Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
153 detections
Filters
Last updated
All Time
Detection languages
92
19
14
13
6
Contributors
74
30
9
9
8
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
95
47
19
11
5
Products / Services
65
31
31
19
13
MITRE Techniques
54
52
24
19
17
CVEs
16
1
IDS Classtypes
2
1
IDS Protocols
2
1
Correlates per-device reads of .env secret files by utility commands (such as cat, grep, findstr) with subsequent or preceding Prisma Studio or database activity within a 30-minute window, indicating potential credential theft or unauthorized database management tool usage.
Detects when a user performs a bulk data download (large volume of data) shortly after accessing restricted or sensitive SAP objects such as sensitive tables, ABAP programs, or transactions.
Detects when a dialog user reads a restricted SAP table using generic table browser transactions such as SE11, SE16, or SE16N.
This detection identifies potentially suspicious usage of sqlcmd.exe, focusing on command patterns that may indicate data exfiltration, reconnaissance, or malicious database operations. The detection looks for both short-form (-X) and long-form (--flag) suspicious parameter combinations, which have been observed in APT campaigns targeting high-value organizations. For example, threat actors like CL-STA-0048 have been known to abuse sqlcmd.exe for data theft and exfiltration from compromised MSSQL servers. The detection monitors for suspicious authentication attempts, output redirection, and potentially malicious query patterns that could indicate unauthorized database access or data theft.
This rule detects a potential brute force attack against the Microsoft SQL Server 'sa' administrative account. It identifies a high volume of failed authentication events (Event ID 18456) for the 'sa' account within a 10-minute window, followed by a successful authentication event (Event ID 18453 or 18454) from the same source IP address. The rule specifically filters for successful logins originating from non-private (internet-facing) IP addresses, suggesting an attempt from an external threat actor.
Detects unauthorized attempts to access exposed Chroma or Weaviate vector database APIs via standard HTTP requests (GET/POST) targeting known API endpoints for collections or objects. This may indicate an adversary conducting reconnaissance on publicly accessible database infrastructure.
Detects an AI agent or automated process that accesses sensitive data sources (such as vaults, databases, or documentation platforms) followed by an outbound HTTP POST request to known high-risk SaaS or web services (e.g., paste sites, file sharing, or webhook services) with a suspicious or large payload.
Detects Salesforce Experience Cloud guest user sessions performing queries or reads on objects not within the authorized allowlist. This behavior, characterized by an abnormal volume of records retrieved or anomalous query patterns, is consistent with attempts to exploit misconfigured guest profile permissions to access internal sensitive data.
Detects anomalous database activity on Magento e-commerce platforms where a SELECT operation against sensitive payment-related tables is followed by a DELETE operation on the same table within the same host context. This sequence is indicative of an attacker exfiltrating credit card data and subsequently attempting to remove forensic evidence of the theft.
Detects high-risk destructive database operations (DROP, TRUNCATE, or UPDATE) on sensitive tables executed within six hours of a large outbound data transfer from the same host, a pattern indicative of anti-forensic database wiping following data exfiltration.
Detects autonomous AI coding-agent processes (e.g., Claude Code, Cursor, Aider) spawning shell or git processes to perform potentially destructive actions such as recursive file deletion, forced git pushes, database manipulation, or unauthorized access to sensitive credential files, indicating agentic 'excessive agency' or compromise.
Detects abnormal bulk API operations (upsert, batch updates, or deletions) targeting vector database or Retrieval-Augmented Generation (RAG) knowledge stores. This activity is flagged when performed by non-authorized service identities or when ingestion volume exceeds a specific threshold within a short timeframe, potentially indicating an attempt to poison the agent's memory store or retrieval corpus to facilitate indirect prompt injection.
Detects an AI agent identity accessing an unusually high number of distinct internal repositories, such as wikis, ticketing systems, code repositories, or customer data stores within a 15-minute window. This behavior is consistent with automated discovery or collection (T1213) by an AI agent.
Detects a single Salesforce user or connected-app session performing an anomalous volume of SOQL queries against sensitive objects including Case, Account, Contact, and Opportunity. This behavior is indicative of mass data enumeration and potential exfiltration, as observed in historical incidents where attackers targeted CRM platforms to extract embedded secrets and sensitive record data.
Detects high-volume database or CRM read activity performed by a user, followed by significant outbound network traffic to known public cloud storage, file-sharing, or messaging services. This pattern is consistent with data staging and exfiltration behaviors often attributed to the ShinyHunters threat actor group.
Detects AI agent tooling (e.g., LangChain, Copilot, Claude Code) performing read operations on databases containing sensitive data patterns, or performing suspicious bulk data enumeration. The rule monitors Azure SQL Database security audit events for suspicious application name signatures and non-schema introspective queries.
Detects AI agent tooling (e.g., LangChain, Copilot, Claude Code) performing read operations on databases containing sensitive data patterns, or performing suspicious bulk data enumeration. The rule monitors Azure SQL Database security audit events for suspicious application name signatures and non-schema introspective queries.
Detects a successful authentication to Microsoft SQL Server using the 'sa' account from a non-local address. This rule is designed to alert on potentially unauthorized access following a brute-force attack, as identified by the correlation of high-volume authentication failures (Event ID 18456) followed by a successful login (Event ID 18453/18454).
Detects AI agent tooling (e.g., LangChain, Copilot, Claude Code) performing read operations on databases containing sensitive data patterns, or performing suspicious bulk data enumeration. The rule monitors Azure SQL Database security audit events for suspicious application name signatures and non-schema introspective queries.
Detects unauthorized or anomalous write operations (upsert/insert) to a vector database, which could indicate a Retrieval-Augmented Generation (RAG) injection attack. The rule monitors for writes from non-sanctioned identities, operations outside of established maintenance or ingestion windows, or entries that lack necessary provenance metadata such as source document IDs or content hashes.
Detects bulk insertions or content updates into vector databases, document stores, or knowledge bases that contain suspected instruction-override, jailbreak, or role-hijacking phrases, particularly when performed by unauthenticated or unknown identities.
Page 1 of 8