Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
115 detections
Filters
Last updated
All Time
Detection languages
59
19
11
10
6
Contributors
20
19
15
9
7
Categories
53
25
22
20
13
Platforms
47
36
29
12
9
Products / Services
40
9
8
7
6
MITRE Techniques
18,108
15,614
12,573
8,384
6,204
IDS Classtypes
5
1
IDS Protocols
4
2
This rule detects anomalous, high-volume activity in Jira, such as mass ticket viewing, searching, exporting, or attachment downloading, which is often characteristic of unauthorized data exfiltration or reconnaissance. The detection triggers when an account exceeds thresholds of 200 issue-related actions or 8 attachment downloads within a 7-day period.
This rule monitors for suspicious interactions with Android device drivers via the 'getevent' utility, often used to capture raw input, combined with unusual file access patterns involving 'locateValues.json' and potential data exfiltration attempts to specific internal API endpoints.
Detects high-frequency outbound TLS connections to 'api-gost.oneme.ru', which is indicative of potential bulk contact list uploading, possibly related to unauthorized data collection by the Max Messenger application.
Detects high-frequency outbound TLS connections to 'api-gost.oneme.ru', which is indicative of potential bulk contact list uploading, possibly related to unauthorized data collection by the Max Messenger application.
Detects high-frequency outbound TLS connections to 'api-gost.oneme.ru', which is indicative of potential bulk contact list uploading, possibly related to unauthorized data collection by the Max Messenger application.
Detects high-frequency outbound TLS connections to 'api-gost.oneme.ru', which is indicative of potential bulk contact list uploading, possibly related to unauthorized data collection by the Max Messenger application.
Detects anomalous, high-volume file access and download activity targeting SharePoint or OneDrive. This behavior is identified by the use of the python-httpx User-Agent, which is often associated with automated scripts for data collection and exfiltration in cloud-based intrusions.
Detects instances where browser processes (chrome.exe or comet.exe) access multiple files in sensitive or unexpected directories (e.g., System32, /etc/, Documents) without an associated user click event. This activity often indicates potential malicious scripts or automated data collection running within the context of a browser process.
Detects anomalous, high-frequency, and highly regular HTTP requests directed at Dahua camera infrastructure for the purpose of harvesting snapshots. The rule uses statistical analysis to identify automated collection patterns, such as a high volume of requests across multiple devices with low variance in request intervals.
Detects the use of cmd.exe to execute copy commands involving specific batch files (doxc.bat or config.bat) or suspicious file paths, which may indicate malicious file staging or automated data collection behavior.
This rule monitors cloud audit logs for high-frequency file access operations originating from a Python-based HTTP client (python-httpx). This behavior is characteristic of automated collection or exfiltration scripts utilizing cloud APIs to download or access large quantities of files.
This rule monitors Office 365 SharePoint file operations and search queries for patterns indicative of automated discovery and exfiltration of sensitive content. It specifically identifies high-frequency search queries involving wildcard parameters used in SharePoint content indexing, which may suggest an adversary is systematically crawling or enumerating organizational documents.
Detects execution of the s5cmd command-line tool performing synchronization, copy, or move operations to a cloud storage URI (s3://) followed by an outbound network connection on port 443 within a 10-minute window. This behavior is indicative of potential data exfiltration to cloud storage.
Detects network traffic directed towards Microsoft Graph API that utilizes the 'python-httpx' User-Agent. This combination is often associated with automated scripts, potentially used by adversaries (e.g., Storm-3121/Storm-3032) for automated data collection and exfiltration from Microsoft 365 environments.
Detects a single user account downloading or accessing a high volume of files (more than 50) within a 15-minute window from SharePoint or OneDrive. This behavior often indicates automated data collection, potential mass exfiltration, or a compromised user account account accessing sensitive files in bulk.
This rule monitors Office 365 activity for anomalous search behavior, specifically targeting high volumes of distinct search queries involving site collections, web structures, or index ID patterns. Such patterns are indicative of automated data discovery or enumeration activities performed against SharePoint or OneDrive environments.
This rule monitors Office 365 file download activity, identifying users whose download volume significantly deviates from their historical baseline. It specifically looks for an unusually high number of unique files downloaded in a one-hour window, while excluding known service accounts and synchronization agents like OneDrive sync client.
This rule monitors Office 365 activity for anomalous search behavior, specifically targeting high volumes of distinct search queries involving site collections, web structures, or index ID patterns. Such patterns are indicative of automated data discovery or enumeration activities performed against SharePoint or OneDrive environments.
Detects the creation of files named 'strEncodedData.txt' on the local file system. This naming convention is associated with the DarkTortilla RAT, which uses this specific file to stage encoded data prior to exfiltration or further processing.
This rule detects suspicious, high-volume file access or download operations in SharePoint and OneDrive. It filters for activities performed by specific user agents commonly associated with automated scripting tools (e.g., python-requests, Microsoft.Graph.Client), which indicates potential automated exfiltration or unauthorized bulk data collection.
This rule monitors Office 365 SharePoint file operations and search queries for patterns indicative of automated discovery and exfiltration of sensitive content. It specifically identifies high-frequency search queries involving wildcard parameters used in SharePoint content indexing, which may suggest an adversary is systematically crawling or enumerating organizational documents.
Page 1 of 6