Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,686 detections
Filters
Last updated
All Time
Detection languages
1,342
389
264
219
197
Contributors
620
506
358
209
102
Categories
20,453
11,838
5,876
5,154
4,865
2,686
Platforms
1,168
638
452
382
359
Products / Services
593
445
403
264
229
MITRE Techniques
1,884
787
525
521
510
CVEs
11
5
5
5
3
IDS Classtypes
189
133
34
10
7
IDS Protocols
243
58
33
22
12
This rule detects potentially malicious mailbox search and item access activity in Microsoft 365. It monitors for users who trigger both 'Search' and 'MailItemsAccessed' actions within a one-hour window. The detection logic flags behavior that includes a high volume of mail access (more than 10 events) or access originating from multiple distinct IP addresses, which are common indicators of automated collection or credential compromise.
Detects Google Workspace bulk export/Takeout activity occurring shortly after an OAuth grant or app-password creation, or an unusual volume of export/download events, consistent with automated Gmail/Docs/Keep data exfiltration.
Detects high-risk user behavior associated with unsanctioned or restricted Generative AI applications, specifically targeting large data uploads (potential data exfiltration) or repeated access following a coaching intervention.
This rule detects data synchronization activities between sanctioned enterprise applications and unsanctioned or personal cloud applications using Netskope logs. This pattern often indicates potential shadow IT usage or unauthorized data exfiltration from controlled environments to personal storage services.
Detects DLP events from Netskope where sensitive data (PII, PCI, Source Code, or Credentials) is being uploaded or shared, indicating potential data exfiltration.
Detects instances where sensitive or organizational data is uploaded to public text storage repositories like Pastebin or GitHub Gists through Netskope, which may indicate data exfiltration.
Detects bulk SharePoint/M365 file access or download either from a known UNC6671 exfiltration IP, or via a scripting-library user agent that is new for the user and exceeds a volume threshold within a short session window.
Detects potentially unauthorized or suspicious file activities such as bulk downloads, external file sharing, or CASB policy violations monitored by Zscaler ZIA, which may indicate data exfiltration or policy non-compliance.
Detects users who have downloaded more than 50 files from cloud storage applications within a single hour, potentially indicating data exfiltration or mass data harvesting.
Detects potential data exfiltration attempts using PowerShell by identifying Invoke-WebRequest usage with specific flags (Put, ContentType, InFile) or encoding patterns (EncodedCommand) while targeting sensitive file extensions, directories, or suspicious network destinations.
Detects instances where a single user account performs a large volume of file downloads (50 or more unique files) within a 30-minute window from Office 365 services. This behavior may indicate unauthorized data exfiltration or mass collection of sensitive information.
This one's the interesting bit they're using Ethereum RPC calls as a C2channel and dumping stolen secrets to attacker-owned public repos tagged "Shai-Hulud: Here We Go Again". Also flags Claude/VS Code config file writes dropped by the worm for lateral persistence across dev machines.
This hunting query detects potential data exfiltration by identifying users whose outbound data volume to cloud storage and messaging platforms: (OneDrive, Dropbox, Google Drive, SharePoint, Telegram) spikes dramatically compared to their own historical behavior.
It uses a per-user adaptive baseline approach rather than static thresholds, making it more resilient to normal variance in user upload habits while still flagging statistically abnormal spikes.
MITRE ATT&CK Mapping
Tactic: Exfiltration (TA0010)
Technique: T1567 – Exfiltration Over Web Service
Sub-technique T1567.002 – Exfiltration to Cloud Storage
Data Source
DeviceNetworkEvents (Microsoft Defender for Endpoint / Microsoft 365 Defender advanced hunting schema)
Logic Breakdown:
Baseline window (31 days, excluding the most recent day):
The query calculates each user's average daily upload volume (BytesSent) to a defined set of cloud storage/messaging destinations over the trailing 31 days, ending 1 day ago. This establishes a personal historical norm per user.
Global peer baseline fallback:
For users with little or no prior upload history (average below minBaselineFloor = 1 MB), the query substitutes a global average across all users (globalPeerBaseline) — or the 1 MB floor, whichever is higher — to avoid division-by-near-zero producing artificially inflated ratios for low-activity users.
Today's upload volume:
Sums BytesSent to the same destination patterns over the last 24 hours per user.
Ratio comparison:
Joins today's upload volume against each user's effective baseline and computes UploadRatio = TodayUpload / EffectiveBaseline.
Alert conditions (both must be true):
UploadRatio > 5 — today's upload is more than 5x the user's normal daily average.
TodayUpload > minUploadFloor (100 MB) — an absolute floor ensuring small, low-value increases (e.g., 1 KB → 6 KB) don't trigger noise alerts even if the ratio is high.
Output: Results sorted by UploadRatio descending, surfacing the most anomalous users firs
It uses a per-user adaptive baseline approach rather than static thresholds, making it more resilient to normal variance in user upload habits while still flagging statistically abnormal spikes.
MITRE ATT&CK Mapping
Tactic: Exfiltration (TA0010)
Technique: T1567 – Exfiltration Over Web Service
Sub-technique T1567.002 – Exfiltration to Cloud Storage
Data Source
DeviceNetworkEvents (Microsoft Defender for Endpoint / Microsoft 365 Defender advanced hunting schema)
Logic Breakdown:
Baseline window (31 days, excluding the most recent day):
The query calculates each user's average daily upload volume (BytesSent) to a defined set of cloud storage/messaging destinations over the trailing 31 days, ending 1 day ago. This establishes a personal historical norm per user.
Global peer baseline fallback:
For users with little or no prior upload history (average below minBaselineFloor = 1 MB), the query substitutes a global average across all users (globalPeerBaseline) — or the 1 MB floor, whichever is higher — to avoid division-by-near-zero producing artificially inflated ratios for low-activity users.
Today's upload volume:
Sums BytesSent to the same destination patterns over the last 24 hours per user.
Ratio comparison:
Joins today's upload volume against each user's effective baseline and computes UploadRatio = TodayUpload / EffectiveBaseline.
Alert conditions (both must be true):
UploadRatio > 5 — today's upload is more than 5x the user's normal daily average.
TodayUpload > minUploadFloor (100 MB) — an absolute floor ensuring small, low-value increases (e.g., 1 KB → 6 KB) don't trigger noise alerts even if the ratio is high.
Output: Results sorted by UploadRatio descending, surfacing the most anomalous users firs
This rule detects anomalous, high-volume file access activity within SharePoint by monitoring the 'FileAccessed' operation. It calculates a 14-day rolling baseline for each user and triggers an alert when the hourly 'FileAccessed' count significantly exceeds this baseline, specifically when no corresponding 'FileDownloaded' events are present. This behavior aims to detect stream-based data exfiltration techniques that bypass standard download-based DLP controls.
Detects anomalous spikes in per-user M365 (SharePoint and Exchange) activity volume by comparing current 15-minute intervals against a 30-day rolling baseline (mean + 3 standard deviations). This behavior may indicate mass data staging or exfiltration activities common in precursor phases of extortion or data theft.
This rule detects high-volume file access or download operations in SharePoint or OneDrive, performed by non-browser user agents (e.g., Python, PowerShell, cURL, Go). An elevated volume of such actions within a short timeframe is indicative of automated, scripted interaction, which may represent malicious data exfiltration, automated content scraping, or potential account compromise.
Detects potentially unauthorized or suspicious file activities such as bulk downloads, external file sharing, or CASB policy violations monitored by Zscaler ZIA, which may indicate data exfiltration or policy non-compliance.
This rule detects data synchronization activities between sanctioned enterprise applications and unsanctioned or personal cloud applications using Netskope logs. This pattern often indicates potential shadow IT usage or unauthorized data exfiltration from controlled environments to personal storage services.
This rule detects potential data exfiltration via email by identifying mass near-identical background-image URLs in the body of an email. The rule looks for a high volume (8+) of distinct URLs that contain short parameters (indicative of encoded or smuggled data) within a single email. It further refines the detection by checking for the presence of specific CSS-like syntax often used in CSS-injection keylogging techniques to force the browser or email client to send background-image requests.
This rule detects potential credential or sensitive file theft from VS Code extensions or configuration folders, followed closely by network exfiltration to the Telegram API. It specifically monitors file access to common paths (.ssh/id_rsa, .aws/credentials, .netrc, Local Storage, etc.) by VS Code processes, correlated with non-Telegram processes establishing network connections to api.telegram.org within a 10-minute window.
This rule monitors GCP VPC Flow logs for potential command and control (C2) or data exfiltration activity by identifying internal-to-external network connections that exhibit high novelty. It calculates the percentage of new destination IP addresses contacted by internal source IPs within a single day. Alerts are triggered when a source IP initiates connections to at least 20 unique external destinations, where at least 20% of those destinations have never been contacted by that source in the previous day. This behavioral analysis is designed to detect reconnaissance, scanning, or large-scale data exfiltration patterns.
Page 44 of 128