Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,615 detections
Filters
Last updated
All Time
Detection languages
1,725
690
266
214
190
Contributors
985
505
494
256
209
Categories
814
787
730
629
473
Platforms
2,071
629
488
459
346
Products / Services
769
666
527
195
185
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
3,615
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
This rule detects a high volume of network connections (10 or more within an hour) from a single process to remote URLs containing 'artifact' or 'maven' on standard HTTP (port 80) or HTTPS (port 443) ports. This activity could indicate legitimate software development or build processes, but also potentially malicious activities such as supply chain compromise, data staging, or exfiltration of development-related artifacts.
This rule detects an unusually high number of web search queries (identified by 'search' or 'query' in the URI) originating from a single IP address within a one-hour window. A threshold of 100 or more queries triggers the alert. This behavior could indicate automated activity such as web scraping, reconnaissance, or a denial-of-service attempt against the search functionality.
This rule detects when a user creates two or more email forwarding rules within a one-hour period in Exchange Online. This behavior can indicate an adversary setting up persistence or exfiltration mechanisms for email.
Detects when a single user account creates 5 or more files within an hour that contain keywords like 'confidential', 'secret', or 'restricted' in their filenames. This behavior could indicate an attempt to stage sensitive data for exfiltration or unauthorized access to sensitive information.
This rule detects when sharing inheritance settings are modified in SharePoint. This could indicate an attempt to broaden access to sensitive information, a misconfiguration, or an attacker attempting to maintain access or exfiltrate data.
Detects an unusually high number of file copy operations to 'public' or 'external' folders within a one-hour window, initiated by the same process account. This behavior could indicate data exfiltration or unauthorized data staging.
This rule identifies accounts that create or modify 10 or more files, each larger than 200MB, within a one-hour period. This behavior can be indicative of data exfiltration, staging of large files, or other suspicious bulk file operations.
Detects requests for a specific favicon image (`/img/ib99-hq.ico`) that is consistently used across all deployments of a threat actor's Next.js gambling kit. This kit is associated with the "Borrowed Trust" campaign. The rule identifies these requests in both endpoint network telemetry and perimeter proxy/firewall logs, indicating potential reconnaissance or active exploitation attempts targeting systems hosting this gambling kit.
This rule detects attempts to exfiltrate clipboard data over HTTP using a POST request. It specifically looks for HTTP POST requests where the URI or content contains the string "clipboard" (case-insensitive). This behavior is indicative of malware or malicious scripts trying to steal sensitive information copied by the user.
Detects bulk access to internal information repositories for data collection
This rule detects potential data exfiltration of removable media file contents over HTTP. It specifically looks for HTTP POST requests to a URI containing "upload" with a payload size greater than 50,000 bytes. A threshold is applied to prevent excessive alerts, triggering if 5 such events occur from the same source within 60 seconds.
This rule detects a high volume of requests to download repository archives from a GitLab instance. Specifically, it triggers when 10 or more HTTP requests containing '/repository/archive' in the URI and 'gitlab.' in the HTTP host header are observed from the same source IP within a 60-second window. This behavior could indicate an attempt to exfiltrate data by bulk downloading repository contents.
This rule detects potential bulk downloads from SharePoint document libraries. It triggers when a client makes 30 or more HTTP requests to a SharePoint API endpoint related to web lists ('/_api/web/lists') within a 60-second window. This behavior can indicate an attempt to exfiltrate a large amount of data from SharePoint.
This rule detects when an Outlook OST (Offline Storage Table) file is accessed over SMB (Server Message Block) protocol. The detection is triggered by the presence of the string ".ost" (case-insensitive) in the network traffic on port 445 (SMB). This activity could indicate an attempt to collect local email data.
This rule detects when a network device configuration is transferred via TFTP. It specifically looks for UDP traffic on port 69 (TFTP's default port) and checks for the byte sequence "|00 02|" at the beginning of the payload, which corresponds to a TFTP read request (opcode 2). This activity is often associated with attackers collecting configuration files from network devices.
This rule detects Simple Network Management Protocol (SNMP) Bulk Get requests targeting port 161 on the home network, specifically looking for a content byte pattern indicative of MIB (Management Information Base) configuration data. It uses a threshold of 20 such requests within 30 seconds from the same source IP to trigger an alert, suggesting a network scan or reconnaissance activity.
This rule detects a Simple Network Management Protocol (SNMP) Management Information Base (MIB) walk dump, which is often used for configuration collection. It specifically looks for UDP traffic destined for port 161 (the standard SNMP port) within the home network, containing the byte sequence "30 82" at a depth of 2 bytes. A threshold of 50 such events from the same source within 30 seconds triggers the alert, indicating a potential network scan or reconnaissance activity.
This rule detects attempts to access network device configurations via SNMP (UDP port 161) by looking for the string "public" in the UDP payload. A threshold of 10 occurrences within 30 seconds from the same source IP is set to trigger an alert, indicating a potential network scan or reconnaissance activity targeting SNMP with a common community string.
This rule detects bulk harvesting of Microsoft Teams messages via the Graph API. It triggers when a client makes 20 or more HTTP requests within 60 seconds to graph.microsoft.com with URIs containing both '/teams/' and '/messages'. This behavior could indicate an attempt to exfiltrate a large volume of communication data from Microsoft Teams.
This rule detects large internal data transfers within the network. Specifically, it triggers when the data size of an established TCP flow exceeds 65000 bytes. A threshold is applied, alerting if 50 such transfers occur from the same source within a 60-second window. This behavior is often associated with internal data staging, a technique used by attackers to collect and consolidate data before exfiltration.
Monitors for network connections originating from the VSCode extension host process to GitHub API endpoints immediately following a new extension installation. This may indicate token exfiltration or repository enumeration from a malicious extension.
Page 122 of 173