Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
15 detections
Filters
Last updated
All Time
Detection languages
9
3
2
1
Contributors
8
2
2
1
1
Categories
9
5
4
3
3
Platforms
6
5
2
2
2
Products / Services
8
2
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
2
Hunting rule loosely modeled after Atomic Red Team T1048.002 test "Exfiltrate data in a file over HTTPS using wget". No public in-the-wild intel reference available; correlate before alerting.
Hunting rule loosely modeled after Atomic Red Team T1048.002 test "Exfiltrate data in a file over HTTPS using wget". No public in-the-wild intel reference available; correlate before alerting.
Detects curl.exe exfiltrating screenshots to .onion domains via proxy.
This rule detects large encrypted data uploads (over 65KB) on TCP port 8443, which is an alternate port often used for TLS/HTTPS traffic. The rule triggers if 10 such uploads occur from the same source within 60 seconds, indicating a potential policy violation or data exfiltration attempt.
This rule detects potential data exfiltration over TLS to non-standard endpoints. It triggers when a large amount of data (greater than 65000 bytes) is sent from the home network to any destination IP on port 443 (HTTPS). A threshold is applied, triggering an alert if this occurs 20 times within 60 seconds from the same source IP, indicating a high volume of outbound encrypted traffic.
Detects native Windows scripting hosts (wscript.exe, cscript.exe) establishing outbound network connections over SMTPS (port 465). This is highly anomalous and was observed in the FAUX#ELEVATE campaign where threat actors exfiltrated stolen credentials and browser data using Collaboration Data Objects (CDO) via VBScript to external SMTP servers.
Detects the execution of rar.exe to create a password-protected archive with a known password, or the use of curl.exe to exfiltrate data to known HoneyMyte infrastructure. This TTP is associated with the group's script-based data collection and exfiltration activities.
This rule detects file downloads from Office 365 or Microsoft Graph Activity logs, specifically excluding anonymous file links. It looks for 'FileDownloaded' events from Office 365 and HTTP GET requests with a 302 response code from Microsoft Graph Activity, ensuring the download is not initiated by an anonymous user.
This rule detects when files are downloaded from OneDrive using anonymous links. While not inherently malicious, some organizations prohibit anonymous links due to data leakage risks. The rule specifically looks for 'FileDownloaded' events from Office 365 where the principal user ID indicates an anonymous access (e.g., 'urn:spo:anon#' or 'anonymous').
This rule detects when anonymous links are used to access files from OneDrive. While not always malicious, some organizations prohibit anonymous links due to data leakage risks. The rule specifically looks for 'USER_RESOURCE_ACCESS' events with 'FileAccessed' product event type from Office 365, where the principal user ID indicates an anonymous access (e.g., 'urn:spo:anon#' or 'anonymous').
This rule detects when anonymous links are used to access files from OneDrive. While this isn't always a sign of malicious activity, some organizations do not support the use of anonymous links because of the risk of data leakage. The rule specifically looks for 'USER_RESOURCE_ACCESS' events with 'AnonymousLinkUsed' as the product event type, originating from 'Office 365' and 'Microsoft', where the user ID is 'anonymous'.
Detects file downloads using O365 or Graph Activity logs, not including anonymous file links
Anonymous links can be used to export files from OneDrive. While this isn't always a sign of malicious activity, some organizations do not support the use of anonymous links because of the risk of data leakage. This rule detects when anonymous links are used to access files from OneDrive.
Anonymous links can be used to export files from OneDrive. While this isn't always a sign of malicious activity, some organizations do not support the use of anonymous links because of the risk of data leakage. This rule detects when anonymous links are used to download files from OneDrive.
Anonymous links can be used to access files from OneDrive. While this isn't always a sign of malicious activity, some organizations do not support the use of anonymous links because of the risk of data leakage. This rule detects when anonymous links are used to access files from OneDrive.