Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
295 detections
Filters
Last updated
All Time
Detection languages
159
38
32
29
17
Contributors
96
50
39
17
14
Categories
171
167
134
53
43
Platforms
129
123
96
46
27
Products / Services
144
37
31
29
19
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
IDS Classtypes
4
IDS Protocols
4
This rule detects potential exposure of API keys, tokens, or secrets within FTP directory listings. It specifically looks for network events on remote port 21 (FTP) where the 'RemoteUrl' contains keywords like 'api_key', 'apikey', 'token', 'secret', or 'key=' during a network signature inspection.
This rule detects suspicious activities related to AWS S3 buckets that could indicate a bucket hijacking attempt or unauthorized replication to an external account. Specifically, it looks for two scenarios: 1) an S3 bucket being deleted and then recreated by a different AWS account within a one-hour window, suggesting a namespace hijacking, or 2) an S3 bucket being deleted while a PutBucketReplication event references an external AWS account, indicating an attempt to exfiltrate data or maintain access through replication.
Detects a potential storage container hijacking attack in Azure, where a container is deleted in one subscription and subsequently recreated with the same name in a different subscription within the same tenant. This sequence can be used to redirect data streams or intercept access to containerized resources.
This rule detects potential unauthorized access to Azure Storage Blobs following the retrieval of storage account access keys. It correlates 'ListKeys' API events with subsequent blob access activities from either unrecognized IP addresses or via Shared Access Signature (SAS) tokens, indicating potential credential misuse.
Slack Canvas External Access & Tampering
Cortex XDR
Detects external users accessing internal Slack canvases and suspicious canvas deletion or access level changes. Canvases can contain sensitive runbooks, credentials, and organizational data, making these actions critical to monitor for potential data exfiltration or unauthorized access.
This rule detects potential exposure of API keys, tokens, or secrets within FTP directory listings. It specifically looks for network events on remote port 21 (FTP) where the 'RemoteUrl' contains keywords like 'api_key', 'apikey', 'token', 'secret', or 'key=' during a network signature inspection.
Detects cloud searches for credential, key, production, database, or confidential terms followed by access to matching files within OneDrive.
Detects Entra ID guest (B2B) users performing a sign-in from a previously unseen IP address or country (observed over the last 30 days), followed within a 4-hour window by sensitive file operations in SharePoint, OneDrive, or Teams (e.g., file downloads, exports, or sensitivity label changes). This pattern is indicative of potential account takeover or unauthorized access to sensitive corporate data.
Detects an unusually high frequency of storage blob and container listing operations within a short time window. This behavior often indicates an attempt to enumerate the contents of Azure Blob Storage, which may be a precursor to data discovery or exfiltration.
Detects cloud searches for sensitive keywords (credential, secret, etc.) followed by access to matching files.
Detects unauthenticated or anonymous access attempts to cloud storage buckets, specifically targeting Azure Blob Storage and AWS S3. The rule identifies access to publicly exposed buckets or those with anonymous access enabled, including specific bucket names associated with known OPSEC failures (pois43, w456w5, sentiwaw). This could indicate data exposure or reconnaissance by unauthorized actors.
Slack Canvas External Access & Tampering
Cortex XDR
Detects external users accessing internal Slack canvases and suspicious canvas deletion or access level changes. Canvases can contain sensitive runbooks, credentials, and organizational data, making these actions critical to monitor for potential data exfiltration or unauthorized access.
Detects queries extracting large contact lists or license details ($top=999 or $top=1000) via Microsoft Graph API, indicating automated data harvesting or reconnaissance activities. This behavior could be indicative of an adversary attempting to collect information about an organization's users or licensed software.
SYSTEM-Context PST or OST Collection
Cortex XDR
This rule detects suspicious access to Outlook data files (.pst or .ost) by processes running in the SYSTEM context, excluding legitimate Outlook-related processes. It focuses on identifying non-standard applications or scripts attempting to collect mailbox data, potentially indicating data exfiltration or unauthorized access. The rule leverages causality fields for enhanced investigation.
Detects bulk export of CRM customer data for collection and theft
Detects one-way C2 communication via data drops to cloud storage services
Detects bulk export of CRM customer data for collection and theft
Detects abuse of the microsoft.Web/sites/publishxml/action operation to retrieve application publishing profiles and basic auth credentials.
Detects cloud resources created in rarely used geographic regions for evasion
Detects high volume Google Cloud Storage (GCS) object listing and downloads, which can indicate reconnaissance of cloud storage contents or data exfiltration. The rule aggregates operations by identity, bucket, and project ID over a one-hour period and flags activity exceeding 50 total operations.
Slack Canvas External Access & Tampering
Cortex XDR
Detects external users accessing internal Slack canvases and suspicious canvas deletion or access level changes. Canvases can contain sensitive runbooks, credentials, and organizational data, making these actions critical to monitor for potential data exfiltration or unauthorized access.
Page 11 of 15