Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,241 copies160 likes55,538 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
This rule detects when a user creates two or more email forwarding rules within a one-hour period in Exchange Online. This behavior can indicate an adversary setting up persistence or exfiltration mechanisms for email.
Detects when a single user account creates 5 or more files within an hour that contain keywords like 'confidential', 'secret', or 'restricted' in their filenames. This behavior could indicate an attempt to stage sensitive data for exfiltration or unauthorized access to sensitive information.
This rule detects unusually large network uploads from devices. It identifies successful network connections where individual transfers exceed 100MB and aggregates these transfers by account name and hour. The rule then flags any account that has uploaded a total of 1TB or more within a single hour. This pattern could indicate data exfiltration, unauthorized data synchronization, or other malicious activities involving significant data transfer volumes.
This rule detects when sharing inheritance settings are modified in SharePoint. This could indicate an attempt to broaden access to sensitive information, a misconfiguration, or an attacker attempting to maintain access or exfiltrate data.
This rule detects when a single user downloads 50 or more files from OneDrive within a one-hour period. This could indicate data exfiltration or unauthorized bulk access to sensitive information.
This rule detects when a single user removes permissions from 5 or more mailboxes within a one-hour window in an Exchange environment. This activity could indicate an attempt to cover tracks or disrupt access to mailboxes by an attacker.
This rule detects when a single process account creates 5 or more files containing 'database', 'db', or '.sql' in their filenames within a one-hour window. This could indicate an attempt to stage, exfiltrate, or manipulate database files.
Detects an unusually high number of file copy operations to 'public' or 'external' folders within a one-hour window, initiated by the same process account. This behavior could indicate data exfiltration or unauthorized data staging.
This rule detects when an account copies five or more files, each larger than 50MB, within a one-hour period. This activity could indicate data exfiltration or staging for exfiltration.
This rule detects when a single process account creates or copies 10 or more files to a removable media device (e.g., USB drive) within a one-hour window. This behavior can be indicative of data exfiltration attempts.
Page 789 of 866