Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,615 detections
Filters
Last updated
All Time
Detection languages
1,725
690
266
214
190
Contributors
985
505
494
256
209
Categories
814
787
730
629
473
Platforms
2,071
629
488
459
346
Products / Services
769
666
527
195
185
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
3,615
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
Detects a suspicious sequence of events where a host performs multiple reconnaissance-style probes (health checks, documentation, or OpenAPI definitions) followed within 10 minutes by access to sensitive artifact-related URLs on the same remote host. This pattern is indicative of an attacker profiling a target server for metadata and then proceeding to exfiltrate files or sensitive artifacts.
Detects unauthorized processes, excluding standard web browsers, accessing sensitive browser files such as Login Data, Cookies, Web Data, and Local State. This activity is indicative of credential harvesting malware attempting to steal authentication cookies, saved passwords, or browser profiles.
Detection of network traffic patterns associated with the NovaCookies Adversary-in-the-Middle (AiTM) phishing kit. The rules monitor for DNS queries for .vu domains, HTTP requests to lookalike Microsoft 365 login pages hosted on .vu domains, POST requests containing credential data, and the receipt of specific session cookies (ESTSAUTH) indicative of successful AiTM session interception.
Detects specific, targeted search operations within M365 environments for keywords related to payroll, HR, and banking information. This behavior is indicative of post-compromise reconnaissance activity, often following AiTM (Adversary-in-the-Middle) session hijacking where an attacker attempts to locate financial documents and payroll correspondence.
Detects the creation or modification of inbox rules in Microsoft 365 that filter messages containing financial keywords (e.g., 'direct deposit', 'bank') and perform actions designed to hide or suppress these emails (e.g., 'MoveToFolder', 'DeleteMessage', 'MarkAsRead', 'StopProcessingRules'). This behavior is commonly used by adversaries to hide notification emails regarding financial transactions, which could alert the user to unauthorized activity.
Detects M365 administrative actions related to mailbox forwarding rules or OAuth application consent that occur in the absence of a Multi-Factor Authentication (MFA) claim, particularly when preceded by non-interactive session events (LogonType 0) using REST client protocols. This pattern is indicative of potential session hijacking or token replay attacks, where an adversary leverages a compromised session to establish persistence or gain ongoing access to the environment without re-authenticating.
Detects the creation of an email inbox rule that includes both a concealment/deletion action and an external forwarding destination, occurring within 4 hours of a high-risk or compromised device-code authentication event. This pattern is indicative of account takeover where an attacker establishes persistence and exfiltration while hiding their activity.
Detects credential-phishing attempts originating from Proton Mail addresses that result in a user clicking on a link. The rule correlates email delivery from known Proton Mail domains with subsequent URL click events to identify potential Adversary-in-the-Middle (AiTM) activity, often associated with the Star Blizzard (COLDRIVER) threat group.
Detects a single Salesforce user or connected-app session performing an anomalous volume of SOQL queries against sensitive objects including Case, Account, Contact, and Opportunity. This behavior is indicative of mass data enumeration and potential exfiltration, as observed in historical incidents where attackers targeted CRM platforms to extract embedded secrets and sensitive record data.
Detects anomalous, high-volume data access patterns within Salesforce, specifically monitoring for bulk API or SOQL query requests by a single user or application. This behavior is indicative of mass data exfiltration from a CRM instance, a tactic observed in extortion-themed campaigns such as those associated with the ShinyHunters group.
Detects unauthenticated guest users abusing the Salesforce Experience Cloud Aura endpoint (/s/sfsites/aura) to perform high-volume metadata and schema enumeration. This activity typically involves tools like AuraInspector to harvest CRM data by repeatedly invoking Aura actions such as describeSObjects, getSObjectMetadata, ObjectInfoController, or RecordUiController.
Detects high-volume, unauthenticated or anonymous requests (GetObject, ListObjects, ListObjectsV2) against AWS S3 buckets. This behavior is consistent with mass enumeration or scanning activities often associated with data exfiltration attempts against misconfigured publicly-exposed storage buckets.
Detects high-volume data transfers (exceeding 100MB) from internal sources to known external cloud storage and file-sharing platforms. This behavior is consistent with data staging and exfiltration patterns, often used by threat actors to move collected data to attacker-controlled storage infrastructure.
Detects the loading of the 'WbElevation.dll' module associated with SectopRAT, followed by suspicious access to browser, email, or cryptocurrency wallet credential stores within a 10-minute window on the same device.
Detects anomalous file staging activity combined with keyword-matched file access or suspicious Steam application launches, characteristic of the Rapuncel (BoryptGrab) malware's credential and crypto-wallet harvesting routine.
Detects Node.js or Python processes exhibiting suspicious behavior consistent with information-stealing malware (such as BeaverTail or InvisibleFerret). The rule monitors for these processes accessing sensitive files, including browser credentials, cookies, browser extension wallet settings, cryptocurrency wallet files, and various identification document image types, followed by the execution of archiving utilities (e.g., zip, rar, 7z) to stage the collected data for exfiltration.
Detects a specific behavioral chain associated with the CHOSEN BRICK implant. This rule identifies when a suspected malicious process writes image/screenshot files (.png, .jpg, .bmp) to disk, followed by a network connection to the Telegram Bot API within a 15-minute window, suggesting potential data exfiltration.
Detects AI agent tooling (e.g., LangChain, Copilot, Claude Code) performing read operations on databases containing sensitive data patterns, or performing suspicious bulk data enumeration. The rule monitors Azure SQL Database security audit events for suspicious application name signatures and non-schema introspective queries.
Detects AI agent tooling (e.g., LangChain, Copilot, Claude Code) performing read operations on databases containing sensitive data patterns, or performing suspicious bulk data enumeration. The rule monitors Azure SQL Database security audit events for suspicious application name signatures and non-schema introspective queries.
Detects the use of legitimate data transfer utilities (s5cmd, rclone) configured to exfiltrate sensitive document types (.doc, .pdf, .sql, etc.) to S3-compatible cloud storage. The rule correlates this activity with recent access to files containing sensitive credentials or configuration data, a pattern observed in double-extortion campaigns.
Detects the use of legitimate data transfer utilities (s5cmd, rclone) configured to exfiltrate sensitive document types (.doc, .pdf, .sql, etc.) to S3-compatible cloud storage. The rule correlates this activity with recent access to files containing sensitive credentials or configuration data, a pattern observed in double-extortion campaigns.
Page 17 of 173