Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
Detects the creation or modification of Power Automate flows that involve potentially sensitive external services or personal email providers, which may indicate data exfiltration or unauthorized integration setup.
This rule correlates email sender activity with network, cloud, and identity logs by matching traffic against a specific IP range (160.79.104.0/21) identified as malicious or suspicious. The rule flags instances where this range appears as an email sender IP or as a remote/source IP address across various infrastructure indices, potentially indicating adversary communication or exfiltration.
This rule correlates email sender activity with network, cloud, and identity logs by matching traffic against a specific IP range (160.79.104.0/21) identified as malicious or suspicious. The rule flags instances where this range appears as an email sender IP or as a remote/source IP address across various infrastructure indices, potentially indicating adversary communication or exfiltration.
Detects potential exfiltration activity by identifying HTTP POST/PUT requests to known suspicious domains, including specific operator-controlled hosts and anonymous file sharing services, as well as the use of HTTP Range headers for bulk API data exfiltration.
Detects the creation of a new AWS S3 bucket followed by a large volume of data uploads (more than 200 objects) within a 2-hour window. The detection focuses on activity attributed to a single identity with limited source IP diversity, which is highly indicative of scripted data staging and potential exfiltration preparation by an unauthorized actor.
Detects anomalous high-volume access to Exchange Online via the One Outlook Web/Office client, potentially indicating data exfiltration or automated mass email access by a compromised account.
Detects instances where a user or entity accessing a file (download, access, or preview) originates from an IP address identified as an anonymous proxy. This rule is designed to be used with a downstream aggregation tool to identify potentially unauthorized data exfiltration or access via anonymization services.
This rule detects anomalous, high-volume file access or download activity across cloud applications and file storage services. It tracks users over a period of time, flagging individuals whose daily activity consistently contributes to a large total volume of data access (exceeding 500MB) over at least five days, specifically looking for sustained behavior that deviates from sudden, single-day spikes.
Detects anomalous data access or collection activity across multiple M365 workloads (SharePoint, OneDrive, Exchange). The rule identifies users exhibiting high volumes of file or mail access across at least two distinct workloads within a one-hour window, which may indicate account compromise, bulk data exfiltration, or unauthorized persistence via mailbox rules.
Detects automated file access and download operations in SharePoint or OneDrive performed by the 'python-httpx' library. This behavior may indicate an attacker using scripts or automated tools to perform unauthorized data collection or exfiltration, often observed in automated cloud compromise scenarios.
This rule detects high-volume file access, preview, or download activity from SaaS applications (SharePoint, OneDrive, Exchange Online) originating from IP addresses classified as anonymous proxies. The threshold is set to 1000 events within a 2-hour window, which is indicative of automated, high-speed data exfiltration rather than standard user behavior.
Detects anomalous, high-volume file access (downloading, accessing, or previewing) in cloud applications that originates from an IP address identified as an anonymous proxy. This behavior is indicative of potential data exfiltration or unauthorized mass data collection.
This rule detects potentially malicious interaction with specific GCP service account identifiers and client IDs. It monitors multiple log sources—including cloud audit logs, sign-in activity, security logs, and device network events—to identify unauthorized access, command and control communication, or data exfiltration attempts targeting Google API services (specifically oauth2.googleapis.com and sheets.googleapis.com).
Detects network activity communicating with Google Drive domains (drive.google.com and www.googleapis.com). This rule monitors outbound traffic, which may indicate the use of Google Drive as a command-and-control (C2) channel or for unauthorized data exfiltration.
Detects instances where an Artifactory process or user accesses highly sensitive configuration files (system.yaml, join.key) or API endpoints containing configuration data, followed closely (within 15 minutes) by an outbound network connection to a non-standard or external destination. This pattern is indicative of a potential credential theft attempt targeting the Artifactory join key, which is used to authenticate Artifactory nodes in a cluster, followed by potential data exfiltration or C2 communication using these credentials.
Detects anomalous, repeated 512KB multipart POST requests sent to a 'relay.php' endpoint, indicative of bulk data exfiltration performed by the CRPx0 ransomware prior to file encryption.
Detects instances where the outbound byte count to external (non-private) IP addresses for a source host significantly exceeds its historical hourly baseline. This detection is designed to identify potential data exfiltration stages occurring after system or network compromise.
Detects instances where the outbound byte count to external (non-private) IP addresses for a source host significantly exceeds its historical hourly baseline. This detection is designed to identify potential data exfiltration stages occurring after system or network compromise.
Detects instances where the outbound byte count to external (non-private) IP addresses for a source host significantly exceeds its historical hourly baseline. This detection is designed to identify potential data exfiltration stages occurring after system or network compromise.
Detects anomalous data access or collection activity across multiple M365 workloads (SharePoint, OneDrive, Exchange). The rule identifies users exhibiting high volumes of file or mail access across at least two distinct workloads within a one-hour window, which may indicate account compromise, bulk data exfiltration, or unauthorized persistence via mailbox rules.
Detects a sequence of events starting with a device code OAuth sign-in, followed within two hours by the creation or modification of inbox rules and high-frequency enumeration of email items (contacts, folders, messages, threads, people) via Microsoft Graph API. This behavior is indicative of post-compromise activity where an adversary uses OAuth device code grants to maintain access and subsequently automates inbox analysis or data harvesting.
Page 32 of 124