Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
2
1
1
Contributors
2
1
1
Categories
3
2
1
1
1
Platforms
3
1
1
1
1
Products / Services
2
1
1
1
1
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
2
IDS Protocols
2
Detects non-browser automated HTTP clients (e.g., Python, Wget, Curl, Scrapy) downloading audio/video files from corporate public-facing pages such as Investor Relations, Press Releases, and Executive profiles. This activity is indicative of malicious reconnaissance used to harvest voice or video samples for synthetic media (deepfake) creation for future social engineering or impersonation attacks.
Detects high-volume Microsoft Graph API and SCIM endpoint enumeration consistent with employee directory scraping, potentially by threat groups like BlackFile/Cordial Spider. This rule identifies suspicious activity based on a high count of directory queries or distinct URIs accessed within a short time frame, originating from non-Microsoft/Google/Amazon/IBM ASNs and using common scripting/API user agents.
This rule detects potential staff directory scraping by monitoring HTTP GET requests to URIs containing the word "staff". It triggers an alert if more than 20 such requests are observed from a single source IP within a 30-second window, indicating automated or rapid enumeration attempts.
This rule detects potential employee directory enumeration attempts via web requests. It triggers when HTTP URI content contains both 'directory' and 'people' (case-insensitive) within a 60-second window from the same source IP, with a threshold of 10 occurrences. This behavior is indicative of an attacker attempting to discover employee information or organizational structure.