Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
226 detections
Filters
Last updated
All Time
Detection languages
156
25
12
9
7
Contributors
51
37
26
19
14
Categories
189
46
44
31
26
Platforms
108
39
34
32
30
Products / Services
67
43
22
16
15
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
5
1
1
1
IDS Classtypes
4
3
1
1
IDS Protocols
7
1
1
This analytic detects a sharp increase in the number of files written to a specific host. It leverages the Endpoint.Filesystem data model, focusing on 'created' actions and comparing current file write counts against historical averages and standard deviations. This activity is significant as a sudden spike in file writes can indicate malicious activities such as ransomware encryption or data exfiltration. If confirmed malicious, this behavior could lead to significant data loss, system compromise, or further propagation of malware within the network.
Detects modifications to an AWS RDS cluster or its deletion, which may indicate potential data exfiltration attempts, unauthorized access, or exposure of sensitive information. These actions can be performed by an attacker to disrupt services, remove evidence, or facilitate data theft.
Detects modifications to an RDS cluster or its deletion, which may indicate potential data exfiltration attempts, unauthorized access, or exposure of sensitive information.
This rule detects the creation or modification of email forwarding or redirection rules within Microsoft 365 audit logs. It specifically looks for operations related to 'UpdateInboxRules', 'Set-Mailbox', 'New-InboxRule', and 'Set-InboxRule' that include parameters indicative of forwarding or redirecting emails, such as 'Forward', 'Recipients', 'ForwardingSmtpAddress', 'ForwardingAddress', 'ForwardAsAttachmentTo', 'ForwardTo', 'RedirectTo', and 'RedirectToRecipients'. This activity can be a sign of an attacker attempting to exfiltrate sensitive information from a compromised mailbox or maintain persistence.
Detects when Microsoft Cloud App Security reports that an OAuth application has downloaded multiple files from Microsoft SharePoint or Microsoft OneDrive in a manner that is unusual for the user. This activity could indicate unauthorized data exfiltration by a compromised or malicious OAuth app.
This rule detects when the master password for an AWS RDS database instance is changed. This activity could be a precursor to data exfiltration or an attempt to gain unauthorized access to the database. The rule specifically looks for the 'ModifyDBInstance' event from 'rds.amazonaws.com' where the 'masterUserPassword' in 'pendingModifiedValues' is present, indicating a password change.
This rule detects when an AWS RDS database instance is restored from a snapshot and configured to be publicly accessible. This activity could indicate an attempt to exfiltrate data by making a copy of a database publicly available.
Detects when Microsoft Cloud App Security reports suspicious email forwarding rules, such as a user creating an inbox rule to forward copies of all emails to an external address. This activity can indicate an attempt to exfiltrate sensitive information.
Detects PowerShell scripts that read file content, iterate through it, and perform DNS host lookups, potentially for data exfiltration or reconnaissance. This combination of actions is suspicious as it suggests an attempt to process local data and resolve external network information.
Detects the execution of "ldifde.exe" to export Active Directory structure. This tool is often used by attackers to collect information about the domain for reconnaissance or exfiltration purposes. The rule specifically looks for the execution of ldifde.exe with the '-f' flag, which indicates an output file, while excluding the '-i' flag which is used for importing data.
Detects PowerShell scripts that have capabilities to read files, loop through them and resolve DNS host entries.
Detects the change of database master password. It may be a part of data exfiltration.
Detects the recovery of a new public database instance from a snapshot. It may be a part of data exfiltration.
Detects when a Microsoft Cloud App Security reported suspicious email forwarding rules, for example, if a user created an inbox rule that forwards a copy of all emails to an external address.
This rule detects the Konni backdoor, a remote access tool. It identifies specific byte patterns associated with the malware's network communication, handling of C2 commands, creation and uploading of CAB files, and payload expansion. The rule is designed to catch the presence of this specific malware family.
Yara rule that detects Konni backdoor.
Page 11 of 11