Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,615 detections
Filters
Last updated
All Time
Detection languages
1,725
690
266
214
190
Contributors
985
505
494
256
209
Categories
814
787
730
629
473
Platforms
2,071
629
488
459
346
Products / Services
769
666
527
195
185
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
3,615
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
This rule detects suspicious NTLM network or remote interactive logon activity. It specifically looks for multiple distinct accounts logging in from the same device and remote IP address within a one-hour window, using NTLM authentication via NtLmSsp or Seclogon processes. This pattern can indicate credential stuffing, NTLM relay attacks, or other forms of credential misuse.
This rule detects multiple unauthorized access attempts to files identified as machine learning models, weights, or checkpoints. It specifically looks for Security Event ID 4656 (Auditing of object access) where the object name contains keywords like 'model', 'weights', or 'checkpoint', and the access mask indicates unauthorized access attempts (0x0001 for ReadData or ListDirectory, 0x0002 for WriteData or AddFile). The rule then summarizes these attempts by user, computer, and hour, triggering an alert if 5 or more attempts are made within an hour.
Detects access to credential files through web shell commands
This rule detects potential session hijacking or token replay attacks against Okta by identifying a single Okta session (externalSessionId) being used from multiple distinct origins. It specifically looks for divergence in client country, device hash (dtHash), or operating system within the same session, rather than just multiple IP addresses, to reduce false positives. This behavior is indicative of a stolen post-MFA cookie being replayed by an attacker.
This rule detects potential data staging activity on a remote SMB share. It specifically looks for traffic to port 445 (SMB) containing 'ADMIN$' (case-insensitive) with a data size greater than 65000 bytes. A threshold of 20 such events within 60 seconds from the same source IP will trigger an alert, indicating a high volume of data being transferred to an administrative share, which could precede exfiltration.
This rule detects a high volume of HTTP requests to the Confluence REST API endpoint '/rest/api/content'. This pattern of access could indicate an attempt to bulk download content from Confluence spaces, potentially for data exfiltration or reconnaissance purposes. The threshold is set to trigger if 30 such requests are observed from a single source IP within a 60-second window.
This rule detects a high volume of HTTP requests to a Confluence Wiki instance that include both '/wiki/' and 'export' in the URI. Specifically, it triggers if 10 such requests are observed from the same source IP within a 60-second window. This behavior could indicate an attempt to bulk export pages from a Confluence Wiki, potentially for data exfiltration.
This rule detects bulk data access from an internal information repository. It triggers when a single source IP address performs 50 or more HTTP GET requests within a 30-second window to any destination. This behavior could indicate an attempt to exfiltrate or rapidly collect large amounts of data from internal web-based resources.
This rule detects attempts to create or modify email forwarding rules in Office 365 via the Microsoft Graph API. Specifically, it looks for HTTP POST requests to the '/mailFolders/inbox/messageRules' endpoint on 'graph.microsoft.com'. This activity can indicate an attacker setting up an inbox rule to forward emails to an external address for data exfiltration or to maintain persistence.
This rule detects potential email harvesting attempts via Exchange Web Services (EWS). It specifically looks for HTTP requests to the '/EWS/Exchange.asmx' endpoint containing 'FindItem' in the client body, indicating an attempt to enumerate or search for items (like emails) within mailboxes. A threshold is applied to prevent excessive alerts from legitimate, but frequent, EWS activity.
This rule detects attempts to stage large amounts of data (over 65KB) to common cloud storage services (Amazon S3, Azure Blob Storage, Google Cloud Storage) via HTTP PUT requests. This activity is indicative of data being prepared for exfiltration.
This rule detects HTTP POST requests that contain data resembling a ZIP archive (indicated by 'PK' header) and have a size greater than 50,000 bytes. This pattern is often associated with data exfiltration where collected data is archived before being sent out of the network.
This rule detects a high volume of HTTP GET requests to Azure Blob Storage, specifically targeting '.blob.core.windows.net' domains. A threshold of 50 requests within 60 seconds from a single source IP address triggers the alert, indicating a potential bulk data download activity. This could be indicative of data exfiltration or unauthorized access to cloud storage.
This rule detects a high volume of HTTP GET requests to AWS S3 buckets from a single source IP address within a short timeframe. Specifically, it triggers if more than 50 GET requests are observed within 60 seconds to hosts matching 's3.amazonaws.com' or '.s3.' patterns. This behavior can indicate an attempt to exfiltrate data or perform bulk collection from an S3 bucket.
This rule detects JavaScript code being delivered to a client that attempts to capture form field data, specifically looking for 'document.querySelector', 'password', and 'fetch(' within HTTP response data. This behavior is indicative of an attempt to exfiltrate credentials from a login page.
This rule detects the presence of a web portal login page skimmer script by looking for specific JavaScript keywords within HTTP response data. It specifically searches for the combination of 'addEventListener', 'keydown', and 'XMLHttpRequest' (case-insensitive) in the data flowing from the server to the client. This combination suggests a script designed to capture user input (like keystrokes) and exfiltrate it via XMLHttpRequest, a common technique used by web skimmers to steal credentials.
This rule detects attempts to spoof a Windows login credential dialog box over HTTP. It specifically looks for the string "CredUIPromptForCredentials" (case-insensitive) within the file data of HTTP traffic flowing from the server to the client. This string is associated with the Windows Credential UI API, and its presence in unexpected contexts, especially in HTTP responses, could indicate a phishing attempt or malware trying to trick users into entering credentials.
Detects the execution of 7-Zip with specific command-line arguments (password protection, zip format, mx5 compression) used by NightSpire ransomware for data staging prior to exfiltration.
This rule detects an unusually high volume of SharePoint sharing invitation creations or sharing setting modifications by a single user within an hour. This could indicate an attacker attempting to exfiltrate data or broadly share sensitive information.
Detects access to clipboard content via osascript, which may be used for data collection but also occurs in legitimate clipboard utilities and automation scripts
This rule detects attempts to exploit a Local File Inclusion (LFI) vulnerability to read the Windows Security Account Manager (SAM) database. It specifically looks for HTTP requests containing the string "\windows\system32\config\sam" in the URI, which is a common path for the SAM file on Windows systems. Successful exploitation of such a vulnerability could lead to the disclosure of hashed user credentials.
Page 125 of 173