Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
295 detections
Filters
Last updated
All Time
Detection languages
159
38
32
29
17
Contributors
96
50
39
17
14
Categories
171
167
134
53
43
Platforms
129
123
96
46
27
Products / Services
144
37
31
29
19
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
IDS Classtypes
4
IDS Protocols
4
Detects successful Azure AD sign-in events authenticated via the device code flow that subsequently access Microsoft 365 resources such as Outlook, SharePoint, OneDrive, or Teams. This pattern is consistent with post-compromise use of OAuth tokens obtained through device-code phishing.
This rule aggregates SharePoint activity logs for a specific user within a defined timeframe. It groups activities by operation and file, intended to support investigation into potential mass file access or data staging behavior by a specific user in SharePoint.
Detects successful Azure AD sign-in events authenticated via the device code flow that subsequently access Microsoft 365 resources such as Outlook, SharePoint, OneDrive, or Teams. This pattern is consistent with post-compromise use of OAuth tokens obtained through device-code phishing.
Detects successful Azure AD sign-in events authenticated via the device code flow that subsequently access Microsoft 365 resources such as Outlook, SharePoint, OneDrive, or Teams. This pattern is consistent with post-compromise use of OAuth tokens obtained through device-code phishing.
Detects anomalous, automated data exfiltration cycles in Microsoft 365 environments consistent with the Helix threat group. The rule identifies a pattern of successful sign-ins followed within 6 hours by new MFA registration, suspicious SharePoint enumeration, and a high-frequency, non-human-paced burst of file downloads.
Detects reconnaissance activities targeting Azure Container Registry, specifically the listing of available repositories using the Azure CLI and pulling container images, which may indicate an adversary attempting to discover or exfiltrate software components.
Detects potentially unauthorized data exfiltration or bulk extraction activities within Google Cloud BigQuery. The rule monitors for large-scale data queries (SELECT * or queries without filters), data exports to external Google Cloud Storage buckets, and queries executed by automated scripts or tools, which are common indicators of staged data theft following cloud environment compromise.
Detects the creation of Google Cloud Dataflow jobs that exhibit indicators of malicious data exfiltration pipelines, such as usage of suspicious job names (common with exfiltration tools), service account delegation, or execution via scripted user agents.
Detects potential zero-click LLM prompt injection attacks against Microsoft 365 Copilot. The rule correlates Microsoft 365 Copilot activity involving external/untrusted URLs or domains with recent inbound email activity to the same user. This pattern is designed to identify scenarios where an attacker leverages an inbound email to trigger a Copilot interaction with malicious external content, potentially leading to unauthorized data access or exfiltration.
Detects high-volume unauthenticated API queries against a ServiceNow instance by a Guest user. This behavior is indicative of an adversary attempting to exfiltrate sensitive information, such as ticket data, configuration secrets, or employee records, via the 'related_list_edit' REST endpoint or standard table APIs.
Detects high-volume data access or exfiltration from Azure/Office 365 cloud environments via common scripting/automation user-agents. The rule monitors API requests to users, mail, drive, or files endpoints by non-standard clients (e.g., python, curl, Go) from previously unseen locations, calculating a risk score based on the number of endpoints accessed and the total data volume.
This rule detects multiple unauthorized access attempts to files identified as machine learning models, weights, or checkpoints. It specifically looks for Security Event ID 4656 (Auditing of object access) where the object name contains keywords like 'model', 'weights', or 'checkpoint', and the access mask indicates unauthorized access attempts (0x0001 for ReadData or ListDirectory, 0x0002 for WriteData or AddFile). The rule then summarizes these attempts by user, computer, and hour, triggering an alert if 5 or more attempts are made within an hour.
This rule detects when sharing inheritance settings are modified in SharePoint. This could indicate an attempt to broaden access to sensitive information, a misconfiguration, or an attacker attempting to maintain access or exfiltrate data.
This rule detects anomalous high-volume file download activities from Microsoft SharePoint and OneDrive for Business, which may indicate data exfiltration. The rule aggregates download events by user and IP address over 10-minute intervals and triggers when the download count exceeds 200, excluding known service/backup accounts.
Detects high-volume data access or exfiltration from Azure/Office 365 cloud environments via common scripting/automation user-agents. The rule monitors API requests to users, mail, drive, or files endpoints by non-standard clients (e.g., python, curl, Go) from previously unseen locations, calculating a risk score based on the number of endpoints accessed and the total data volume.
This rule detects potential unauthorized access to Azure Storage Blobs following the retrieval of storage account access keys. It correlates 'ListKeys' API events with subsequent blob access activities from either unrecognized IP addresses or via Shared Access Signature (SAS) tokens, indicating potential credential misuse.
Detects anomalous bulk data access activity within SharePoint or OneDrive where the Microsoft Copilot application is the primary interface. This activity pattern is consistent with SearchLeak-style organizational permission abuse, where an AI assistant may be used to discover and access a large number of distinct files that a user might not otherwise access manually.
This rule detects suspicious activity within Microsoft Graph API where an account is querying mailbox contents for sensitive payroll and HR-related keywords. This pattern is often observed following an Adversary-in-the-Middle (AiTM) session compromise, where threat actors (such as those associated with the Payroll Pirate campaign) leverage stolen session tokens to exfiltrate sensitive employee information by searching for specific financial and payroll keywords across multiple mailboxes.
Detects anomalous activity where a single user or service principal downloads more than 5 Microsoft Teams meeting recordings within a 1-hour window. This behavior potentially indicates an insider threat or compromised account performing bulk harvesting of sensitive meeting content.
Detects bulk file access, download, or sync operations by a single user account within a 30-minute window in Microsoft SharePoint Online or OneDrive for Business. This behavior is indicative of potential data exfiltration or unauthorized mass collection of sensitive information.
Detects bulk download of Slack messages using the API
Page 9 of 15