Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
233 detections
Filters
Last updated
All Time
Detection languages
146
31
27
9
7
Contributors
56
43
24
19
15
Categories
89
80
79
56
43
Platforms
181
77
51
44
7
Products / Services
182
34
19
15
15
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
1
1
1
IDS Classtypes
3
1
IDS Protocols
3
Alert when a user has performed an export to a search using 'New-ComplianceSearchAction' with the '-Export' flag. This detection will detect PST export even if the 'eDiscovery search or exported' alert is disabled in the O365.This rule will apply to ExchangePowerShell usage and from the cloud.
Detects adding and using Exchange PowerShell snap-ins to export mailbox data. As seen used by HAFNIUM and APT27
Page 12 of 12