Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,686 detections
Filters
Last updated
All Time
Detection languages
1,342
389
264
219
197
Contributors
620
506
358
209
102
Categories
20,443
11,831
5,875
5,151
4,864
2,686
Platforms
1,168
638
452
382
359
Products / Services
593
445
403
264
229
MITRE Techniques
1,884
787
525
521
510
CVEs
11
5
5
5
3
IDS Classtypes
189
133
34
10
7
IDS Protocols
243
58
33
22
12
KQL Query from file: OAuth app using the OD file picker permission
KQL Query from file: MS Teams DLP Playbook
KQL Query from file: Hunting New Variant of Snake Keylogger
KQL Query from file: Detect Power Pwn (aka LOLCopilot) Red Team Tool
KQL Query from file: Technique profile eDiscovery misuse detection
KQL Query from file: Ottercookie Detection
KQL Query from file: Malware C2 Comms over Azure Blob Metadata
KQL Query from file: Threat Intelligence Data from Sentinel UEBA2
KQL Query from file: M365 Copilot Extensions Threat Monitoring
KQL Query
KQL Query
KQL Query
KQL Query
KQL Query from file: Blob URI Unique Domain Count
KQL Query
Detects the execution of the BCP utility to export data from a Microsoft SQL Server database. Attackers may use this method to extract malware previously saved into a database column or table, or to exfiltrate sensitive data from the database.
KQL Query from file: Hunting VEILDrive C2
This YARA rule detects the ChaosRAT backdoor by identifying specific byte sequences related to its network communication, system information gathering, and file download capabilities. The rule includes three distinct versions of these functionalities, indicating evolution or different variants of the malware. Detection relies on the presence of these unique byte patterns within executable files, specifically ELF files as indicated by the magic byte check.
The following analytic identifies anomalous GetObject API activity in AWS, indicating potential data exfiltration attempts. It leverages AWS CloudTrail logs and uses the `anomalydetection` command to detect unusual patterns in the frequency of GetObject API calls by analyzing fields such as "count," "user_type," and "user_arn" within a 10-minute window. This activity is significant as it may indicate unauthorized data access or exfiltration from S3 buckets. If confirmed malicious, attackers could exfiltrate sensitive data, leading to data breaches and compliance violations.
The following analytic identifies anomalous network traffic volumes between Kubernetes workloads or between a workload and external sources. It leverages Network Performance Monitoring metrics collected via an OTEL collector and pulled from Splunk Observability Cloud. The detection compares recent network metrics (tcp.bytes, tcp.new_sockets, tcp.packets, udp.bytes, udp.packets) over the last hour with the average over the past 30 days to identify significant deviations. This activity is significant as unexpected spikes may indicate unauthorized data transfers or lateral movement. If confirmed malicious, it could lead to data exfiltration or compromise of additional services, potentially resulting in data breaches.
This analytic identifies anomalously high outbound network activity from processes within Kubernetes containerized workloads. It compares recent network metrics (TCP/UDP bytes, new sockets, packets) over the last hour against the average metrics from the past 30 days. Significant deviations may indicate data exfiltration, process modification, or container compromise, potentially leading to unauthorized data transfer or further attacks within the containerized environment.
Page 115 of 128