Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
295 detections
Filters
Last updated
All Time
Detection languages
159
38
32
29
17
Contributors
96
50
39
17
14
Categories
171
167
134
53
43
Platforms
129
123
96
46
27
Products / Services
144
37
31
29
19
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
IDS Classtypes
4
IDS Protocols
4
Detects bulk harvesting of Teams messages for credentials or sensitive data
This rule detects when sharing inheritance settings are modified in SharePoint. This could indicate an attempt to broaden access to sensitive information, a misconfiguration, or an attacker attempting to maintain access or exfiltrate data.
This rule detects when sharing inheritance settings are modified in SharePoint. This could indicate an attempt to broaden access to sensitive information, a misconfiguration, or an attacker attempting to maintain access or exfiltrate data.
This rule detects multiple unauthorized access attempts to files identified as machine learning models, weights, or checkpoints. It specifically looks for Security Event ID 4656 (Auditing of object access) where the object name contains keywords like 'model', 'weights', or 'checkpoint', and the access mask indicates unauthorized access attempts (0x0001 for ReadData or ListDirectory, 0x0002 for WriteData or AddFile). The rule then summarizes these attempts by user, computer, and hour, triggering an alert if 5 or more attempts are made within an hour.
This rule detects a high volume of HTTP GET requests to storage.googleapis.com, indicating a potential bulk download of objects from Google Cloud Storage. The threshold is set to 50 requests within 60 seconds from a single source IP address.
This rule detects multiple unauthorized access attempts to files identified as machine learning models, weights, or checkpoints. It specifically looks for Security Event ID 4656 (Auditing of object access) where the object name contains keywords like 'model', 'weights', or 'checkpoint', and the access mask indicates unauthorized access attempts (0x0001 for ReadData or ListDirectory, 0x0002 for WriteData or AddFile). The rule then summarizes these attempts by user, computer, and hour, triggering an alert if 5 or more attempts are made within an hour.
This rule detects a high volume of HTTP GET requests to Azure Blob Storage, specifically targeting '.blob.core.windows.net' domains. A threshold of 50 requests within 60 seconds from a single source IP address triggers the alert, indicating a potential bulk data download activity. This could be indicative of data exfiltration or unauthorized access to cloud storage.
This rule detects a high volume of HTTP GET requests to AWS S3 buckets from a single source IP address within a short timeframe. Specifically, it triggers if more than 50 GET requests are observed within 60 seconds to hosts matching 's3.amazonaws.com' or '.s3.' patterns. This behavior can indicate an attempt to exfiltrate data or perform bulk collection from an S3 bucket.
Detects access or creation of files within Google Drive that have credential-related names, indicating potential credential harvesting attempts or unauthorized access to sensitive data. The rule specifically looks for file events such as 'view', 'edit', 'create', or 'access_url' on files whose titles contain keywords commonly associated with credentials (e.g., password, secret, key, token, etc.).
Detects the export of Microsoft Teams messages, transcripts, recordings, and chat retrieval activities, particularly when performed via the Graph API. This rule identifies suspicious activity by looking for specific operation names in SaaS audit logs from Microsoft Teams and flags user agents commonly associated with automation tools (e.g., python-requests, axios, go-http, curl, wget, powershell, httpx, aiohttp, node) which could indicate post-compromise attackers using stolen tokens to silently export chat history.
Identifies Node.js processes downloading the Bun runtime from GitHub Releases. This behavior was observed in the vpmdhaj npm supply chain attack, where Gen-2 stagers silently downloaded Bun to execute bundled credential harvesting payloads without an immediate C2 payload drop.
Detects the creation or modification of GitHub Actions workflow files designed to dump and exfiltrate repository secrets, a technique observed in the Mini Shai-Hulud supply chain attack. This rule specifically looks for file events in GitHub Actions workflow directories combined with command-line patterns indicative of secret exfiltration or the creation of a specific malicious workflow file ('codeql_analysis.yml') by scripting interpreters.
Box SaaS Suspicious File Upload
Cortex XDR
Detects suspicious file uploads to Box indicating potential data staging, tool upload, or exfiltration via shared folders. This rule specifically looks for the 'UPLOAD' operation within Box SaaS audit logs and extracts various file and user-related details.
Box SaaS Suspicious File Download
Cortex XDR
Detects file downloads from Box which could indicate potential data exfiltration by insiders or compromised accounts. This rule specifically looks for 'DOWNLOAD' operations within Box SaaS audit logs.
Detects suspicious sharing activity in Box, including the creation of open links, external collaboration invites, role escalation, and weakening of sharing policies. This rule identifies high-risk activities such as making files publicly visible without password protection, inviting external users with co-owner or editor roles, and changes that reduce security like removing expiration dates on shared links.
SharePoint Online Sensitive Data Search
Cortex XDR
This rule detects when users perform search queries in SharePoint Online that contain keywords indicative of sensitive data. The rule categorizes these searches into several types: credentials, personnel/HR information, infrastructure reconnaissance, financial/PII, and confidential business information.
Detects the creation or modification of GitHub Actions workflow files designed to dump and exfiltrate repository secrets, a technique observed in the Mini Shai-Hulud supply chain attack. This rule specifically looks for file events in GitHub Actions workflow directories combined with command-line patterns indicative of secret exfiltration or the creation of a specific malicious workflow file ('codeql_analysis.yml') by scripting interpreters.
SharePoint Online Sensitive Data Search
Cortex XDR
This rule detects when users perform search queries in SharePoint Online that contain keywords indicative of sensitive data. The rule categorizes these searches into several types: credentials, personnel/HR information, infrastructure reconnaissance, financial/PII, and confidential business information.
Azure Blob SAS Access
Cortex XDR
Detects access to Azure Blob Storage using Shared Access Signature (SAS) authentication. This rule specifically looks for successful blob operations where the authentication type is SAS and the identity name matches 'key1' or 'key2', which are often associated with storage account access keys used to generate SAS tokens. Monitoring such access can help identify unauthorized or suspicious use of SAS tokens.
KQL Query
Azure Blob Anonymous Access
Cortex XDR
Detects unauthenticated or anonymous access attempts to Azure Blob Storage. This rule identifies successful operations where the identity is explicitly listed as 'anonymous', indicating potential misconfigurations or unauthorized access to sensitive data.
Page 12 of 15