Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
2
2
1
Contributors
2
1
1
1
Categories
3
2
2
2
1
Platforms
2
2
1
1
Products / Services
2
2
1
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
2
IDS Protocols
2
This rule detects attempts to harvest Slack messages for credential tokens by monitoring HTTP requests to slack.com with the URI '/conversations.history'. A threshold of 20 such requests within 60 seconds from the same source IP triggers the alert, indicating potential automated data exfiltration or reconnaissance.
This rule detects suspicious activity related to Microsoft Teams chat messages being scraped for credentials. Specifically, it looks for HTTP requests to 'graph.microsoft.com' with URIs containing '/chats/' and '/messages'. A threshold of 20 such requests within 60 seconds from a single source IP triggers the alert, indicating potential automated data exfiltration or credential harvesting from Teams chats.
Detects execution of suspicious tools or commands that may indicate credential or secret discovery. Generic detection for processes attempting to enumerate credentials, secrets, or sensitive information across files, repositories, or environments.
KQL Query
KQL Query from file: Sniffing Out UNC3944 on Teams
