Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,613 detections
Filters
Last updated
All Time
Detection languages
1,725
690
264
214
190
Contributors
985
505
494
256
209
Categories
814
787
728
629
473
Platforms
2,069
629
488
459
346
Products / Services
769
666
525
193
185
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
3,613
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
Detects the creation or modification of Exchange mailbox or transport rules that exhibit suspicious characteristics, such as external forwarding, movement to hidden or system folders, automatic deletion/marking as read, or rules containing keywords related to financial fraud. The rule specifically monitors for activities occurring via non-standard or automated clients to increase detection fidelity.
This rule detects potentially compromised accounts by correlating suspicious authentication activity (such as risky sign-ins, impossible travel, or malicious OAuth/Mail-rule configurations) with a subsequent spike in SharePoint or OneDrive file access, downloads, or external link sharing within a one-hour window. This behavior is indicative of an adversary performing cloud-based data exfiltration after gaining unauthorized access to an account.
Detects the creation or modification of Exchange inbox rules that involve suspicious actions, such as forwarding or redirecting emails to external domains, deleting messages, or marking messages as read. These actions are common indicators of persistent access or data exfiltration attempts following a mailbox compromise.
Detects mailbox configuration changes in Exchange Online where email forwarding (ForwardingSmtpAddress, ForwardingAddress, or DeliverToMailboxAndForward) is enabled to an external, non-tenant domain. This technique is commonly used for persistence and data exfiltration following account compromise, allowing attackers to redirect incoming communications to an external mailbox even after the original account credentials have been reset.
Detects high-volume file download activity in Office 365/SharePoint/OneDrive audit logs. The rule correlates download spikes with users who have recently triggered security alerts related to session hijacking, token theft, or risky sign-ins, which are indicators of a potential cloud account takeover scenario.
Detects unauthorized access to sensitive Chromium-based browser files such as 'Login Data' (password database) or 'Local State' (encryption keys) by processes other than standard web browsers (Chrome, Edge, Brave, Firefox). The rule also elevates risk if the access is followed by the execution of known data-handling tools like sqlite, python, or powershell, which are frequently used by information stealers to parse and exfiltrate browser-stored credentials.
Detects bulk mailbox export or content search operations performed by an identity shortly after a high-risk sign-in event. This pattern is indicative of potential account takeover where an adversary attempts to harvest sensitive email data at scale for BEC or extortion.
Detects when a user account that has exhibited anomalous or risky sign-in behavior subsequently grants mailbox delegation, full-access, or Send-As permissions to another user (who is not the mailbox owner). This activity is indicative of a compromised account being used to establish persistence or facilitate email exfiltration and spoofing by expanding access to sensitive mailboxes.
Detects modifications to AWS S3 bucket Access Control Lists (ACLs) using the 'PutBucketAcl' API call that grant public read or write permissions. This could indicate an attempt to make sensitive data stored in S3 publicly accessible, potentially leading to data exfiltration.
Detects modifications to AWS S3 bucket Access Control Lists (ACLs) using the 'PutBucketAcl' API call that grant public read or write permissions. This could indicate an attempt to make sensitive data stored in S3 publicly accessible, potentially leading to data exfiltration.
Detects 'PutBucketPolicy' API calls in AWS CloudTrail where the policy is modified to grant 'Allow' access to a wildcard ('*') or anonymous principal, without including restrictive conditional requirements such as VPC endpoints or organizational ID constraints. This behavior is a common precursor to data exfiltration from misconfigured S3 buckets.
Detects high-volume mailbox item access (MailItemsAccessed) within 15-minute intervals, correlated with risky Entra ID sign-in events within a 60-minute window. This behavior is indicative of automated mail reconnaissance or data exfiltration following potential cloud account compromise.
Detects processes that access multiple categories of sensitive data (browser autofill, cryptocurrency wallets, password manager exports, or system fingerprinting files) within a short time window. This behavior is highly indicative of modular infostealers or data-collection malware conducting 'stacking access' to stage sensitive information for exfiltration.
Detects the creation or modification of inbox rules in Office 365 that exhibit suspicious characteristics, such as external forwarding, automatic deletion/moving of sensitive emails (e.g., security alerts, junk), or rules containing keywords related to fraud. The rule optionally correlates this activity with recent anomalous sign-in attempts by the same user to identify potential account compromise.
Detects the staging of ChainScript files into specific, masquerading subdirectories within user AppData folders that mimic legitimate Windows system paths. This activity is indicative of the _scatter.ps1 script redistributing components such as the Node.js runtime, agent configuration, and helper utilities before execution.
Detects Node.js or Python processes exhibiting behavior characteristic of information-stealing malware (such as the WaterPlum suite: BeaverTail, InvisibleFerret, OtterCookie, StoatWaffle). The rule monitors for these processes accessing sensitive files related to browser credentials, cryptocurrency wallets, scanned identification documents, or performing collection activities like keylogging and screen capturing.
Detects execution of the CHOSEN BRICK implant (process names smdqservice.exe or winappx.exe) initiating a network connection to Telegram infrastructure (C2) followed by a network connection to a cloud object-storage provider (vultrobjects.com, storjshare.io, or backblazeb2.com) for data exfiltration within a 30-minute window.
This rule detects activities indicative of an attacker attempting to establish an adversary-in-the-middle (AiTM) position within an on-premises network. It flags potential NTLM relay attempts (via loopback or invalid workstation indicators) and unauthorized name resolution spoofing (LLMNR/NBT-NS) used to intercept and relay authentication traffic for MFA bypass or credential theft.
Detects anomalous file access patterns by Semantic Kernel agent processes attempting to read sensitive host files such as SSH keys, configuration files, and credential stores. This activity is indicative of malicious use of agent file-transfer capabilities, potentially exploiting path traversal vulnerabilities or prompt injection to exfiltrate sensitive data from the host environment into the agent sandbox.
Detects the presence of configuration markers associated with cryptocurrency clipboard-swapping malware. The rule monitors process command lines for specific flags (e.g., 'cclipper', 'clipboard_check_delay') and cryptocurrency wallet address dictionary keys, which are common indicators of malicious software designed to replace legitimate destination wallet addresses copied to the clipboard with attacker-controlled addresses.
Detects suspicious activity associated with the DarkMe RAT, specifically targeting cryptocurrency wallet data files. The rule correlates file access to known wallet data paths by a hollowed process 'clspack.exe', followed by suspicious outbound network activity originating from that same process, and potentially preceded by WMI-based antivirus enumeration.
Page 14 of 173