Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
295 detections
Filters
Last updated
All Time
Detection languages
159
38
32
29
17
Contributors
96
50
39
17
14
Categories
171
167
134
53
43
Platforms
129
123
96
46
27
Products / Services
144
37
31
29
19
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
CVEs
1
IDS Classtypes
4
IDS Protocols
4
Detects changes to AWS S3 bucket policies or Access Control Lists (ACLs) that result in the bucket becoming publicly accessible. This is a common indicator of misconfiguration or unauthorized modification potentially leading to unauthorized data exposure.
Detects modifications to Google Cloud Storage bucket IAM policies that grant access to 'allUsers' or 'allAuthenticatedUsers'. This activity indicates a potential misconfiguration or an attempt by an attacker to stage or exfiltrate data by making bucket contents publicly accessible.
Detects the modification of an Azure Storage account configuration to enable public access (allowBlobPublicAccess: true). This activity is often associated with attackers attempting to facilitate anonymous data exfiltration by enabling public access to blobs and subsequently reading them.
This rule detects potentially compromised accounts by correlating suspicious authentication activity (such as risky sign-ins, impossible travel, or malicious OAuth/Mail-rule configurations) with a subsequent spike in SharePoint or OneDrive file access, downloads, or external link sharing within a one-hour window. This behavior is indicative of an adversary performing cloud-based data exfiltration after gaining unauthorized access to an account.
Detects high-volume file download activity in Office 365/SharePoint/OneDrive audit logs. The rule correlates download spikes with users who have recently triggered security alerts related to session hijacking, token theft, or risky sign-ins, which are indicators of a potential cloud account takeover scenario.
Detects modifications to AWS S3 bucket Access Control Lists (ACLs) using the 'PutBucketAcl' API call that grant public read or write permissions. This could indicate an attempt to make sensitive data stored in S3 publicly accessible, potentially leading to data exfiltration.
Detects modifications to AWS S3 bucket Access Control Lists (ACLs) using the 'PutBucketAcl' API call that grant public read or write permissions. This could indicate an attempt to make sensitive data stored in S3 publicly accessible, potentially leading to data exfiltration.
Detects 'PutBucketPolicy' API calls in AWS CloudTrail where the policy is modified to grant 'Allow' access to a wildcard ('*') or anonymous principal, without including restrictive conditional requirements such as VPC endpoints or organizational ID constraints. This behavior is a common precursor to data exfiltration from misconfigured S3 buckets.
Detects anomalous, high-volume file download or export activity originating from a single identity across multiple downstream cloud applications or tenants within a one-hour window. This behavior is indicative of a compromised shared service provider, MSP, or clearinghouse account being leveraged to exfiltrate data from multiple client environments simultaneously. The detection excludes pre-approved service accounts and relies on a dynamic baseline comparison rather than a static threshold.
Detects anomalous, high-volume file download or export activity originating from a single identity across multiple downstream cloud applications or tenants within a one-hour window. This behavior is indicative of a compromised shared service provider, MSP, or clearinghouse account being leveraged to exfiltrate data from multiple client environments simultaneously. The detection excludes pre-approved service accounts and relies on a dynamic baseline comparison rather than a static threshold.
Detects anomalous, high-volume file download or export activity originating from a single identity across multiple downstream cloud applications or tenants within a one-hour window. This behavior is indicative of a compromised shared service provider, MSP, or clearinghouse account being leveraged to exfiltrate data from multiple client environments simultaneously. The detection excludes pre-approved service accounts and relies on a dynamic baseline comparison rather than a static threshold.
Detects anomalous, high-volume file download or export activity originating from a single identity across multiple downstream cloud applications or tenants within a one-hour window. This behavior is indicative of a compromised shared service provider, MSP, or clearinghouse account being leveraged to exfiltrate data from multiple client environments simultaneously. The detection excludes pre-approved service accounts and relies on a dynamic baseline comparison rather than a static threshold.
Detects anomalous, high-volume activity in cloud-based services such as SharePoint, OneDrive, and Exchange, specifically tracking file access, downloads, and mailbox exports. This behavior may indicate bulk data collection, unauthorized exfiltration, or malicious data staging by a compromised account.
Detects a suspicious sequence of events where a host performs multiple reconnaissance-style probes (health checks, documentation, or OpenAPI definitions) followed within 10 minutes by access to sensitive artifact-related URLs on the same remote host. This pattern is indicative of an attacker profiling a target server for metadata and then proceeding to exfiltrate files or sensitive artifacts.
Detects a suspicious sequence of events where a host performs multiple reconnaissance-style probes (health checks, documentation, or OpenAPI definitions) followed within 10 minutes by access to sensitive artifact-related URLs on the same remote host. This pattern is indicative of an attacker profiling a target server for metadata and then proceeding to exfiltrate files or sensitive artifacts.
Detects anomalous, high-volume data access patterns within Salesforce, specifically monitoring for bulk API or SOQL query requests by a single user or application. This behavior is indicative of mass data exfiltration from a CRM instance, a tactic observed in extortion-themed campaigns such as those associated with the ShinyHunters group.
Detects high-volume, unauthenticated or anonymous requests (GetObject, ListObjects, ListObjectsV2) against AWS S3 buckets. This behavior is consistent with mass enumeration or scanning activities often associated with data exfiltration attempts against misconfigured publicly-exposed storage buckets.
This rule detects when a user or service account accesses or downloads a high volume of files from SharePoint or OneDrive that match sensitive keywords such as 'password', 'secret', 'credential', or specific file extensions like '.pem', '.pfx', and '.env'. This behavior is indicative of an attempt to harvest credentials, API keys, or configuration secrets from cloud storage repositories.
Detects high-volume file download, access, or preview activity originating from known anonymous proxy services. This behavior is indicative of potential data exfiltration or unauthorized mass data collection from cloud storage applications.
Detects high-volume file download, access, or preview activity originating from known anonymous proxy services. This behavior is indicative of potential data exfiltration or unauthorized mass data collection from cloud storage applications.
Detects potential abuse of the Microsoft Graph API by correlating device-code authentication events with subsequent high-volume activity, such as mail or file enumeration, from the same account within a short window. This pattern is indicative of ARToken-style token proxying, where an attacker intercepts an OAuth device-code token to gain unauthorized access to an user's resources.
Page 3 of 15