Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
361 detections
Filters
Last updated
All Time
Detection languages
221
34
32
25
24
Contributors
108
70
66
16
14
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
197
191
116
38
19
Products / Services
210
40
30
29
27
MITRE Techniques
238
171
151
80
77
CVEs
5
IDS Classtypes
4
3
1
IDS Protocols
8
Detects anomalous, high-frequency mailbox search and access activity targeting financial-related keywords (e.g., invoices, wire transfers, bank details). This behavior pattern is frequently observed during business email compromise (BEC) attacks, where adversaries utilize OAuth tokens to triage mailboxes for sensitive payment information.
This rule detects anomalous activity where users access Microsoft 365 services (SharePoint, OneDrive, Exchange) through identified anonymous proxy connections. It identifies potentially malicious exfiltration or bulk activity by flagging users who perform a high number of operations (1,000+ events) or download a significant volume of data (5GB+) within a 2-hour window.
This rule detects anomalous, high-volume file access or download activity across cloud applications and file storage services. It tracks users over a period of time, flagging individuals whose daily activity consistently contributes to a large total volume of data access (exceeding 500MB) over at least five days, specifically looking for sustained behavior that deviates from sudden, single-day spikes.
This rule detects potentially malicious or automated data access patterns within Microsoft 365 or similar cloud environments. It identifies user accounts or applications that exhibit a high volume of file/email access operations across a diverse set of paths, which is often indicative of automated data exfiltration, scraping, or suspicious collection by a compromised identity.
Detects anomalous data access or collection activity across multiple M365 workloads (SharePoint, OneDrive, Exchange). The rule identifies users exhibiting high volumes of file or mail access across at least two distinct workloads within a one-hour window, which may indicate account compromise, bulk data exfiltration, or unauthorized persistence via mailbox rules.
Detects automated file access and download operations in SharePoint or OneDrive performed by the 'python-httpx' library. This behavior may indicate an attacker using scripts or automated tools to perform unauthorized data collection or exfiltration, often observed in automated cloud compromise scenarios.
Detects anomalous, high-volume activity directed at SharePoint and OneDrive Graph API endpoints (e.g., /sites, /drives, /search, /children). The activity pattern, characterized by multiple distinct path requests and the usage of pagination tokens within a short timeframe, strongly indicates an adversary attempting to map the file structure and contents of a repository prior to data collection or exfiltration.
This rule detects high-volume file access, preview, or download activity from SaaS applications (SharePoint, OneDrive, Exchange Online) originating from IP addresses classified as anonymous proxies. The threshold is set to 1000 events within a 2-hour window, which is indicative of automated, high-speed data exfiltration rather than standard user behavior.
Detects anomalous, high-volume enumeration of SharePoint and OneDrive resources via Microsoft Graph API by monitoring for repeated access patterns involving /sites, /drives, or /drive endpoints combined with search, directory traversal, and pagination parameters.
Detects anomalous, high-volume file access (downloading, accessing, or previewing) in cloud applications that originates from an IP address identified as an anonymous proxy. This behavior is indicative of potential data exfiltration or unauthorized mass data collection.
Detects anomalous data access or collection activity across multiple M365 workloads (SharePoint, OneDrive, Exchange). The rule identifies users exhibiting high volumes of file or mail access across at least two distinct workloads within a one-hour window, which may indicate account compromise, bulk data exfiltration, or unauthorized persistence via mailbox rules.
This rule monitors Office 365 activity for anomalous search behavior, specifically targeting high volumes of distinct search queries involving site collections, web structures, or index ID patterns. Such patterns are indicative of automated data discovery or enumeration activities performed against SharePoint or OneDrive environments.
Detects anomalous, large-scale cloning or mirroring of code repositories combined with targeted access to infrastructure-as-code configuration files (e.g., .tfvars, .tfstate) or automated exfiltration of CI/CD build artifacts. This behavior is indicative of an adversary attempting to exfiltrate proprietary source code or sensitive secrets stored within repositories.
Detects anomalous, large-scale cloning or mirroring of code repositories combined with targeted access to infrastructure-as-code configuration files (e.g., .tfvars, .tfstate) or automated exfiltration of CI/CD build artifacts. This behavior is indicative of an adversary attempting to exfiltrate proprietary source code or sensitive secrets stored within repositories.
Detects a user performing a high volume of SharePoint site discovery queries within a one-hour window. This behavior often indicates an adversary attempting to map site structures and discover content across an organization's SharePoint environment.
Detects anomalous, high-volume file access or download operations in SharePoint from a user agent identified as 'python-httpx'. This behavior is characteristic of automated scripts or potential data exfiltration attempts targeting cloud-based file storage.
Detects high-volume file access and download operations in SharePoint Online and OneDrive where the user agent is identified as 'python-httpx'. This behavior is indicative of automated exfiltration scripts potentially used in malicious cloud intrusion campaigns.
Detects high-volume access to Exchange Online mailboxes by a single user from a single IP address using the 'One Outlook Web' application ID, potentially indicating unauthorized automated mailbox data exfiltration.
Detects anomalous data access or collection activity across multiple M365 workloads (SharePoint, OneDrive, Exchange). The rule identifies users exhibiting high volumes of file or mail access across at least two distinct workloads within a one-hour window, which may indicate account compromise, bulk data exfiltration, or unauthorized persistence via mailbox rules.
Detects anomalous data access or collection activity across multiple M365 workloads (SharePoint, OneDrive, Exchange). The rule identifies users exhibiting high volumes of file or mail access across at least two distinct workloads within a one-hour window, which may indicate account compromise, bulk data exfiltration, or unauthorized persistence via mailbox rules.
This rule detects suspicious, high-volume file access or download operations in SharePoint and OneDrive. It filters for activities performed by specific user agents commonly associated with automated scripting tools (e.g., python-requests, Microsoft.Graph.Client), which indicates potential automated exfiltration or unauthorized bulk data collection.
Page 9 of 18