Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,613 detections
Filters
Last updated
All Time
Detection languages
1,725
690
264
214
190
Contributors
985
505
494
256
209
Categories
814
787
728
629
473
Platforms
2,069
629
488
459
346
Products / Services
769
666
525
193
185
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
3,613
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
Detects a suspicious pattern where a user authenticates to a remote access portal (like Citrix or VPN) without multi-factor authentication (MFA) or with an existing risk flag, followed by a surge in file activity (creation, modification, or renaming of >500 files or >200 distinct files) on the same account within a 24-hour window, potentially indicating compromised credential usage for staging data for exfiltration or ransomware.
Detects the use of legitimate archival utilities (such as 7-Zip, WinRAR, tar) or scripting engines (PowerShell) to compress or package sensitive browser profile artifacts like 'Login Data', 'Cookies', or 'Local State'. This behavior is a common indicator of credential harvesting and data staging activity by infostealers prior to exfiltration.
Detects unauthorized access to or generation of Citrix NetScaler core dump files, trace outputs, or memory diagnostic artifacts. These artifacts are high-value targets for attackers, such as those exploiting CVE-2026-88772, who attempt to extract session tokens, credentials, and sensitive data residing in memory via these diagnostic mechanisms.
Detects an anomalous volume of file downloads from SharePoint or OneDrive by a user on an unmanaged, non-compliant device, shortly following a suspicious or risky sign-in event. The rule establishes a baseline for individual user behavior over 30 days and alerts when the current hourly download activity significantly exceeds that baseline.
Detects unauthorized access or modification attempts to common web browser credential storage files (such as 'Login Data' or 'key4.db') by processes other than standard, trusted web browsers (e.g., Chrome, Edge, Firefox). This behavior is indicative of credential harvesting, where an adversary attempts to steal saved login information from browser data stores.
This rule detects potentially compromised accounts by correlating suspicious authentication activity (such as risky sign-ins, impossible travel, or malicious OAuth/Mail-rule configurations) with a subsequent spike in SharePoint or OneDrive file access, downloads, or external link sharing within a one-hour window. This behavior is indicative of an adversary performing cloud-based data exfiltration after gaining unauthorized access to an account.
Detects DNS resolution attempts for newly registered or suspicious top-level domains (e.g., .xyz, .top, .live) that mimic corporate Identity Provider (IdP) or Single Sign-On (SSO) login portals. This behavior is characteristic of Adversary-in-the-Middle (AiTM) phishing kits like EvilProxy or Tycoon2FA, intended to capture user session tokens. Note: This rule monitors for initial domain contact and should be correlated with subsequent authentication logs to identify potential session hijacking.
Detects potential insider threats or departing employees by correlating abnormal bulk data downloads from cloud repositories (SharePoint/OneDrive/Box/etc.) with subsequent sensitive data access and exfiltration signals. It uses baseline behavioral profiling, requires a threshold of sensitive file interactions, and mandates high-confidence exfiltration indicators (removable media usage, suspicious external domains, or multiple combined destination events) to reduce noise. Archive/staging activity is used as an optional confidence booster.
Detects unauthorized processes accessing sensitive credential storage files (e.g., 'Login Data', 'Cookies', 'Local State') from known Chromium-based browser profile directories. This activity is indicative of credential harvesting by infostealer malware attempting to exfiltrate browser data before performing decryption.
Detects unauthorized access, reading, or downloading of sensitive NetScaler system files, including configuration files (ns.conf), licensing files, and cryptographic material (private keys/certificates). This activity often indicates post-exploitation reconnaissance, staging, or data theft attempts following initial access.
Detects the use of legitimate data transfer utilities (s5cmd, rclone) configured to exfiltrate sensitive document types (.doc, .pdf, .sql, etc.) to S3-compatible cloud storage. The rule correlates this activity with recent access to files containing sensitive credentials or configuration data, a pattern observed in double-extortion campaigns.
This rule detects potential browser-based credential and session theft by monitoring for a process that accesses multiple sensitive web browser artifacts (cookies, local state, session storage) across several user profiles in a short timeframe. It correlates this activity with the subsequent creation of a compressed archive in a temporary directory followed by an outbound network connection, indicating a multi-stage exfiltration workflow.
Detects unauthorized processes attempting to read sensitive session files or databases associated with messaging applications like Telegram, Signal, and Discord. Accessing these files (such as 'tdata', 'db.sqlite', or 'leveldb') allows for full account takeover by extracting session tokens, enabling attackers to bypass authentication and 2FA.
Detects the creation or modification of Exchange mailbox rules using the New-InboxRule or Set-InboxRule cmdlets that perform automatic forwarding or redirection of email to external, non-trusted domains. This technique is commonly employed during account takeover events to facilitate covert data exfiltration.
Detects anomalous high-volume download or 'GetObject' operations from a single identity across multiple cloud storage objects and buckets within a short time window, which is indicative of bulk data exfiltration.
Detects the use of ntdsutil.exe to create an Install From Media (IFM) backup of the Active Directory database (NTDS.dit) to a non-standard location, followed closely by the use of 7-Zip (7z.exe or 7za.exe) to archive that specific backup directory, which is a common indicator of credential dumping and exfiltration staging.
Detects high-risk GitHub events indicating data or asset exposure, such as creating public repositories with specific naming conventions, changing private repositories to public, or creating new gists, which could indicate exfiltration of sensitive assets or information.
Detects a suspicious pattern where a user authenticates to a remote access portal (like Citrix or VPN) without multi-factor authentication (MFA) or with an existing risk flag, followed by a surge in file activity (creation, modification, or renaming of >500 files or >200 distinct files) on the same account within a 24-hour window, potentially indicating compromised credential usage for staging data for exfiltration or ransomware.
This rule monitors for the addition of new credentials (secrets) to service principals or applications in an Azure/Entra ID environment. It then correlates this event with subsequent mailbox activity (such as accessing mail items, sending mail, or message binding) performed by the application within 7 days of the credential creation. This detection pattern is indicative of potential OAuth application-based persistence and mailbox data exfiltration.
Detects anomalous, high-volume data retrieval from Salesforce via OAuth-authenticated Connected Apps using SOQL or Bulk API. This behavior is indicative of a compromised integration token being used by an adversary to exfiltrate sensitive CRM data, such as User, Account, Case, or Opportunity records, by bypassing standard user interface workflows.
Detects unauthorized sharing, copying, or exporting of EBS, disk, or database snapshots to external cloud accounts, subscriptions, or projects that are not present in the defined trusted allow-list for AWS, Azure, or GCP environments.
Page 4 of 173