Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
Detects Google Workspace bulk export/Takeout activity occurring shortly after an OAuth grant or app-password creation, or an unusual volume of export/download events, consistent with automated Gmail/Docs/Keep data exfiltration.
Detects high-risk user behavior associated with unsanctioned or restricted Generative AI applications, specifically targeting large data uploads (potential data exfiltration) or repeated access following a coaching intervention.
This rule detects data synchronization activities between sanctioned enterprise applications and unsanctioned or personal cloud applications using Netskope logs. This pattern often indicates potential shadow IT usage or unauthorized data exfiltration from controlled environments to personal storage services.
Detects DLP events from Netskope where sensitive data (PII, PCI, Source Code, or Credentials) is being uploaded or shared, indicating potential data exfiltration.
Detects instances where sensitive or organizational data is uploaded to public text storage repositories like Pastebin or GitHub Gists through Netskope, which may indicate data exfiltration.
Detects execution of RClone from non-standard directories or outbound transfer to cloud endpoints outside an approved destination list, consistent with Gunra's pre-encryption data-exfiltration tooling.
This rule detects high volumes of network traffic originating from processes other than common web browsers (chrome, msedge, firefox) to specific edge computing and logging infrastructure (ingest.sentry.io, workers.dev, pages.dev). This behavior is indicative of non-browser processes, potentially malicious implants or scripts, using legitimate cloud-based edge services as command-and-control (C2) infrastructure or for data exfiltration.
GitHub Public Repository Created
Cortex XDR
Detects the creation of a new public repository within GitHub. This activity, while often legitimate, poses a potential data exposure risk by making code or sensitive assets publicly accessible. The rule identifies events where repository visibility is explicitly set to public for governance and security review.
This rule detects high volumes of network traffic originating from processes other than common web browsers (chrome, msedge, firefox) to specific edge computing and logging infrastructure (ingest.sentry.io, workers.dev, pages.dev). This behavior is indicative of non-browser processes, potentially malicious implants or scripts, using legitimate cloud-based edge services as command-and-control (C2) infrastructure or for data exfiltration.
Detects bulk SharePoint/M365 file access or download either from a known UNC6671 exfiltration IP, or via a scripting-library user agent that is new for the user and exceeds a volume threshold within a short session window.
Detects potentially unauthorized or suspicious file activities such as bulk downloads, external file sharing, or CASB policy violations monitored by Zscaler ZIA, which may indicate data exfiltration or policy non-compliance.
Detects users who have downloaded more than 50 files from cloud storage applications within a single hour, potentially indicating data exfiltration or mass data harvesting.
Detects instances where a single user account performs a large volume of file downloads (50 or more unique files) within a 30-minute window from Office 365 services. This behavior may indicate unauthorized data exfiltration or mass collection of sensitive information.
This one's the interesting bit they're using Ethereum RPC calls as a C2channel and dumping stolen secrets to attacker-owned public repos tagged "Shai-Hulud: Here We Go Again". Also flags Claude/VS Code config file writes dropped by the worm for lateral persistence across dev machines.
This hunting query detects potential data exfiltration by identifying users whose outbound data volume to cloud storage and messaging platforms: (OneDrive, Dropbox, Google Drive, SharePoint, Telegram) spikes dramatically compared to their own historical behavior.
It uses a per-user adaptive baseline approach rather than static thresholds, making it more resilient to normal variance in user upload habits while still flagging statistically abnormal spikes.
MITRE ATT&CK Mapping
Tactic: Exfiltration (TA0010)
Technique: T1567 – Exfiltration Over Web Service
Sub-technique T1567.002 – Exfiltration to Cloud Storage
Data Source
DeviceNetworkEvents (Microsoft Defender for Endpoint / Microsoft 365 Defender advanced hunting schema)
Logic Breakdown:
Baseline window (31 days, excluding the most recent day):
The query calculates each user's average daily upload volume (BytesSent) to a defined set of cloud storage/messaging destinations over the trailing 31 days, ending 1 day ago. This establishes a personal historical norm per user.
Global peer baseline fallback:
For users with little or no prior upload history (average below minBaselineFloor = 1 MB), the query substitutes a global average across all users (globalPeerBaseline) — or the 1 MB floor, whichever is higher — to avoid division-by-near-zero producing artificially inflated ratios for low-activity users.
Today's upload volume:
Sums BytesSent to the same destination patterns over the last 24 hours per user.
Ratio comparison:
Joins today's upload volume against each user's effective baseline and computes UploadRatio = TodayUpload / EffectiveBaseline.
Alert conditions (both must be true):
UploadRatio > 5 — today's upload is more than 5x the user's normal daily average.
TodayUpload > minUploadFloor (100 MB) — an absolute floor ensuring small, low-value increases (e.g., 1 KB → 6 KB) don't trigger noise alerts even if the ratio is high.
Output: Results sorted by UploadRatio descending, surfacing the most anomalous users firs
It uses a per-user adaptive baseline approach rather than static thresholds, making it more resilient to normal variance in user upload habits while still flagging statistically abnormal spikes.
MITRE ATT&CK Mapping
Tactic: Exfiltration (TA0010)
Technique: T1567 – Exfiltration Over Web Service
Sub-technique T1567.002 – Exfiltration to Cloud Storage
Data Source
DeviceNetworkEvents (Microsoft Defender for Endpoint / Microsoft 365 Defender advanced hunting schema)
Logic Breakdown:
Baseline window (31 days, excluding the most recent day):
The query calculates each user's average daily upload volume (BytesSent) to a defined set of cloud storage/messaging destinations over the trailing 31 days, ending 1 day ago. This establishes a personal historical norm per user.
Global peer baseline fallback:
For users with little or no prior upload history (average below minBaselineFloor = 1 MB), the query substitutes a global average across all users (globalPeerBaseline) — or the 1 MB floor, whichever is higher — to avoid division-by-near-zero producing artificially inflated ratios for low-activity users.
Today's upload volume:
Sums BytesSent to the same destination patterns over the last 24 hours per user.
Ratio comparison:
Joins today's upload volume against each user's effective baseline and computes UploadRatio = TodayUpload / EffectiveBaseline.
Alert conditions (both must be true):
UploadRatio > 5 — today's upload is more than 5x the user's normal daily average.
TodayUpload > minUploadFloor (100 MB) — an absolute floor ensuring small, low-value increases (e.g., 1 KB → 6 KB) don't trigger noise alerts even if the ratio is high.
Output: Results sorted by UploadRatio descending, surfacing the most anomalous users firs
This rule detects anomalous, high-volume file access activity within SharePoint by monitoring the 'FileAccessed' operation. It calculates a 14-day rolling baseline for each user and triggers an alert when the hourly 'FileAccessed' count significantly exceeds this baseline, specifically when no corresponding 'FileDownloaded' events are present. This behavior aims to detect stream-based data exfiltration techniques that bypass standard download-based DLP controls.
Detects anomalous spikes in per-user M365 (SharePoint and Exchange) activity volume by comparing current 15-minute intervals against a 30-day rolling baseline (mean + 3 standard deviations). This behavior may indicate mass data staging or exfiltration activities common in precursor phases of extortion or data theft.
This rule detects high-volume file access or download operations in SharePoint or OneDrive, performed by non-browser user agents (e.g., Python, PowerShell, cURL, Go). An elevated volume of such actions within a short timeframe is indicative of automated, scripted interaction, which may represent malicious data exfiltration, automated content scraping, or potential account compromise.
Detects SilentDataCollector uploading AES-CBC encrypted, specifically-named archives (desktop_files, pass_V, wallet_V, filelist.zip.encrypted, documents<n>.zip) to the compromised WordPress C2.
Detects potentially unauthorized or suspicious file activities such as bulk downloads, external file sharing, or CASB policy violations monitored by Zscaler ZIA, which may indicate data exfiltration or policy non-compliance.
This rule detects data synchronization activities between sanctioned enterprise applications and unsanctioned or personal cloud applications using Netskope logs. This pattern often indicates potential shadow IT usage or unauthorized data exfiltration from controlled environments to personal storage services.
Page 39 of 124