Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
159 detections
Filters
Last updated
All Time
Detection languages
91
23
18
7
7
Contributors
46
40
17
14
9
Categories
20,402
11,796
5,865
5,145
4,864
Platforms
73
63
17
16
10
Products / Services
52
41
27
26
25
MITRE Techniques
48
46
37
28
27
CVEs
11
3
3
2
1
IDS Classtypes
6
1
IDS Protocols
7
Detects anomalous activities targeting SaaS CRM applications (Salesforce, Microsoft Dynamics 365, HubSpot), including high-volume bulk exports, off-hours access, mass API queries for sensitive objects, and suspicious OAuth token grants.
Detects the use of OSQL.EXE to interact with Microsoft SQL Server databases and redirect query results—such as user tables or credential data—to files on disk. This activity is consistent with data collection and staging efforts used by threat actors to exfiltrate database contents.
This rule detects scenarios where an Oracle database process (or associated service processes) spawns potentially malicious OS-level child processes, such as shells, network utilities, or script execution. This behavior is highly indicative of abuse of Oracle features like DBMS_SCHEDULER or UTL_FILE to execute arbitrary commands, perform network reconnaissance, or stage exploit payloads.
Detects anomalous activities targeting SaaS CRM applications (Salesforce, Microsoft Dynamics 365, HubSpot), including high-volume bulk exports, off-hours access, mass API queries for sensitive objects, and suspicious OAuth token grants.
Detection rule monitoring for indicators of compromise related to SolarWinds Serv-U, including anomalous Content-Encoding headers, unexpected child process execution, large file staging indicative of data exfiltration (Cl0p-style), outbound exfiltration, SQL injection artifacts, and unauthorized LDAP/Active Directory object enumeration by the Serv-U process.
Detects unauthorized attempts to access or interact with the Veeam Backup database, including psql.exe direct queries, PowerShell scripts attempting to decrypt credentials using DPAPI, and encoded PowerShell commands launched from cmd.exe that target the Veeam environment.
Detects the use of the legacy OSQL.exe utility to connect to a local SQL server instance and execute a query that writes output to a file. This behavior is indicative of manual data discovery or exfiltration from a local database.
Detects the use of osql.exe or sqlcmd.exe to query database schema information (such as sys.objects, sys.tables, or INFORMATION_SCHEMA) with output redirected to a file. This behavior is flagged when launched from non-standard parent processes, specifically those commonly associated with web shell activity like w3wp.exe, suggesting post-exploitation database discovery.
Detects unauthorized execution of Oracle DBMS_SCHEDULER jobs combined with UTL_FILE output retrieval, a TTP observed in Operation Escaneo. The rule identifies suspicious command lines involving common database-layer exploitation scripts, manipulation of DBMS_SCHEDULER jobs, and interaction with the /tmp directory to exfiltrate or read command outputs.
This rule detects potentially malicious activity within Oracle database audit and alert logs, specifically monitoring for the usage of packages like DBMS_SCHEDULER or UTL_FILE to execute OS commands or manipulate files. It also flags the execution of known exploit scripts or reconnaissance queries commonly associated with database-based attacks and unauthorized data dumping.
Detects high-volume SQL UPDATE operations indicating data manipulation attack
Detects high-volume database record modifications
Detects the execution of OSQL.EXE to perform a database table dump to a file on the local system. The rule specifically monitors for OSQL connecting to a local SQL instance (localhost or 127.0.0.1) and utilizing the output flag (-o) to save query results to a file with a .sql extension, which is a common indicator of unauthorized data staging or collection.
Detection rule monitoring for indicators of compromise related to SolarWinds Serv-U, including anomalous Content-Encoding headers, unexpected child process execution, large file staging indicative of data exfiltration (Cl0p-style), outbound exfiltration, SQL injection artifacts, and unauthorized LDAP/Active Directory object enumeration by the Serv-U process.
Detects the use of the legacy osql.exe command-line tool to execute SQL queries against a local SQL server. This behavior is often associated with automated maintenance tasks but can be abused by adversaries for data discovery or exfiltration.
Detects execution of the OSQL.EXE utility with command-line arguments indicative of database enumeration or unauthorized file operations, specifically targeting local SQL server instances.
Detects suspicious usage of the OSQL.EXE command-line utility, often associated with database enumeration or interaction. The rule identifies instances where OSQL queries local databases for user information, exports results to file paths, or is executed from suspicious parent processes like web shells (w3wp.exe or cmd.exe).
Detects unauthorized OS command execution initiated via Oracle DBMS_SCHEDULER jobs, often involving UTL_FILE for output retrieval. This behavior is indicative of RCE attempts against database servers.
This rule detects unauthorized attempts to extract credentials from the Veeam Backup and Replication PostgreSQL database. It identifies malicious activity involving the use of PowerShell to interact with the database, including direct psql.exe command line execution, PowerShell scripts referencing sensitive database keywords, WMI-spawned PowerShell processes, and network connections to the PostgreSQL service port (5432).
Detects unauthorized access to the Veeam Backup PostgreSQL database to extract credentials, a technique observed in Akira ransomware campaigns. The rule monitors for suspicious execution of psql.exe or PowerShell scripts designed to query the 'VeeamBackup' database for credentials, which are subsequently decrypted using DPAPI.
Detects the use of the PostgreSQL client utility (psql.exe) to directly query the VeeamBackup database for credential information. This behavior is indicative of unauthorized attempts to extract encrypted backup credentials, which may be subsequently decrypted using DPAPI.
Page 6 of 8