Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
31 detections
Filters
Last updated
All Time
Detection languages
8
7
7
5
4
Contributors
18
11
1
1
Categories
9
8
7
7
7
Platforms
14
9
6
6
3
Products / Services
11
8
8
6
5
MITRE Techniques
18,108
15,614
12,573
8,384
6,204
IDS Classtypes
4
3
1
IDS Protocols
4
3
1
Detects network activity (TCP, DNS, TLS, HTTP) associated with the UNC6240 threat actor's infrastructure, specifically targeting communications with known malicious IP addresses and domains used in a campaign leveraging PeopleSoft-related lures.
Detects anomalous large-scale data transfers to external endpoints that exhibit patterns characteristic of the ShinyHunters group's SaaS bulk export and data exfiltration methods. The rule identifies suspicious HTTP requests to Salesforce API endpoints (e.g., batch jobs, bulk queries) accompanied by unusually large content payloads, followed by subsequent encrypted communication to non-whitelisted external destinations.
This rule monitors for indicators of compromise (IOCs) associated with the ShinyHunters threat actor, including specific malicious domains, IP addresses, and artifacts found in command lines or event data. It aggregates telemetry from network events, Entra ID sign-in logs, cloud application activity, email logs, process execution, and general device events to detect interaction with known malicious infrastructure or execution of threat-actor specific artifacts.
Detects network activity (TCP, DNS, TLS, HTTP) associated with the UNC6240 threat actor's infrastructure, specifically targeting communications with known malicious IP addresses and domains used in a campaign leveraging PeopleSoft-related lures.
Detects network activity (TCP, DNS, TLS, HTTP) associated with the UNC6240 threat actor's infrastructure, specifically targeting communications with known malicious IP addresses and domains used in a campaign leveraging PeopleSoft-related lures.
Detects anomalous large-volume file download or export activity from cloud repositories (SharePoint, OneDrive, or Salesforce) occurring shortly after a help-desk-mediated credential or MFA reset for the same user. This behavior is indicative of account takeover, specifically vishing-to-exfiltration patterns used by threat actors.
Detects anomalous large-volume file download or export activity from cloud repositories (SharePoint, OneDrive, or Salesforce) occurring shortly after a help-desk-mediated credential or MFA reset for the same user. This behavior is indicative of account takeover, specifically vishing-to-exfiltration patterns used by threat actors.
This rule detects command-and-control (C2) communication patterns associated with the 'soraki-proxy.workers.dev' domain, a Cloudflare Workers-hosted proxy service. Additionally, it identifies potential malicious mTLS implants by flagging non-standard TLS handshakes that use self-signed or auto-generated certificates missing standard organization (O) fields in the subject DN.
This rule detects command-and-control (C2) communication patterns associated with the 'soraki-proxy.workers.dev' domain, a Cloudflare Workers-hosted proxy service. Additionally, it identifies potential malicious mTLS implants by flagging non-standard TLS handshakes that use self-signed or auto-generated certificates missing standard organization (O) fields in the subject DN.
This rule detects command-and-control (C2) communication patterns associated with the 'soraki-proxy.workers.dev' domain, a Cloudflare Workers-hosted proxy service. Additionally, it identifies potential malicious mTLS implants by flagging non-standard TLS handshakes that use self-signed or auto-generated certificates missing standard organization (O) fields in the subject DN.
Page 2 of 2