Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,613 detections
Filters
Last updated
All Time
Detection languages
1,725
690
264
214
190
Contributors
985
505
494
256
209
Categories
814
787
728
629
473
Platforms
2,069
629
488
459
346
Products / Services
769
666
525
193
185
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
3,613
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
Alert when a user has performed an export to a search using 'New-ComplianceSearchAction' with the '-Export' flag. This detection will detect PST export even if the 'eDiscovery search or exported' alert is disabled in the O365.This rule will apply to ExchangePowerShell usage and from the cloud.
Detects attempts to use screencapture to collect macOS screenshots
Cisco Collect Data
Sigma
Collect pertinent data from the configuration files
Detects usage of the 'Get-Clipboard' cmdlet via CLI
Detects adding and using Exchange PowerShell snap-ins to export mailbox data. As seen used by HAFNIUM and APT27
Detects dump of credentials in VeeamBackup dbo
Detects Processes accessing the camera and microphone from suspicious folder
Identifies potential full network packet capture in gcp. This feature can potentially be abused to read sensitive data from unencrypted internal traffic.
Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed.
Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.
Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.
Potential adversaries accessing the microphone and webcam in an endpoint.
Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database).
Used to access information such as the AD FS configuration settings which contains sensitive information used to sign SAML tokens.
Used to access information such as the AD FS configuration settings which contains sensitive information used to sign SAML tokens.
Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration.
An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
A General detection for the Get-Clipboard commands in PowerShell logs. This could be an adversary capturing clipboard contents.
Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration.
An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
Detects PowerShell scripts that contains reference to keystroke capturing functions
Detects audio capture via PowerShell Cmdlet.
Detects execution of Windows Problem Steps Recorder (psr.exe), a utility used to record the user screen and clicks.
Detects the use of rar.exe, on the command line, to create an archive with password protection or with a specific compression level. This is pretty indicative of malicious actions.
Detect attacker collecting audio via SoundRecorder application.
Detects potentially suspicious SQL queries using SQLCmd targeting the Veeam backup databases in order to steal information.
Detects execution of WinRAR in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.
Page 171 of 173