Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
295 detections
Filters
Last updated
All Time
Detection languages
159
38
32
29
17
Contributors
96
50
39
17
14
Categories
171
167
134
53
43
Platforms
129
123
96
46
27
Products / Services
144
37
31
29
19
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
IDS Classtypes
4
IDS Protocols
4
This rule monitors Office 365 activity for anomalous search behavior, specifically targeting high volumes of distinct search queries involving site collections, web structures, or index ID patterns. Such patterns are indicative of automated data discovery or enumeration activities performed against SharePoint or OneDrive environments.
Detects anomalous, large-scale cloning or mirroring of code repositories combined with targeted access to infrastructure-as-code configuration files (e.g., .tfvars, .tfstate) or automated exfiltration of CI/CD build artifacts. This behavior is indicative of an adversary attempting to exfiltrate proprietary source code or sensitive secrets stored within repositories.
Detects anomalous, large-scale cloning or mirroring of code repositories combined with targeted access to infrastructure-as-code configuration files (e.g., .tfvars, .tfstate) or automated exfiltration of CI/CD build artifacts. This behavior is indicative of an adversary attempting to exfiltrate proprietary source code or sensitive secrets stored within repositories.
Detects anomalous, high-volume file access or download operations in SharePoint from a user agent identified as 'python-httpx'. This behavior is characteristic of automated scripts or potential data exfiltration attempts targeting cloud-based file storage.
Detects high-volume file access and download operations in SharePoint Online and OneDrive where the user agent is identified as 'python-httpx'. This behavior is indicative of automated exfiltration scripts potentially used in malicious cloud intrusion campaigns.
Detects anomalous, high-volume search query activity across multiple SharePoint sites or OneDrive locations, potentially indicating an adversary performing broad data discovery or enumeration across an organization's cloud document repositories.
Detects high-volume image pull activity against an Azure Container Registry from a single identity, which may indicate reconnaissance or mass harvesting of container images to extract embedded credentials, secrets, or source code.
Detects anomalous access to Microsoft 365 services (OneDrive, SharePoint, Mail) where the user activity is characterized by a high volume of operations (more than 30) across a diverse set of objects (more than 15) within a one-hour window. The detection focuses on activity originating from specific common automation/scripting User-Agents (Microsoft Graph, Python httpx/requests) that deviate from typical, focused service account behavior.
Detects high-volume image pull activity against an Azure Container Registry from a single identity, which may indicate reconnaissance or mass harvesting of container images to extract embedded credentials, secrets, or source code.
Detects automated directory fuzzing attempts against Azure Storage blobs targeting sensitive files like .env, .pem, or configuration files. The rule identifies suspicious activity by aggregating requests from Anonymous or SAS-authenticated sources that exhibit high request volumes and access to multiple distinct sensitive paths, while excluding known legitimate bulk-transfer and synchronization tools.
Detects anomalous, large-scale cloning or mirroring of code repositories combined with targeted access to infrastructure-as-code configuration files (e.g., .tfvars, .tfstate) or automated exfiltration of CI/CD build artifacts. This behavior is indicative of an adversary attempting to exfiltrate proprietary source code or sensitive secrets stored within repositories.
Detects anomalous, large-scale cloning or mirroring of code repositories combined with targeted access to infrastructure-as-code configuration files (e.g., .tfvars, .tfstate) or automated exfiltration of CI/CD build artifacts. This behavior is indicative of an adversary attempting to exfiltrate proprietary source code or sensitive secrets stored within repositories.
Detects anomalous user behavior where a file search query is followed by a high volume of file downloads within a short period (30 minutes) from the same IP address. This behavior is indicative of an attacker searching for sensitive documents and performing bulk extraction or exfiltration.
Detects anomalous, high-volume search query activity across multiple SharePoint sites or OneDrive locations, potentially indicating an adversary performing broad data discovery or enumeration across an organization's cloud document repositories.
Detects anomalous, high-volume search query activity across multiple SharePoint sites or OneDrive locations, potentially indicating an adversary performing broad data discovery or enumeration across an organization's cloud document repositories.
Detects anomalous, high-volume search query activity across multiple SharePoint sites or OneDrive locations, potentially indicating an adversary performing broad data discovery or enumeration across an organization's cloud document repositories.
Detects anomalous, high-volume search query activity across multiple SharePoint sites or OneDrive locations, potentially indicating an adversary performing broad data discovery or enumeration across an organization's cloud document repositories.
This rule monitors Office 365 activity for anomalous search behavior, specifically targeting high volumes of distinct search queries involving site collections, web structures, or index ID patterns. Such patterns are indicative of automated data discovery or enumeration activities performed against SharePoint or OneDrive environments.
This rule monitors Office 365 activity for anomalous search behavior, specifically targeting high volumes of distinct search queries involving site collections, web structures, or index ID patterns. Such patterns are indicative of automated data discovery or enumeration activities performed against SharePoint or OneDrive environments.
This rule monitors Office 365 activity for anomalous search behavior, specifically targeting high volumes of distinct search queries involving site collections, web structures, or index ID patterns. Such patterns are indicative of automated data discovery or enumeration activities performed against SharePoint or OneDrive environments.
Detects anomalous access to Microsoft 365 services (OneDrive, SharePoint, Mail) where the user activity is characterized by a high volume of operations (more than 30) across a diverse set of objects (more than 15) within a one-hour window. The detection focuses on activity originating from specific common automation/scripting User-Agents (Microsoft Graph, Python httpx/requests) that deviate from typical, focused service account behavior.
Page 7 of 15