Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
295 detections
Filters
Last updated
All Time
Detection languages
159
38
32
29
17
Contributors
96
50
39
17
14
Categories
171
167
134
53
43
Platforms
129
123
96
46
27
Products / Services
144
37
31
29
19
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
IDS Classtypes
4
IDS Protocols
4
'Finds instances where a file uploaded to blob or file storage and it is seen on an endpoint by Microsoft Defender XDR.'
'This hunting query looks for queries that appear to be looking for secrets or passwords in tables.'
'This hunting query looks for new Service Principals running queries that have not previously been seen running queries.'
'This hunting query looks for clients running queries that have not previously been seen running queries.'
'This hunting query looks for increases in the number of workspaces queried by a user.'
This query monitors for users running Log Analytics queries that contain filters for specific, defined VIP user accounts or the VIPUser watchlist template.
Use this detection to alert for users specifically searching for activity of sensitive users.
Use this detection to alert for users specifically searching for activity of sensitive users.
'This hunting query looks for users who have run queries that have not previously been seen running queries.'
'This hunting query looks for users who have run queries calling a watchlist template relating to sensitive data that have not previously been seen calling these watchlists.'
This query looks for file download events identified by Microsoft Defender for Cloud Apps. It will require an corresponding app connector in Microsoft Defender for Cloud Apps.
Reference - https://learn.microsoft.com/defender-cloud-apps/enable-instant-visibility-protection-and-governance-actions-for-your-apps
Reference - https://learn.microsoft.com/defender-cloud-apps/enable-instant-visibility-protection-and-governance-actions-for-your-apps
Detects when a Cloud Storage bucket's IAM policy is changed to add public access to all users.
This analytic identifies the creation of new open/public GCP Storage buckets. It leverages GCP PubSub events, specifically monitoring for the `storage.setIamPermissions` method and checks if the `allUsers` member is added. This activity is significant because open storage buckets can expose sensitive data to the public, posing a severe security risk. If confirmed malicious, an attacker could access, modify, or delete data within the bucket, leading to data breaches and potential compliance violations.
The following analytic identifies access to GCP Storage buckets from new or previously unseen remote IP addresses. It leverages GCP Storage bucket-access logs ingested via Cloud Pub/Sub and compares current access events against a lookup table of previously seen IP addresses. This activity is significant as it may indicate unauthorized access or potential reconnaissance by an attacker. If confirmed malicious, this could lead to data exfiltration, unauthorized data manipulation, or further compromise of the GCP environment.
This analytic detects when an excessive number of files are accessed from Office 365 by the same user over a short period of time. This behavior may indicate an attacker staging data for exfiltration or an insider threat removing organizational data. The rule specifically looks for `fileaccessed` operations in the Office 365 Universal Audit Log, excluding SharePoint app access and common image file extensions. It then calculates the count of unique source file names accessed per user and flags users whose access count significantly exceeds the average (3 standard deviations above the mean) and is greater than 50 files. This can help identify malicious actors abusing "open in app" functionality or Graph API-based access to evade typical file download events.
This analytic detects when an excessive number of files are synced from Office 365 by the same user over a short period of time. This behavior may indicate an attacker staging data for exfiltration or an insider threat removing organizational data. The rule specifically looks for `filesyncdownload*` operations with a `UserAgent` containing `*SkyDriveSync*` and filters out cases where the `SiteUrl` matches the user's flat ID, which could be legitimate personal sync activity. A threshold of more than 50 unique source file names downloaded by a single user is used to trigger the alert. Additional attention should be taken with any Azure Guest (#EXT#) accounts.
The analytic identifies a spike in API activity related to the deletion of S3 buckets in an AWS environment. It uses AWS CloudTrail logs to detect anomalies by comparing current deletion activity against a historical baseline. Unusual spikes in S3 bucket deletions could indicate malicious actions such as data exfiltration or unauthorized data destruction, leading to significant data loss, disruption of services, and potential exposure of sensitive information. Immediate investigation is required to determine the legitimacy of the activity.
This analytic detects when an excessive number of files are downloaded from Office 365 by the same user over a short period of time. Office 365 may bundle these files together as a ZIP file, however each file will have its own download event. This behavior may indicate an attacker staging data for exfiltration or an insider threat removing organizational data. Additional attention should be taken with any Azure Guest (#EXT#) accounts.
The following analytic identifies the creation of open/public S3 buckets in AWS. It detects this activity by analyzing AWS CloudTrail events for `PutBucketAcl` actions where the access control list (ACL) grants permissions to all users or authenticated users. This activity is significant because open S3 buckets can expose sensitive data to unauthorized access, leading to data breaches. If confirmed malicious, an attacker could read, write, or fully control the contents of the bucket, potentially leading to data exfiltration or tampering.
The analytic identifies successful access to an S3 bucket from a new or previously unseen remote IP address. This activity is significant because access from unfamiliar IP addresses could indicate unauthorized access or potential data exfiltration attempts. If confirmed malicious, this activity could lead to unauthorized data access, data theft, or further exploitation of the compromised S3 bucket, posing a significant risk to sensitive information stored within the bucket.
The following analytic detects the creation of open/public S3 buckets via the AWS CLI. It leverages AWS CloudTrail logs to identify events where a user has set bucket permissions to allow access to "AuthenticatedUsers" or "AllUsers." This activity is significant because open S3 buckets can expose sensitive data to unauthorized users, leading to data breaches. If confirmed malicious, an attacker could gain unauthorized access to potentially sensitive information stored in the S3 bucket, posing a significant security risk.
This detects when a 401 Unauthorized status is received on multiple attempts of the same file when attempting to download from OneDrive and may indicate a permissions issue for the user.
This detects when a 401 Unauthorized status code is returned when attempting to download multiple unique files from OneDrive and may indicate a permissions issue for the user.
Page 14 of 15