Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
956 detections
Filters
Last updated
All Time
Detection languages
486
122
65
63
57
Contributors
328
210
131
82
29
Categories
504
436
202
184
173
Platforms
748
270
203
29
24
Products / Services
318
197
48
42
42
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
956
CVEs
4
3
2
2
2
IDS Classtypes
6
6
4
3
IDS Protocols
15
4
This analytic detects the configuration of TFTP services on Cisco IOS devices that could be used to exfiltrate sensitive configuration files. Threat actors like Static Tundra have been observed configuring TFTP servers to make device configuration files accessible for exfiltration after gaining initial access. The detection specifically looks for commands that expose critical configuration files such as startup-config, running-config, and other sensitive system information through TFTP. This activity is particularly concerning as it may represent an attempt to steal credentials, network topology information, and other sensitive data stored in device configurations.
Detects the execution of specific SOQL (Salesforce Object Query Language) queries associated with the UNC6395 data theft campaign. The actor used these queries to enumerate and exfiltrate data from sensitive Salesforce objects.
Detects a sequence of commands on Cisco IOS devices used to capture network traffic, specifically targeting TACACS+ on TCP port 49, and then exfiltrate it. This technique, detailed in a CISA advisory on PRC state-sponsored actors, is used to harvest credentials from network traffic.
This analytic detects the use of Windows command-line copy utilities, such as xcopy, to systematically collect files from user directories and consolidate them into a centralized location on the system. This activity is often indicative of malicious behavior, as threat actors frequently use such commands to gather sensitive information, including documents with .doc, .docx, and .pdf extensions. The detection focuses on identifying recursive copy operations targeting user folders, such as Documents, Desktop, or other directories that commonly store personal or organizational files. Malware that performs this behavior typically attempts to evade detection by using legitimate Windows utilities, executing commands through cmd.exe or other scripting hosts, and writing the collected files to directories like C:\ProgramData or temporary storage locations. Once collected, the information may be staged for exfiltration, used for lateral movement, or leveraged for further compromise of the environment. By monitoring for these types of file collection patterns, security teams can identify suspicious activity early, differentiate between normal administrative tasks and potentially malicious scripts, and prevent sensitive data from being exfiltrated. This analytic is particularly relevant for environments where confidential documents are present and attackers may attempt to harvest them using built-in Windows tools.
The analytic identifies a possible non-common browser process accessing its browser user data profile. This tactic/technique has been observed in various Trojan Stealers, such as SnakeKeylogger, which attempt to gather sensitive browser information and credentials as part of their exfiltration strategy. Detecting this anomaly can serve as a valuable pivot for identifying processes that access lists of browser user data profiles unexpectedly. This detection uses a lookup file `browser_app_list` that maintains a list of well known browser applications and the browser paths that are allowed to access the browser user data profiles.
This rule detects the use of 'esentutl.exe' with specific command-line arguments to extract browser data, particularly from the Windows WebCache. This activity is associated with malware like Qbot, which uses this technique to steal sensitive information from browsers such as Internet Explorer and Microsoft Edge.
One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and Microsoft Edge by using the built-in utility esentutl.exe
Detects the Koi Stealer macOS variant, an infostealer targeting cryptocurrency wallets and sensitive user data. This malware is linked to North Korean threat actors.
This rule detects the creation of a Volume Shadow Copy using PowerShell, specifically looking for the `Win32_ShadowCopy` WMI class and the `.Create()` method with the `ClientAccessible` parameter. Adversaries often use Volume Shadow Copies to access or copy the Active Directory domain database (NTDS.dit) to steal credential information, or other sensitive data from the local system.
This detection identifies access to sensitive system and configuration files on an ESXi host, including authentication data, service configurations, and VMware-specific management settings. Interaction with these files may indicate adversary reconnaissance, credential harvesting, or preparation for privilege escalation, lateral movement, or persistence.
This rule detects suspicious activity where scripting interpreters (node.exe, python.exe, pwsh.exe, powershell.exe) are observed accessing a large number of potentially sensitive files (e.g., .env, secret, wallet, keypair, credential, recovery files, or common document/data file types like .pdf, .docx, .csv, .json, .txt) and subsequently exfiltrating a significant amount of data over the network. It correlates file access events with network outbound traffic from the same process within a 10-minute window, flagging instances where more than 20 distinct sensitive files are accessed and over 500KB of data is sent out.
This detection identifies potential exploitation attempts against Citrix NetScaler appliances vulnerable to CVE-2025-5777 (CitrixBleed 2), focusing on suspicious POST requests and memory spillage in logoff entries.
This detection identifies the use of a remote tool to download virtual machine disk files from a datastore. The NFC protocol is used by management tools to transfer files to and from ESXi hosts, but it can also be abused by attackers or insiders to exfiltrate full virtual disk images.
Detects Odyssey Infostealer, a macOS malware known for stealing sensitive data and establishing persistence. This rule identifies specific strings related to its C2 communication, data theft, and persistence mechanisms.
KQL Query
DEVMAN Ransomware Detection
KQL Query from file: Threat Intelligence Data from Sentinel UEBA
KQL Query from file: Detecting Abuse of Wevtutil.exe in LOLBAS Attacks
Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database).
Used to access information such as the AD FS configuration settings which contains sensitive information used to sign SAML tokens.
Used to access information such as the AD FS configuration settings which contains sensitive information used to sign SAML tokens.
Detects a command used by conti to dump database
'Identifies an export of the ADFS DKM Master Key from Active Directory.
References: https://blogs.microsoft.com/on-the-issues/2020/12/13/customers-protect-nation-state-cyberattacks/,
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html?1
To understand further the details behind this detection, please review the details in the original PR and subequent PR update to this:
https://github.com/Azure/Azure-Sentinel/pull/1562#issue-551542469
https://github.com/Azure/Azure-Sentinel/pull/1512#issue-543053339
'
References: https://blogs.microsoft.com/on-the-issues/2020/12/13/customers-protect-nation-state-cyberattacks/,
https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html?1
To understand further the details behind this detection, please review the details in the original PR and subequent PR update to this:
https://github.com/Azure/Azure-Sentinel/pull/1562#issue-551542469
https://github.com/Azure/Azure-Sentinel/pull/1512#issue-543053339
'
Page 43 of 46