Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
137 detections
Filters
Last updated
All Time
Detection languages
83
24
10
10
6
Contributors
25
24
19
11
9
Categories
72
43
40
34
20
Platforms
73
47
18
16
11
Products / Services
46
13
9
9
8
MITRE Techniques
18,108
15,614
12,573
8,384
6,204
CVEs
1
1
1
IDS Classtypes
1
1
IDS Protocols
2
Detects attempts to export user permission data from Bitbucket, which could indicate reconnaissance or data collection activities by an adversary.
This rule detects attempts to export user details from Bitbucket, including successful exports, failed attempts, and the initiation of such exports. This activity could indicate an adversary attempting to collect sensitive user information for further reconnaissance or data exfiltration.
Detects user data export activity.
Detects user permission data export attempt.
KQL Query from file: New Redis RCE Alert: CVE-2025-49844
Detects attempts to exploit a SQL injection vulnerability (CVE-2025-57819) in FreePBX via a malicious GET request to '/admin/ajax.php'. Attackers leverage this to achieve remote code execution by inserting a malicious cron job.
This detection identifies potentially suspicious usage of sqlcmd.exe, focusing on command patterns that may indicate data exfiltration, reconnaissance, or malicious database operations. The detection looks for both short-form (-X) and long-form (--flag) suspicious parameter combinations, which have been observed in APT campaigns targeting high-value organizations. For example, threat actors like CL-STA-0048 have been known to abuse sqlcmd.exe for data theft and exfiltration from compromised MSSQL servers. The detection monitors for suspicious authentication attempts, output redirection, and potentially malicious query patterns that could indicate unauthorized database access or data theft.
Detects data theft activity from Salesforce instances by the threat actor UNC6395, who leveraged compromised OAuth tokens associated with the Salesloft Drift third-party application. The detection is based on suspicious user agents and known malicious IP addresses used by the threat actor, specifically targeting the 'Drift' connected application.
KQL Query
KQL Query from file: M365 Copilot Plugins Inventory Analysis
KQL Query from file: Threat Intelligence Data from Sentinel UEBA2
'Attacker can exfiltrate data from your GitHub repository by cloning it. This hunting query tracks clone activities for each repository, allowing quick identification of anomalies/excessive clones to investigate repo access & permissions.'
'This hunting query looks for queries that appear to be looking for secrets or passwords in tables.'
'This hunting query identifies GitHub activites where a repo was changed from private to public that may be a sign of compromise.'
'This hunting query looks for new Service Principals running queries that have not previously been seen running queries.'
'This hunting query looks for clients running queries that have not previously been seen running queries.'
'This hunting query looks for increases in the number of workspaces queried by a user.'
This query monitors for users running Log Analytics queries that contain filters for specific, defined VIP user accounts or the VIPUser watchlist template.
Use this detection to alert for users specifically searching for activity of sensitive users.
Use this detection to alert for users specifically searching for activity of sensitive users.
'This hunting query looks for users who have run queries that have not previously been seen running queries.'
'This hunting query looks for users who have run queries calling a watchlist template relating to sensitive data that have not previously been seen calling these watchlists.'
Detects when a user grants access to a GitHub Personal Access Token (PAT) and subsequently clones a high number of non-public GitHub repositories. This behavior can indicate an adversary attempting to steal the contents of multiple GitHub repositories using an automated script or offensive tool after gaining access to a PAT.
Page 6 of 7