Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
41 detections
Filters
Last updated
All Time
Detection languages
24
5
3
3
2
Contributors
8
7
4
3
2
Categories
18
10
8
6
5
Platforms
31
9
7
6
3
Products / Services
31
6
4
4
3
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
1
IDS Classtypes
2
IDS Protocols
2
Detects Microsoft 365 activity (Exchange and SharePoint) initiated by known compromised service principal UUIDs associated with the ConnectWise supply-chain attack.
Detects a burst of file access or download operations from SharePoint or OneDrive by a single user account within a short timeframe. This behavior is indicative of bulk data collection or exfiltration, often associated with post-credential-theft activity where an attacker stage and extract organizational data.
This rule detects when a user or service account accesses or downloads a high volume of files from SharePoint or OneDrive that match sensitive keywords such as 'password', 'secret', 'credential', or specific file extensions like '.pem', '.pfx', and '.env'. This behavior is indicative of an attempt to harvest credentials, API keys, or configuration secrets from cloud storage repositories.
Detects high-volume, diverse administrative and discovery activities in cloud environments, including SharePoint site enumeration, Azure AD user/identity discovery, and suspicious access to mail items via specific client applications, potentially indicating post-compromise reconnaissance or data harvesting.
Detects high-frequency, diverse access patterns against the Microsoft Graph API, indicative of automated enumeration or discovery of SharePoint, OneDrive, or search resources. The rule monitors for distinct paths (e.g., sites, drives, children) requested by a single actor within a 20-minute window.
Detects SharePoint Online search queries involving sensitive keywords related to M&A, legal, or financial activities, excluding authorized personnel in departments such as legal or finance. This rule helps identify potential unauthorized internal reconnaissance or data staging activities within an organization's document management system.
This rule detects an unusually high volume of SharePoint sharing invitation creations or sharing setting modifications by a single user within an hour. This could indicate an attacker attempting to exfiltrate data or broadly share sensitive information.
Detects thousands of OneDrive or SharePoint file downloads by a single account during a short period, indicating automated collection rather than ordinary user activity.
Detects rapid enumeration of SharePoint sites, drives, lists, and document libraries from one account, which can precede targeted data collection. This rule identifies a high volume of GET requests to SharePoint-related URIs within a short timeframe, indicating potential reconnaissance or data exfiltration attempts.
Detects attempts to upload files to the SharePoint master page gallery using a POST request. This activity can be indicative of an attacker attempting to establish persistence or deface the SharePoint site by modifying its core components. The rule specifically looks for requests to '_layouts/15/Upload.aspx' or '_layouts/Upload.aspx' with 'RootFolder' and 'List' parameters containing '_catalogs/masterpage' or directory traversal sequences ('../').
Detects a single new session identifier accessing Exchange, SharePoint, and OneDrive within a short period, which may indicate broad post-authentication collection following an adversary-in-the-middle (AiTM) attack.
Detects a newly replayed session issuing mailbox searches for invoice, payment, password, security, or confidential terms. This rule is designed to identify suspicious activity indicative of session hijacking or credential compromise, where an attacker uses a replayed session to search for sensitive information within a mailbox or SharePoint.
Detects thousands of OneDrive or SharePoint file downloads by a single account during a short period, indicating automated collection rather than ordinary user activity.
This rule detects access attempts to SharePoint or Office 365 applications where the UserAgent string indicates the use of PowerShell or Python. This could signify suspicious scripting activity or automated access that might be indicative of malicious intent, such as data exfiltration or unauthorized configuration changes.
Detects automated scripts generating large volumes of text or markdown documents in corporate sync folders (OneDrive/SharePoint) designed to flood the AI indexer with poisoned recommendations.
This rule detects an unusually high volume of SharePoint sharing invitation creations or sharing setting modifications by a single user within an hour. This could indicate an attacker attempting to exfiltrate data or broadly share sensitive information.
Identifies network connections to specific Azure-hosted authentication brokers used by the jupyter-powerdev malware to retrieve Graph API tokens for its SharePoint C2 channel. This rule specifically looks for connections to known malicious broker domains or a known associated IP address.
This rule detects when a client makes repeated HTTP requests to the SharePoint download.aspx page, specifically looking for the URI pattern "/_layouts/download.aspx". This behavior, when occurring frequently from a single source, could indicate an attempt to enumerate and potentially exfiltrate content from a SharePoint site. The rule uses a threshold of 20 requests within 60 seconds from the same source IP to trigger an alert, suggesting a bulk download or enumeration activity.
This rule detects potential bulk downloads from SharePoint document libraries. It triggers when a client makes 30 or more HTTP requests to a SharePoint API endpoint related to web lists ('/_api/web/lists') within a 60-second window. This behavior can indicate an attempt to exfiltrate a large amount of data from SharePoint.
This rule detects an unusually high volume of SharePoint sharing invitation creations or sharing setting modifications by a single user within an hour. This could indicate an attacker attempting to exfiltrate data or broadly share sensitive information.
Detects users accessing, downloading, or copying a high volume of document files (>100 unique files) across multiple SharePoint sites (>1) within a single hour, excluding legitimate OneDrive sync client activity. The rule targets file types commonly associated with sensitive business data — Office documents, PDFs, archives, databases, email exports (PST/OST/MSG), and OneNote notebooks — and aggregates by user and hour to surface bulk collection patterns consistent with insider data theft, account compromise, or pre-exfiltration staging by ransomware affiliates
Page 1 of 2