Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
295 detections
Filters
Last updated
All Time
Detection languages
159
38
32
29
17
Contributors
96
50
39
17
14
Categories
171
167
134
53
43
Platforms
129
123
96
46
27
Products / Services
144
37
31
29
19
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
IDS Classtypes
4
IDS Protocols
4
Detects anomalous access to Microsoft 365 services (OneDrive, SharePoint, Mail) where the user activity is characterized by a high volume of operations (more than 30) across a diverse set of objects (more than 15) within a one-hour window. The detection focuses on activity originating from specific common automation/scripting User-Agents (Microsoft Graph, Python httpx/requests) that deviate from typical, focused service account behavior.
Detects high-volume image pull activity against an Azure Container Registry from a single identity, which may indicate reconnaissance or mass harvesting of container images to extract embedded credentials, secrets, or source code.
Detects high-volume image pull activity against an Azure Container Registry from a single identity, which may indicate reconnaissance or mass harvesting of container images to extract embedded credentials, secrets, or source code.
Detects automated directory fuzzing attempts against Azure Storage blobs targeting sensitive files like .env, .pem, or configuration files. The rule identifies suspicious activity by aggregating requests from Anonymous or SAS-authenticated sources that exhibit high request volumes and access to multiple distinct sensitive paths, while excluding known legitimate bulk-transfer and synchronization tools.
Detects automated directory fuzzing attempts against Azure Storage blobs targeting sensitive files like .env, .pem, or configuration files. The rule identifies suspicious activity by aggregating requests from Anonymous or SAS-authenticated sources that exhibit high request volumes and access to multiple distinct sensitive paths, while excluding known legitimate bulk-transfer and synchronization tools.
Detects automated directory fuzzing attempts against Azure Storage blobs targeting sensitive files like .env, .pem, or configuration files. The rule identifies suspicious activity by aggregating requests from Anonymous or SAS-authenticated sources that exhibit high request volumes and access to multiple distinct sensitive paths, while excluding known legitimate bulk-transfer and synchronization tools.
Detects anomalous access to Microsoft 365 services (OneDrive, SharePoint, Mail) where the user activity is characterized by a high volume of operations (more than 30) across a diverse set of objects (more than 15) within a one-hour window. The detection focuses on activity originating from specific common automation/scripting User-Agents (Microsoft Graph, Python httpx/requests) that deviate from typical, focused service account behavior.
Detects anomalous access to Microsoft 365 services (OneDrive, SharePoint, Mail) where the user activity is characterized by a high volume of operations (more than 30) across a diverse set of objects (more than 15) within a one-hour window. The detection focuses on activity originating from specific common automation/scripting User-Agents (Microsoft Graph, Python httpx/requests) that deviate from typical, focused service account behavior.
Detects unauthorized or suspicious access attempts to common backup, database dump, or archive files via the Caddy web server, identified by specific file extensions in the requested URL.
This detection identifies sensitive data such as social security numbers, passwords, API keys, and credit card numbers being sent in prompts to AWS Bedrock Claude models. Exposure of sensitive data through AI prompts may indicate data loss, credential leakage, or insider threat activity.
KQL Query
Detects sensitive files in cloud storage environments that have been shared publicly or with external entities, as identified by Netskope CASB (DLP) policies. This rule monitors for events where storage objects are assigned broad access permissions (e.g., 'public', 'anyone with link') in conjunction with DLP incident triggers.
Detects sensitive files in cloud storage environments that have been shared publicly or with external entities, as identified by Netskope CASB (DLP) policies. This rule monitors for events where storage objects are assigned broad access permissions (e.g., 'public', 'anyone with link') in conjunction with DLP incident triggers.
Detects suspicious OAuth consent or connected app authorization followed by SaaS query, export, download, or bulk API activity from the same account within 24 hours, indicating possible OAuth token abuse or SaaS data exfiltration.
Detects instances where a single user account performs a large volume of file downloads (50 or more unique files) within a 30-minute window from Office 365 services. This behavior may indicate unauthorized data exfiltration or mass collection of sensitive information.
This rule detects potential mass data retrieval or excessive access to sensitive-labeled files by an individual user through Microsoft Copilot within a one-hour window. By monitoring the volume of distinct sensitivity-labeled objects accessed, it identifies behavior consistent with a user or compromised account performing high-volume information gathering.
Detects instances where a single user account performs a large volume of file downloads (50 or more unique files) within a 30-minute window from Office 365 services. This behavior may indicate unauthorized data exfiltration or mass collection of sensitive information.
Detects anomalous, high-volume access, download, or synchronization activity in SharePoint or OneDrive within a one-hour window. The rule focuses on non-interactive user agents typically used by scripting libraries (e.g., Python requests, PowerShell, Go-http-client) and flags activity that exceeds an individual user's 21-day rolling baseline, suggesting potential automated data exfiltration or mass collection.
This rule detects potential mass data retrieval or excessive access to sensitive-labeled files by an individual user through Microsoft Copilot within a one-hour window. By monitoring the volume of distinct sensitivity-labeled objects accessed, it identifies behavior consistent with a user or compromised account performing high-volume information gathering.
Detects access to Google Cloud Platform virtual machine serial port output. This API call (v1.compute.instances.getSerialPortOutput) allows users to view the console output of a VM instance, which may contain sensitive information, including boot logs, system diagnostic messages, or credentials that were inadvertently logged to the console by services or applications running on the instance.
Details: Detection to identify bulk download of files from SharePoint within a short period of time (defined as >= 5000 files downloaded within 10 minutes).
Hypothesis: Adversaries may collect large volumes of sensitive data for exfiltration from cloud storage services such as SharePoint. This is a common technique employed by data extortion focused groups such as ShinyHunters.
Recommended Actions: Conduct review of files downloaded paying particular attention to anything which may be of sensitive nature and could be used for extortion purposes. Ensure files downloaded align with user's role. It may be necessary to confirm activity with user if deemed anomalous.
Reference: https://reliaquest.com/blog/threat-spotlight-shinyhunters-fast-tracks-saas-access-subdomain-impersonation/
Hypothesis: Adversaries may collect large volumes of sensitive data for exfiltration from cloud storage services such as SharePoint. This is a common technique employed by data extortion focused groups such as ShinyHunters.
Recommended Actions: Conduct review of files downloaded paying particular attention to anything which may be of sensitive nature and could be used for extortion purposes. Ensure files downloaded align with user's role. It may be necessary to confirm activity with user if deemed anomalous.
Reference: https://reliaquest.com/blog/threat-spotlight-shinyhunters-fast-tracks-saas-access-subdomain-impersonation/
Page 8 of 15