Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
153 detections
Filters
Last updated
All Time
Detection languages
92
19
14
13
6
Contributors
74
30
9
9
8
Categories
20,417
11,806
5,870
5,145
4,864
Platforms
95
47
19
11
5
Products / Services
65
31
31
19
13
MITRE Techniques
54
52
24
19
17
CVEs
16
1
IDS Classtypes
2
1
IDS Protocols
2
1
This rule detects potentially malicious activity within Oracle database audit and alert logs, specifically monitoring for the usage of packages like DBMS_SCHEDULER or UTL_FILE to execute OS commands or manipulate files. It also flags the execution of known exploit scripts or reconnaissance queries commonly associated with database-based attacks and unauthorized data dumping.
Detects anomalous activity originating from Oracle database processes, including the spawning of shell commands via DBMS_SCHEDULER, execution of known attacker staging scripts, and the creation of sensitive output files in temporary directories, which are characteristic of database-level remote code execution or exfiltration attempts.
Detects the execution of the 'moladb_superusers.py' script, which is associated with the MuddyWater threat group for database enumeration.
Detects unauthorized access to manufacturing process historian databases (OSIsoft PI, Honeywell PHD, Aspen IP.21) by non-engineering accounts from unexpected workstations. The rule correlates audit logs showing access to historian systems with sign-in logs for specific applications, identifying users with a high volume of access within a short timeframe.
Detects the creation, alteration, or deletion of a SQL external model that could be used to establish a persistent exfiltration channel. Threat actors can leverage this to send data to an external server whenever a table is updated, particularly when combined with SQL triggers.
Detects the configuration change that enables the 'external rest endpoint' feature in SQL Server 2025. Threat actors can abuse this feature using sp_invoke_external_rest_endpoint to natively exfiltrate data and establish C2 channels.
Detects creation of malicious stored procedures in SQL databases
MSSQL Database DROP Destruction
Suricata
This rule detects attempts to drop a database on an MSSQL server. It specifically looks for the string "DROP DATABASE" in TCP traffic destined for port 1433 (the default MSSQL port). This activity is indicative of data destruction or sabotage.
Detects administrative user management (Create/Alter/Drop) and schema deletion within SAP HANA DB.
This rule detects unauthorized or suspicious direct access to sensitive SAP tables (such as USR02, which contains user credentials) when initiated specifically via an RFC (Remote Function Call) logon connection. This helps identify potential data exfiltration attempts or unauthorized reconnaissance of sensitive SAP security data.
Detects the assignment of administrative privileges or roles within SAP HANA DB.
Detects changes to SAP HANA audit policies (Create, Alter, Drop) which could indicate an attempt to evade logging.
Detects direct access to highly sensitive SAP tables (USR02, PAYR, P0002) via RFC logon. This specifically monitors for potential theft of user hashes (USR02), payroll data (PAYR), or personal employee information (P0002).
Detects the deactivation of the global auditing state in SAP HANA, which stops all audit logging.
The rule detects potential exploitation attempts by identifying a single source IP that generates a high number of connection events (>= 100) but a very low rate of client metadata exchanges (<= 10%). This pattern, combined with a high connection rate, is strong evidence of an anomalous interaction consistent with a network-based vulnerability scan or exploitation attempt.
Detects a series of Salesforce Object Query Language (SOQL) queries indicative of data reconnaissance and exfiltration, similar to techniques used by UNC6395.
This detection identifies when critical SQL Server configuration options are modified, including "Ad Hoc Distributed Queries", "external scripts enabled", "Ole Automation Procedures", "clr enabled", and "clr strict security". These features can be abused by attackers for various malicious purposes - Ad Hoc Distributed Queries enables Active Directory reconnaissance through ADSI provider, external scripts and Ole Automation allow execution of arbitrary code, and CLR features can be used to run custom assemblies. Enabling these features could indicate attempts to gain code execution or perform reconnaissance through SQL Server.
Detects the execution of specific SOQL (Salesforce Object Query Language) queries associated with the UNC6395 data theft campaign. The actor used these queries to enumerate and exfiltrate data from sensitive Salesforce objects.
Detects the invocation of MS SQL transactions that are destructive towards table or database data, such as "DROP TABLE", "DROP DATABASE", or "TRUNCATE TABLE". These operations can lead to data loss and impact system availability.
Suspicious SQL Query
Sigma
Detects suspicious SQL query keywrods that are often used during recon, exfiltration or destructive activities. Such as dropping tables and selecting wildcard fields
This analytic detects when SQL Server loads DLLs to execute extended stored procedures. This is particularly important for security monitoring as it indicates the first-time use or version changes of potentially dangerous procedures like xp_cmdshell, sp_OACreate, and others. While this is a legitimate operation, adversaries may abuse these procedures for execution, discovery, or privilege escalation.
Page 7 of 8