Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
361 detections
Filters
Last updated
All Time
Detection languages
221
34
32
25
24
Contributors
108
70
66
16
14
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
197
191
116
38
19
Products / Services
210
40
30
29
27
MITRE Techniques
238
171
151
80
77
CVEs
5
IDS Classtypes
4
3
1
IDS Protocols
8
This rule monitors Office 365 activity for anomalous search behavior, specifically targeting high volumes of distinct search queries involving site collections, web structures, or index ID patterns. Such patterns are indicative of automated data discovery or enumeration activities performed against SharePoint or OneDrive environments.
Detects automated directory fuzzing attempts against Azure Storage blobs targeting sensitive files like .env, .pem, or configuration files. The rule identifies suspicious activity by aggregating requests from Anonymous or SAS-authenticated sources that exhibit high request volumes and access to multiple distinct sensitive paths, while excluding known legitimate bulk-transfer and synchronization tools.
Detects rapid, bulk cloning or downloading of GitHub repositories containing sensitive data (e.g., consensus algorithms, PII, internal blocklists). This behavior is characteristic of unauthorized data exfiltration, specifically tracking activity involving suspicious OAuth token prefixes (gho_) and rapid high-volume access to sensitive organizational assets within a short timeframe.
Detects rapid, bulk cloning or downloading of GitHub repositories containing sensitive data (e.g., consensus algorithms, PII, internal blocklists). This behavior is characteristic of unauthorized data exfiltration, specifically tracking activity involving suspicious OAuth token prefixes (gho_) and rapid high-volume access to sensitive organizational assets within a short timeframe.
Detects rapid, bulk cloning or downloading of GitHub repositories containing sensitive data (e.g., consensus algorithms, PII, internal blocklists). This behavior is characteristic of unauthorized data exfiltration, specifically tracking activity involving suspicious OAuth token prefixes (gho_) and rapid high-volume access to sensitive organizational assets within a short timeframe.
Detects rapid, bulk cloning or downloading of GitHub repositories containing sensitive data (e.g., consensus algorithms, PII, internal blocklists). This behavior is characteristic of unauthorized data exfiltration, specifically tracking activity involving suspicious OAuth token prefixes (gho_) and rapid high-volume access to sensitive organizational assets within a short timeframe.
Detects the creation and immediate deletion of a GitHub OAuth token that is used to clone or fetch a large volume of private repositories within a short lifespan. This behavior is indicative of an adversary using a temporary, ephemeral token to perform rapid data exfiltration or mass reconnaissance on source code repositories.
Detects the creation and immediate deletion of a GitHub OAuth token that is used to clone or fetch a large volume of private repositories within a short lifespan. This behavior is indicative of an adversary using a temporary, ephemeral token to perform rapid data exfiltration or mass reconnaissance on source code repositories.
Detects the creation and immediate deletion of a GitHub OAuth token that is used to clone or fetch a large volume of private repositories within a short lifespan. This behavior is indicative of an adversary using a temporary, ephemeral token to perform rapid data exfiltration or mass reconnaissance on source code repositories.
Detects the creation and immediate deletion of a GitHub OAuth token that is used to clone or fetch a large volume of private repositories within a short lifespan. This behavior is indicative of an adversary using a temporary, ephemeral token to perform rapid data exfiltration or mass reconnaissance on source code repositories.
Detects high-frequency access requests to SharePoint or OneDrive services using the 'python-httpx' library. This behavior is indicative of automated scraping or mass data retrieval often associated with malicious actors or unauthorized automated tools.
Detects users accessing files across SharePoint, OneDrive, or Exchange over a sustained period of at least 6 hours, while maintaining a low-to-moderate frequency (1-999 events per hour). This behavioral pattern may indicate slow, automated data exfiltration or unauthorized reconnaissance of sensitive files while attempting to stay under traditional volume-based alerting thresholds.
Detects anomalous, high-frequency file access (100+ files within a 2-hour window) in Microsoft 365 (SharePoint or OneDrive) by users employing a Python-based HTTP client (python-httpx). This behavior is often indicative of automated data scraping, exfiltration, or bulk download activities performed by unauthorized scripts or compromised service accounts.
Detects file access or download operations performed by the python-httpx library within a specific cloud application context, which may indicate automated data retrieval or exfiltration attempts by scripts or custom tools.
Detects high-volume file download or data access events across SharePoint, OneDrive, and Exchange Online. This rule monitors for requests from Python-based HTTP libraries (httpx, requests, urllib) targeting Microsoft Graph API endpoints, which is a pattern indicative of automated bulk data collection or exfiltration, often observed in campaigns like Storm-3121 or Storm-3032.
Detects instances where identified AI agents, bots, or automated assistants perform bulk access operations on mailboxes (e.g., MailItemsAccessed, Send, deletions) or data stores (e.g., FileDownloaded, FileAccessed, SearchQueryPerformed) in Microsoft 365 environments. This monitors for potentially compromised or malicious AI service accounts abusing legitimate access to harvest sensitive data.
This rule monitors Office 365 file download activity, identifying users whose download volume significantly deviates from their historical baseline. It specifically looks for an unusually high number of unique files downloaded in a one-hour window, while excluding known service accounts and synchronization agents like OneDrive sync client.
Detects anomalous, large-scale cloning or mirroring of code repositories combined with targeted access to infrastructure-as-code configuration files (e.g., .tfvars, .tfstate) or automated exfiltration of CI/CD build artifacts. This behavior is indicative of an adversary attempting to exfiltrate proprietary source code or sensitive secrets stored within repositories.
Detects 'GetBlob' operations on Azure Storage blobs that have extensions commonly associated with executable files, scripts, or archives, which may indicate the retrieval of malicious payloads.
Detects unauthorized access and data retrieval attempts from a MinIO object storage instance using default administration credentials (minioadmin:minioadmin). The rule monitors both command-line execution of MinIO client (mc) operations and network connections to MinIO service ports (9000/9001) that involve the use of the default credential pair.
Detects unauthorized access and data retrieval attempts from a MinIO object storage instance using default administration credentials (minioadmin:minioadmin). The rule monitors both command-line execution of MinIO client (mc) operations and network connections to MinIO service ports (9000/9001) that involve the use of the default credential pair.
Page 8 of 18