Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
137 detections
Filters
Last updated
All Time
Detection languages
83
24
10
10
6
Contributors
25
24
19
11
9
Categories
72
43
40
34
20
Platforms
73
47
18
16
11
Products / Services
46
13
9
9
8
MITRE Techniques
18,108
15,615
12,573
8,385
6,206
CVEs
1
1
1
IDS Classtypes
1
1
IDS Protocols
2
Detects the execution of 'OmniQuery.pl' with command-line arguments indicative of direct database queries targeting sensitive authentication data (e.g., SELECT name, auth_data FROM users). This behavior suggests unauthorized access to database credentials or user information.
This rule monitors Office 365 SharePoint file operations and search queries for patterns indicative of automated discovery and exfiltration of sensitive content. It specifically identifies high-frequency search queries involving wildcard parameters used in SharePoint content indexing, which may suggest an adversary is systematically crawling or enumerating organizational documents.
Detects a user performing a high volume of SharePoint site discovery queries within a one-hour window. This behavior often indicates an adversary attempting to map site structures and discover content across an organization's SharePoint environment.
Detects a user performing a high volume of SharePoint site discovery queries within a one-hour window. This behavior often indicates an adversary attempting to map site structures and discover content across an organization's SharePoint environment.
Detects a user performing a high volume of SharePoint site discovery queries within a one-hour window. This behavior often indicates an adversary attempting to map site structures and discover content across an organization's SharePoint environment.
This rule monitors Office 365 SharePoint file operations and search queries for patterns indicative of automated discovery and exfiltration of sensitive content. It specifically identifies high-frequency search queries involving wildcard parameters used in SharePoint content indexing, which may suggest an adversary is systematically crawling or enumerating organizational documents.
Detects anomalous access to Microsoft 365 services (OneDrive, SharePoint, Mail) where the user activity is characterized by a high volume of operations (more than 30) across a diverse set of objects (more than 15) within a one-hour window. The detection focuses on activity originating from specific common automation/scripting User-Agents (Microsoft Graph, Python httpx/requests) that deviate from typical, focused service account behavior.
This rule detects anomalous behavior indicative of post-compromise reconnaissance within Jira or Atlassian environments. It monitors CloudAppEvents for high volumes of distinct view actions (e.g., issues, projects, boards, reports) performed by a single account within a one-hour window, which may signify an attacker using a compromised API token or account to harvest sensitive information from engineering and security work items.
This rule detects anomalous behavior indicative of post-compromise reconnaissance within Jira or Atlassian environments. It monitors CloudAppEvents for high volumes of distinct view actions (e.g., issues, projects, boards, reports) performed by a single account within a one-hour window, which may signify an attacker using a compromised API token or account to harvest sensitive information from engineering and security work items.
Detects access attempts to exposed .git, .svn, or .hg directories.
This detection identifies potential cross-region inference abuse in AWS Bedrock Claude models. Cross-region inference abuse may indicate attempts to bypass regional restrictions, exfiltrate data, or perform unauthorized actions across different AWS regions.
This detection identifies sensitive data such as social security numbers, passwords, API keys, and credit card numbers being sent in prompts to AWS Bedrock Claude models. Exposure of sensitive data through AI prompts may indicate data loss, credential leakage, or insider threat activity.
Detects Google Workspace bulk export/Takeout activity occurring shortly after an OAuth grant or app-password creation, or an unusual volume of export/download events, consistent with automated Gmail/Docs/Keep data exfiltration.
Detects bulk SharePoint/M365 file access or download either from a known UNC6671 exfiltration IP, or via a scripting-library user agent that is new for the user and exceeds a volume threshold within a short session window.
Detects suspicious OAuth consent or connected app authorization followed by SaaS query, export, download, or bulk API activity from the same account within 24 hours, indicating possible OAuth token abuse or SaaS data exfiltration.
Detects SharePoint Online search queries involving sensitive keywords related to M&A, legal, or financial activities, excluding authorized personnel in departments such as legal or finance. This rule helps identify potential unauthorized internal reconnaissance or data staging activities within an organization's document management system.
Detects centralized automation collecting mail across 3+ tenants within a short synchronized window, consistent with coordinated mailbox collection infrastructure.
This takes the earliest available snapshot per agent instead of comparing two states. If an agent is born already carrying MCP access and org-wide sharing there is no baseline to drift from, so this needs its own check rather than a diff.
Detects anomalous post-authentication activity in n8n where the authentication issuer for an account changes from historical norms. This identifies potential account takeover (ATO) scenarios where a hijacked token or cross-issuer session is used to perform lateral movement, workflow manipulation, credential access, or data exfiltration, consistent with behaviors associated with vulnerabilities like CVE-2026-59208.
Detects a single authenticated user account or client performing a high volume of requests to sequential object IDs on the same API path within a short window. This pattern is characteristic of Broken Object Level Authorization (BOLA) or Insecure Direct Object Reference (IDOR) exploitation, where an attacker attempts to gain unauthorized access to data records that do not belong to them by iterating through predictable numeric identifiers.
Detects potentially malicious or anomalous queries within Microsoft 365 Copilot interactions. The rule monitors for patterns indicating attempts at data exfiltration (e.g., HTML/image embedding, image search parameters), unauthorized information extraction (e.g., email or title extraction), or targeting of sensitive authentication-related information (e.g., OTP or MFA codes).
Page 4 of 7