with sensitive cloud documents.
Detects high-frequency search queries in SharePoint that utilize internal document identifiers (indexdocid), which may indicate an adversary attempting to enumerate or scrape content across a site collection.
Detects bulk uploads or downloads of AI/ML artifacts, such as model weights, datasets, and configuration files, to suspected personal or external cloud storage providers. This rule is designed to identify potential unauthorized exfiltration of proprietary AI/ML assets.
Detects anomalous large-volume file download or export activity from cloud repositories (SharePoint, OneDrive, or Salesforce) occurring shortly after a help-desk-mediated credential or MFA reset for the same user. This behavior is indicative of account takeover, specifically vishing-to-exfiltration patterns used by threat actors.
Detects anomalous large-volume file download or export activity from cloud repositories (SharePoint, OneDrive, or Salesforce) occurring shortly after a help-desk-mediated credential or MFA reset for the same user. This behavior is indicative of account takeover, specifically vishing-to-exfiltration patterns used by threat actors.
Detects bulk read operations on AWS Secrets Manager or similar cloud secret stores where the accessed resources contain keywords related to cryptocurrency custody, private keys, or wallet material. This pattern is indicative of unauthorized exfiltration attempts by threat actors such as Slim Spider targeting digital asset infrastructure.
This rule monitors for high-frequency download or access events of files associated with AI development, such as model weights (.pt, .ckpt, .safetensors, .h5, .onnx, .pkl, .pb), checkpoints, and research datasets from cloud storage. It triggers when an account accesses or downloads 20 or more unique AI-related files within a 60-minute window, which is indicative of unauthorized data exfiltration of intellectual property.
Detects rapid access to multiple Microsoft 365 collection applications (Office, OneDrive, Teams) by a user account from specific AWS EC2 IP ranges identified as associated with the TeamFiltration tool. This behavior is consistent with automated exfiltration of email, chats, and files.
Detects behavior associated with the TeamFiltration backdoor, where a user account downloads a file from OneDrive, modifies or replaces that file, and re-uploads it within a short timeframe (30 minutes). This pattern is consistent with the 'taint shared content' technique used to distribute malicious files through legitimate cloud storage.
Detects behavior associated with the TeamFiltration backdoor, where a user account downloads a file from OneDrive, modifies or replaces that file, and re-uploads it within a short timeframe (30 minutes). This pattern is consistent with the 'taint shared content' technique used to distribute malicious files through legitimate cloud storage.
Detects behavior associated with the TeamFiltration backdoor, where a user account downloads a file from OneDrive, modifies or replaces that file, and re-uploads it within a short timeframe (30 minutes). This pattern is consistent with the 'taint shared content' technique used to distribute malicious files through legitimate cloud storage.
Detects rapid access to multiple Microsoft 365 collection applications (Office, OneDrive, Teams) by a user account from specific AWS EC2 IP ranges identified as associated with the TeamFiltration tool. This behavior is consistent with automated exfiltration of email, chats, and files.
Detects high-frequency, automated access to mail items via Microsoft Graph API (mail.read/MailItemsAccessed), consistent with automated scanning or exfiltration tools like ARToken's Inbox Monitor. The rule identifies suspicious patterns of repetitive access to mailbox folders or messages that may indicate Business Email Compromise (BEC) or automated credential-based harvesting.
Detects access to Microsoft Graph API endpoints related to mail, contacts, drive, or messages from a device that was registered within the last 24 hours. This behavior may indicate an adversary using stolen session tokens or credentials to access cloud-based email and data shortly after device registration or enrollment.
This rule identifies sustained, low-volume activity (low-and-slow) against Microsoft 365 services (SharePoint, OneDrive, and Exchange) which may indicate an adversary is using automated methods via the Graph API to collect sensitive files or emails over an extended period. The rule buckets events by user and time, requiring a minimum of three hours of activity with consistent but low-volume interactions to identify potential data collection behavior that avoids traditional volume-based detection thresholds.
Detects high-volume, potentially automated data access, collection, or staging activities within Microsoft 365 services (SharePoint, OneDrive, and Exchange). The rule flags user identities performing a high count of operations (downloads, accesses, deletions, or export requests) across a wide range of unique objects or sites within a one-hour window, which is indicative of post-compromise mass data collection or exfiltration preparation.
Detects anomalous, high-volume file download activity from SharePoint or OneDrive initiated through identified anonymous proxy services. This behavior suggests potential data exfiltration by an adversary attempting to mask their source IP address while offloading large amounts of data.
Detects high-volume, automated access and download activity targeting sensitive data within Microsoft 365 services (SharePoint, OneDrive, and Exchange) using the Microsoft Graph API. The rule identifies suspicious patterns of URI access associated with file downloading and mail item access, which may indicate automated data exfiltration by an adversary using compromised credentials or OAuth tokens.
Detects anomalous, high-volume file access and download activity targeting SharePoint or OneDrive. This behavior is identified by the use of the python-httpx User-Agent, which is often associated with automated scripts for data collection and exfiltration in cloud-based intrusions.
Detects an anomalous burst of git clone, fetch, or download events performed by a single GitHub user account against a large number of private repositories within a short timeframe (15-minute window). This pattern often indicates unauthorized bulk collection or exfiltration of sensitive source code by an actor using a valid account.
Page 5 of 18