Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,686 detections
Filters
Last updated
All Time
Detection languages
1,342
389
264
219
197
Contributors
620
506
358
209
102
Categories
20,456
11,839
5,876
5,155
4,865
2,686
Platforms
1,168
638
452
382
359
Products / Services
593
445
403
264
229
MITRE Techniques
1,884
787
525
521
510
CVEs
11
5
5
5
3
IDS Classtypes
189
133
34
10
7
IDS Protocols
243
58
33
22
12
Detects exfiltration of sensitive data pushed to GitHub repositories
Detects large data transfers occurring outside normal business hours
This rule detects rapid access to specific classified document types (.doc, .docx, .pdf, .xls) followed by network egress to identified C2 structures within a 5-minute window. It correlates file access events for sensitive document types with subsequent network connections initiated by the same process on the same device.
Correlates the targeted reading of USERDNSDOMAIN and COMPUTERNAME environment variables with network connections to a known malicious domain (kleymarket.ru), indicating potential data exfiltration by the Silent Rotor malware.
Identifies rapid retrieval of dozens of secrets from Azure Key Vaults within minutes by a single identity. This behavior can indicate an attacker attempting to exfiltrate credentials or sensitive information after gaining initial access to an Azure environment.
This rule detects a high volume of HTTP requests to Salesforce API endpoints associated with bulk data queries. Specifically, it looks for 20 or more requests within a 60-second window from a single source IP to 'salesforce.com' with URI paths containing both '/services/data/' and '/query/'. This pattern suggests a potential bulk download of customer records or other data via the Salesforce API.
This rule detects an unusual spike in 'Export' or 'Download' operations within Azure Activity logs by a single caller. It triggers when a user performs 5 or more such operations within an hour, which could indicate data exfiltration attempts or suspicious data access patterns.
Udm Mail Raw Ip Https
YARA-L
This rule detects network connections made by processes commonly associated with mail collection, archiving, or data export (e.g., mail, archive, collector, export, rclone, winscp, curl executables). The detection specifically looks for these processes making HTTPS connections where the command line contains keywords related to email data files (.pst, .ost) or email processing (aspose.email, mailbox). The rule aims to identify potential exfiltration or collection of email data over HTTPS.
Detects bulk export of Confluence wiki content
This rule detects repeated access attempts (read or write) to files or directories commonly associated with software build artifacts (e.g., 'build', 'release', 'artifact', 'bin', 'dist'). It specifically looks for Security Event ID 4656, which indicates a handle to an object was requested, and filters out common system accounts to focus on user-initiated access. A high number of access attempts (5 or more) within an hour by a non-system user to these sensitive object names could indicate an attempt to compromise or exfiltrate software supply chain components.
Detects transmission of a bitmask representing environment checks to the C2.
This rule tracks the execution of a file named 'uds.exe' and subsequently monitors for any network connections initiated by this process within a 10-minute window of its creation. This behavior is indicative of a compiled payload attempting unauthorized network exfiltration shortly after dynamic compilation, as observed in the 'Operation SilentCanvas' campaign.
This rule detects the attempted extraction of Slack API tokens (specifically 'xoxb-' prefixed tokens) from process command lines, combined with network activity to a specific IP address (216.126.225.129). This combination suggests an attempt to harvest and exfiltrate Slack tokens, potentially by the Megalodon CI/CD malware.
Detects suspicious activity involving the upload of multiple unique packages to common CI/CD package repositories (like npmjs, pypi, Artifactory, Nexus, Maven) from a single device within a short timeframe. This could indicate a compromised build server or developer account attempting to inject malicious dependencies into the software supply chain.
This rule detects reconnaissance activity targeting sensitive employee information within Microsoft Graph. Specifically, it looks for 'Directory.Read.All' actions in Microsoft Graph events where the raw event data contains keywords like 'jobTitle' or 'displayName' and also includes terms such as 'payroll', 'hr', 'finance', or 'admin'. This combination suggests an attacker is attempting to enumerate or collect information about employees in sensitive departments, potentially for purposes like payroll hijacking or social engineering.
This rule detects reconnaissance activity targeting sensitive employee information within Microsoft Graph. Specifically, it looks for 'Directory.Read.All' actions in Microsoft Graph events where the raw event data contains keywords like 'jobTitle' or 'displayName' and also includes terms such as 'payroll', 'hr', 'finance', or 'admin'. This combination suggests an attacker is attempting to enumerate or collect information about employees in sensitive departments, potentially for purposes like payroll hijacking or social engineering.
This rule detects when a GitHub workflow branch is deleted shortly after build artifacts were downloaded. This behavior can indicate an attacker attempting to hide their tracks after exfiltrating secrets or sensitive information from build artifacts. It is crucial to preserve logs and investigate who deleted the branch. Further investigation should include questioning the user about recent software installations or clicked links, and involving the security team if the answers are unclear.
Detects the creation or alteration of a SQL trigger that utilizes sp_invoke_external_rest_endpoint. Attackers can abuse database triggers to automatically exfiltrate newly added credentials or sensitive records in real-time.
Detects pythonw.exe establishing a connection to the Vidar C2 domains and sending a significant byte count, confirming credential exfiltration.
Detects PHP or web server processes launching command-line database clients. INFINITERED collected database credentials and supported arbitrary SQL execution against compromised REDCap environments. Direct database-client execution by a web-serving process is uncommon and may indicate credential access, data collection, or backdoor command execution.
Detects bulk file reading from network shares for data collection
Page 81 of 128