Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,686 detections
Filters
Last updated
All Time
Detection languages
1,342
389
264
219
197
Contributors
620
506
358
209
102
Categories
20,456
11,839
5,876
5,155
4,865
2,686
Platforms
1,168
638
452
382
359
Products / Services
593
445
403
264
229
MITRE Techniques
1,884
787
525
521
510
CVEs
11
5
5
5
3
IDS Classtypes
189
133
34
10
7
IDS Protocols
243
58
33
22
12
Detects the creation or modification of Power Automate Flows that utilize non-Microsoft domains for HTTP or webhook connectors. Adversaries may abuse Power Automate to automate exfiltration or command-and-control tasks by connecting workflows to external malicious endpoints.
Detects instances where language-related processes (amazonq-language-server, node) or common tools (bash, sh, curl, aws) execute commands containing AWS access credentials or perform potential data exfiltration via curl POST requests.
Detects bulk file access, download, or sync operations by a single user account within a 30-minute window in Microsoft SharePoint Online or OneDrive for Business. This behavior is indicative of potential data exfiltration or unauthorized mass collection of sensitive information.
Detects post-compromise activity where an adversary enumerates Domain Admins group memberships using standard Windows utilities (net, net1, nltest, or PowerShell) immediately followed by the use of curl to exfiltrate data via HTTP POST requests to suspicious external infrastructure.
Detects HTTP requests to Microsoft 365 search endpoints containing unusually long query strings. Such patterns may indicate automated data extraction, exfiltration over alternative protocols, or unauthorized information harvesting via search parameters.
This rule detects potential data exfiltration through the Bing Image Search 'search-by-image' feature. It identifies web traffic to Bing that contains an 'imgurl' parameter, decodes the URL, and filters out legitimate Microsoft-related domains. It then flags suspicious, potentially encoded file paths or data structures that might indicate the use of this public service to exfiltrate or host staging data.
This rule detects potential Server-Side Request Forgery (SSRF) exploitation where Bing's 'search by image' functionality is abused to fetch external, non-Microsoft controlled URLs. The query monitors web proxy logs for specific Bing search parameters ('cbir=sbi' and 'imgurl') and filters out requests to trusted domains, effectively identifying attempts to use the search engine as an intermediary for unauthorized external web requests. The rule further correlates these hits with Microsoft Copilot interaction logs to identify if the activity is associated with authenticated Copilot user sessions.
Detects suspicious subprocesses spawned by IDE or extension host processes (like VS Code or Amazon Q) that execute AWS CLI commands to enumerate identity or immediately exfiltrate data via curl/wget, indicating potential credential abuse by malicious plugins or MCP servers.
This rule monitors for malicious Chrome extension activity involving the redirection of address bar inputs to an unauthorized domain (perplexity-ai.online). It identifies indicators of compromise across device network logs (connectivity to the malicious C2), file system events (presence of the identified malicious extension identifier), and generic device events (log entries containing the malicious extension ID or C2 URL). This pattern is indicative of a browser-based keystroke exfiltration attack.
Detects a Node.js process, spawned as a child of an IDE (e.g., VS Code, Cursor), that accesses local AWS configuration or credential files followed by an outbound network connection to a non-AWS destination. This behavior is indicative of potential cloud credential exfiltration via malicious Model Context Protocol (MCP) server execution.
Detects network connections to Zoho WorkDrive or Zoho Accounts from non-standard or suspicious processes. The rule identifies potential unauthorized data exfiltration or cloud access by flagging processes running from temporary or user-writable directories (e.g., AppData, ProgramData), processes known to be associated with specific threats, or processes exhibiting signs of binary sideloading based on their parent process ancestry.
Detects sensitive data posted to text sharing services
Detects exfiltration of data to Dropbox cloud storage
Detects bulk download of Slack messages using the API
Detects Meow RAT (ClickFix campaign) copying Chromium browser extension data directories associated with cryptocurrency wallets, including MetaMask (nkbihfbeogaeaoehlefnkodbefgpgknn), via osascript on macOS.
Detects DNS resolution to attacker-controlled AWS S3 buckets masquerading as Outlook/OneDrive service pages used by UNC6692 for phishing delivery, SNOWBELT C2, and credential exfiltration. The rule specifically looks for DNS queries to S3 domains with patterns indicative of spoofed Outlook/OneDrive service pages or specific known malicious S3 bucket names.
Detects the use of rclone.exe to exfiltrate files to Dropbox, specifically looking for process execution patterns and network connections to Dropbox API endpoints consistent with the Gamaredon PteroBox exfiltration module.
Detects the use of 'curl' with '-X PUT' and '--data-binary' options, which can indicate data exfiltration or staging activities. This combination is often used to upload raw data to a specified endpoint.
Detects the export of Microsoft Teams messages, transcripts, recordings, and chat retrieval activities, particularly when performed via the Graph API. This rule identifies suspicious activity by looking for specific operation names in SaaS audit logs and flags potentially malicious user agents commonly associated with automation tools (e.g., python-requests, axios, go-http, curl, wget, powershell, httpx, aiohttp, node). It also categorizes user agents by risk level (HIGH, MEDIUM, NONE) and extracts relevant details like device IDs, IP addresses, and chat information. This activity can indicate post-compromise attackers using stolen tokens to silently export chat history.
Detects the configuration and usage of personal Microsoft OneDrive accounts on corporate endpoints. This is achieved by monitoring for OneDrive process execution with personal account command-line arguments, OneDrive setup utilities configured with personal tenant identifiers, and file system activity within directory paths associated with personal OneDrive synchronization.
This rule detects outbound network connections to URLs associated with common file sharing services (e.g., Dropbox, Mega, Gofile) or temporary email providers (e.g., Temp-Mail). Such connections can indicate data exfiltration attempts, use of unsanctioned services, or communication with command and control infrastructure.
Page 57 of 128