Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
189 detections
Filters
Last updated
All Time
Detection languages
95
36
19
18
10
Contributors
35
34
27
18
13
Categories
20,402
11,796
5,865
5,145
4,864
Platforms
58
49
41
22
22
Products / Services
38
30
18
17
13
MITRE Techniques
90
44
34
28
25
CVEs
6
2
2
1
1
IDS Classtypes
14
8
6
3
1
IDS Protocols
20
9
4
1
Identifies the execution of wget.exe or curl.exe with command-line flags indicative of file uploads (specifically archives like zip, rar, or 7z), which may be used by adversaries to exfiltrate staged data to remote infrastructure.
Detects rapid high-volume file and messaging operations across multiple Microsoft 365 services (SharePoint, OneDrive, Teams, Exchange) within a compressed 10-minute window. This behavior can indicate data exfiltration or collection by an adversary.
Detects the use of weaponized GitHub Actions workflows (e.g., impersonating 'Run Copilot' or 'Dependabot Updates') designed to exfiltrate CI/CD secrets via artifacts, as observed in the Miasma/Mini Shai-Hulud supply chain campaign.
Detects anomalous bulk publication of NPM packages by a specific compromised maintainer account (czirker) targeting the LeoPlatform and LeoInsights organizations, indicative of malicious propagation behavior similar to the Miasma worm.
Detects attempts to upload files to the SharePoint master page gallery using a POST request. This activity can be indicative of an attacker attempting to establish persistence or deface the SharePoint site by modifying its core components. The rule specifically looks for requests to '_layouts/15/Upload.aspx' or '_layouts/Upload.aspx' with 'RootFolder' and 'List' parameters containing '_catalogs/masterpage' or directory traversal sequences ('../').
Detects anomalous, high-volume npm package publication patterns from a single user account within a 5-minute window. This behavior is indicative of automated worm propagation or supply chain attacks using compromised developer tokens, specifically identified by high-frequency 'publish' events.
Detects unauthorized npm package publication events triggered by specific compromised maintainer accounts (czirker, llxlr) associated with the Miasma/Mini Shai-Hulud supply chain attack campaign, specifically targeting LeoPlatform or Verana Blockchain related packages.
Detects anomalous activity consistent with the IronWorm threat actor using compromised CI credentials to perform npm package publishing. The rule identifies a sequence of two events from the same source IP within a 10-minute window: first, an OIDC identity token exchange request at the npm registry, followed by a package publish operation (PUT request). This behavior is characteristic of malicious actors hijacking CI/CD pipelines to inject malicious code into trusted npm packages.
Detects instances of npm package publication events initiated by known-compromised maintainer accounts (czirker, llxlr). These accounts have been identified as being used to distribute malicious packages, such as leo-aws versions, representing a software supply chain compromise.
Detects malicious npm package propagation indicative of the Miasma/Mini Shai-Hulud worm. The rule identifies suspicious patterns in AuditLogs, specifically burst npm publishes by known malicious actors or involving known malicious package names, as well as the use of weaponized GitHub Actions workflows or unauthorized snapshot branches.
Detects a rapid burst of file upload activity to cloud storage applications from a single account, including unusual proxy or device context. This rule identifies scenarios where an account performs 20 or more upload events or uploads 20 or more distinct objects within a 15-minute time window to common cloud storage services like Google Drive, Dropbox, Box, MEGA, OneDrive, or ShareFile. It also highlights if any of these uploads originate from an anonymous proxy.
Detects WinSCP command-line use that performs scripted uploads, synchronisation, or non-interactive transfer, which could indicate data exfiltration or automated file transfers.
This rule detects internal HTTP PUT requests that contain the 'MZ' header, which is indicative of an executable file. This combination suggests a possible lateral movement scenario where an attacker is transferring a tool or malware within the internal network using HTTP PUT.
Detects an anomalous volume of NPM package publications by specific users associated with internal naming conventions (leo-*, @leoplatform/*, verana-blockchain*). The rule identifies potential supply chain compromise attempts by monitoring for burst activity (3+ publishes or 3+ unique packages within a 10-second window).
This rule detects the execution of cloud transfer tools such as rclone, WinSCP, Dropbox, OneDrive, or curl.exe when their command line arguments indicate the transfer of mailbox-related files (PST, OST, or temporary files with 'ts_' prefix) and include keywords like 'copy', 'sync', 'put', 'upload', or 'transfer'. The rule focuses on the causality chain to identify the actor and processes involved in such activities, which could indicate data exfiltration.
Detects the uploading of a plugin matching known disguised slugs ('content-delivery-helper' or 'database-optimizer') used by attackers to install backdoors after establishing a rogue admin account in WordPress environments. This rule specifically targets POST requests to the WordPress plugin update endpoint with these malicious plugin names in the query string.
Detects a non-Discord process preparing multipart attachment data from a local path for upload through a messaging API. This behavior is indicative of malware like EchoCreep exfiltrating data via messaging platforms.
Detects PHP or web server processes launching tools commonly used to download or upload files. This activity can indicate a web shell or other compromise where an attacker is attempting to transfer files to or from the compromised server. Investigate the transferred destination, remote endpoint, and whether the activity occurred during an approved deployment.
Detects a non-OneDrive client invoking createUploadSession after creating staged command output or archives, indicative of GraphWorm activity.
Detects upload of malicious payloads to file hosting services for staging
This rule detects users uploading a high volume of files (50 or more within an hour) to SharePoint or OneDrive. This activity could indicate data exfiltration or unauthorized mass data transfer.
Page 6 of 9