Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
640 detections
Filters
Last updated
All Time
Detection languages
302
82
80
57
53
Contributors
139
126
122
26
24
Categories
510
318
124
86
79
Platforms
309
155
127
112
91
Products / Services
164
119
84
80
76
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
8
2
1
1
1
IDS Classtypes
44
25
6
5
1
IDS Protocols
60
12
5
1
Detects a suspicious curl process start the adds a file to a web request
This analytic detects when an excessive number of files are accessed from Office 365 by the same user over a short period of time. This behavior may indicate an attacker staging data for exfiltration or an insider threat removing organizational data. The rule specifically looks for `fileaccessed` operations in the Office 365 Universal Audit Log, excluding SharePoint app access and common image file extensions. It then calculates the count of unique source file names accessed per user and flags users whose access count significantly exceeds the average (3 standard deviations above the mean) and is greater than 50 files. This can help identify malicious actors abusing "open in app" functionality or Graph API-based access to evade typical file download events.
This analytic detects when an excessive number of files are synced from Office 365 by the same user over a short period of time. This behavior may indicate an attacker staging data for exfiltration or an insider threat removing organizational data. The rule specifically looks for `filesyncdownload*` operations with a `UserAgent` containing `*SkyDriveSync*` and filters out cases where the `SiteUrl` matches the user's flat ID, which could be legitimate personal sync activity. A threshold of more than 50 unique source file names downloaded by a single user is used to trigger the alert. Additional attention should be taken with any Azure Guest (#EXT#) accounts.
This analytic detects when an excessive number of files are downloaded from Office 365 by the same user over a short period of time. Office 365 may bundle these files together as a ZIP file, however each file will have its own download event. This behavior may indicate an attacker staging data for exfiltration or an insider threat removing organizational data. Additional attention should be taken with any Azure Guest (#EXT#) accounts.
This analytic detects when Microsoft Office 365 Data Loss Prevention (DLP) rules have been triggered. DLP rules are configured for security, regulatory, or business compliance reasons. Detections from this analytic should be thoroughly evaluated to determine the security relevance of the underlying DLP events. The accuracy of this analytic depends on the upstream DLP configuration.
This analytic identifies significant changes in network communication behavior within Kubernetes containers by examining the inbound to outbound network IO ratios. It leverages process metrics from an OTEL collector and Kubelet Stats Receiver, along with data from Splunk Observability Cloud. Anomalies are detected using a lookup table containing average and standard deviation values for network IO, triggering an event if the anomaly persists for over an hour. This activity is significant as it may indicate data exfiltration, command and control communication, or compromised container behavior. If confirmed malicious, it could lead to data breaches, service outages, and unauthorized access within the Kubernetes cluster.
The analytic identifies when a user with sufficient access to the O365 Security & Compliance portal uses premium investigation features (Threat Explorer) to directly view email. Adversaries may exploit privileged access with this premium feature to enumerate or exfiltrate sensitive data.
Detects when the visibility for a GitHub repository is changed to public.
This rule identifies when a single user downloads multiple files from Google Drive within a one-hour window. This behavior can be indicative of data exfiltration attempts, where an attacker or malicious insider is trying to extract sensitive information from the organization's Google Drive storage. The rule specifically looks for 'download' events from the 'Google Workspace' vendor and 'drive' product, and triggers an alert if more than 10 distinct files are downloaded by the same user within the specified timeframe.
This rule identifies a suspicious sequence of events within Google Workspace. Specifically, it triggers when a user successfully logs in under suspicious circumstances (indicated by the 'is_suspicious' label) and subsequently downloads a file from Google Drive. The rule correlates these two events by the user ID and ensures the download occurs after the suspicious login, within a 1-hour window.
This rule identifies potential data exfiltration attempts where a user sends multiple files (more than 10) from Google Drive as email attachments to free email domains (e.g., gmail.com, aol.com, hotmail.com, outlook.com, icloud.com) within a one-hour window. This behavior can indicate an adversary attempting to move sensitive data out of the organization's controlled environment.
This rule identifies when a user shares a file from Google Drive with an email address belonging to a common free email domain (e.g., gmail.com, aol.com, hotmail.com, outlook.com, icloud.com). This activity is flagged as it may indicate an attempt at data exfiltration, where sensitive information is moved outside the organization's controlled environment to personal or untracked accounts.
This rule detects when a single user downloads results from multiple BigQuery tables within a one-hour window. This behavior can be indicative of data exfiltration attempts, where an attacker or insider is trying to extract a large amount of data from an organization's data warehouse.
This rule identifies when a Google Workspace user shares a file on Google Drive shortly after a suspicious login event has occurred. It correlates a successful login event flagged as suspicious with subsequent Google Drive file sharing activities (changing user access, document visibility, access scope, or ACL editors) by the same user within a one-hour window. This behavior could indicate an attacker gaining access to an account and then exfiltrating data.
This rule identifies when a single user copies a large number of files from Google Drive within a one-hour period. This behavior can be indicative of data exfiltration attempts, where an attacker or malicious insider is trying to move sensitive data out of the organization's control. The rule specifically looks for 'copy' or 'source_copy' events within Google Workspace Drive logs and triggers if more than 10 distinct documents are copied by the same user in an hour.
Identifies when a Google Workspace user downloads a file from Google Drive after a suspicious login event occurred.
Identifies when a user sends multiple files from Google Drive as an email attachment to a free email domain, which may indicate data exfiltration.
Identifies when a user deletes multiple files from Google Drive, which may indicate data destruction.
Identifies when a user downloads multiple files from Google Drive, which may indicate data exfiltration.
Detect a user downloads GCP BigQuery results from multiple tables which might indicate data exfiltration activity.
Identifies when a Google Workspace user shares a file on Google Drive after a suspicious login event occurred.
Page 30 of 31