Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
137 detections
Filters
Last updated
All Time
Detection languages
83
24
10
10
6
Contributors
25
24
19
11
9
Categories
72
43
40
34
20
Platforms
73
47
18
16
11
Products / Services
46
13
9
9
8
MITRE Techniques
18,108
15,614
12,573
8,384
6,204
CVEs
1
1
1
IDS Classtypes
1
1
IDS Protocols
2
Detects command-line operations indicative of bulk data export, dumping, or unauthorized scanning against vector databases (e.g., Pinecone, Chroma, Milvus, Qdrant) and caching backends (e.g., Redis). Such activities may indicate an adversary attempting to exfiltrate training data, embeddings, or context stored within an AI agent's memory backend.
Detects Salesforce Experience Cloud guest user sessions performing queries or reads on objects not within the authorized allowlist. This behavior, characterized by an abnormal volume of records retrieved or anomalous query patterns, is consistent with attempts to exploit misconfigured guest profile permissions to access internal sensitive data.
Detects potential insider threats or departing employees by correlating abnormal bulk data downloads from cloud repositories (SharePoint/OneDrive/Box/etc.) with subsequent sensitive data access and exfiltration signals. It uses baseline behavioral profiling, requires a threshold of sensitive file interactions, and mandates high-confidence exfiltration indicators (removable media usage, suspicious external domains, or multiple combined destination events) to reduce noise. Archive/staging activity is used as an optional confidence booster.
Detects unauthorized access to unauthenticated Docker registry API endpoints on port 5000. This rule identifies catalog enumeration and the pulling of malicious container images associated with the CARBONATO botnet, including the retrieval of image manifests and configuration files that expose sensitive environment variables and credentials.
Detects bulk mailbox export or content search operations performed by an identity shortly after a high-risk sign-in event. This pattern is indicative of potential account takeover where an adversary attempts to harvest sensitive email data at scale for BEC or extortion.
Detects an AI agent identity accessing an unusually high number of distinct internal repositories, such as wikis, ticketing systems, code repositories, or customer data stores within a 15-minute window. This behavior is consistent with automated discovery or collection (T1213) by an AI agent.
Detects anomalous, high-volume activity in cloud-based services such as SharePoint, OneDrive, and Exchange, specifically tracking file access, downloads, and mailbox exports. This behavior may indicate bulk data collection, unauthorized exfiltration, or malicious data staging by a compromised account.
Detects a single Salesforce user or connected-app session performing an anomalous volume of SOQL queries against sensitive objects including Case, Account, Contact, and Opportunity. This behavior is indicative of mass data enumeration and potential exfiltration, as observed in historical incidents where attackers targeted CRM platforms to extract embedded secrets and sensitive record data.
Detects unauthorized access attempts to a Docker Registry API on port 5000. The rule identifies attempts to enumerate the image catalog and extract sensitive environment variable information from configuration blobs, which may contain hardcoded credentials or indicators of compromise.
Detects anomalous, high-volume file access by a single process, followed by local file compression or archiving, and subsequent outbound data transfer to a non-internal IP address. This pattern is characteristic of automated agents (like those used in the GTG-1002/Anthropic AI-orchestrated campaigns) performing rapid data triage and staging for exfiltration.
Detects anomalous, high-volume file access by a single process, followed by local file compression or archiving, and subsequent outbound data transfer to a non-internal IP address. This pattern is characteristic of automated agents (like those used in the GTG-1002/Anthropic AI-orchestrated campaigns) performing rapid data triage and staging for exfiltration.
Detects high-volume or systematic SharePoint search queries performed by a single user, specifically looking for indicators of data discovery activities such as searching for SharePoint sites, web structures, or iterating through document IDs which may suggest an adversary attempting to map or identify sensitive data within the environment.
Detects instances where Microsoft 365 Copilot surfaces content labeled with sensitivity markings to a user who only has access to that content via inherited or broad sharing permissions (e.g., Company link, Anonymous link, or inherited permissions), rather than explicit access. This identifies potential AI-retrieval exploitation patterns where Copilot inadvertently exposes sensitive information due to oversharing configurations.
Detects attempts to perform prompt injection against internal Large Language Model (LLM) inference APIs. The rule monitors HTTP proxy logs for specific query parameters designed to trick the model into disclosing its underlying system instructions or hidden prompts.
Detects instances where a Redis server process, or its child process, writes a file named 'verify.html' into the web root directory '/var/www/html/'. This behavior is characteristic of adversaries abusing compromised Redis instances to deploy web shells or command-and-control beacons for persistent access.
This rule detects anomalous behavior where an identity performs multi-category discovery (e.g., users, groups, directory roles, applications) via Microsoft Graph API within a single session, followed by intensive collection of content (files, attachments, or messages). This sequence is indicative of an adversary performing reconnaissance to map an environment before moving to data exfiltration or theft.
Detects high-volume, sustained or burst-like access, download, or deletion activity by a single user across SharePoint, OneDrive, or Exchange services. This behavior is indicative of potential data staging, exfiltration, or bulk malicious activity by a compromised account or insider.
This rule monitors Office 365 SharePoint file operations and search queries for patterns indicative of automated discovery and exfiltration of sensitive content. It specifically identifies high-frequency search queries involving wildcard parameters used in SharePoint content indexing, which may suggest an adversary is systematically crawling or enumerating organizational documents.
This rule detects anomalous, high-volume file and email access events by a single user from a single IP address within the Microsoft 365 environment. The detection logic groups operations such as file downloads, file access, and mailbox item access, flagging instances where a user performs 100 or more such operations, which may indicate data exfiltration or compromised account activity.
Detects the execution of PostgreSQL dump utilities (pg_dump, pg_dumpall) initiated directly by application-level processes like Langflow or Python, rather than through standard system-level task schedulers. This behavior is indicative of unauthorized data collection or staging of database contents by an application process.
Detects the execution of PostgreSQL dump utilities (pg_dump, pg_dumpall) initiated directly by application-level processes like Langflow or Python, rather than through standard system-level task schedulers. This behavior is indicative of unauthorized data collection or staging of database contents by an application process.
Page 2 of 7