Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,686 detections
Filters
Last updated
All Time
Detection languages
1,342
389
264
219
197
Contributors
620
506
358
209
102
Categories
20,456
11,839
5,876
5,155
4,865
2,686
Platforms
1,168
638
452
382
359
Products / Services
593
445
403
264
229
MITRE Techniques
1,884
787
525
521
510
CVEs
11
5
5
5
3
IDS Classtypes
189
133
34
10
7
IDS Protocols
243
58
33
22
12
Detects network activity associated with Bluekit phishing infrastructure, which utilizes WebSocket connections for real-time browser session exfiltration. The rule monitors for characteristic HTTP upgrade requests to WebSockets containing 'rrweb' or 'session' query parameters, or connections to known Bluekit phishing domains, which allow attackers to stream DOM, keystrokes, and mouse movements from a victim's browser to an attacker-controlled dashboard.
This rule identifies suspicious outbound network traffic potentially related to data exfiltration or command-and-control (C2) communication. It monitors for connections to the Telegram Bot API utilizing 'sendMessage' methods, often used by malware for exfiltrating credentials or sensitive data, as well as connections to known 'Bluekit' PhaaS (Phishing-as-a-Service) operator domains.
Detects potential malicious browser extension activity by correlating internal browser process network connections to suspicious infrastructure (e.g., adblock-for-youtube.com) with subsequent network traffic from the same process PID to third-party domains within 60 seconds of visiting sensitive high-value websites (e.g., login portals, banking). The rule also alerts on any direct network connection to identified malicious exfiltration infrastructure.
Detects suspicious usage of the 'curl' command-line tool to perform PUT or POST requests with binary data to specific paths, potentially indicating data exfiltration or command and control communication. The rule excludes common web browsers as initiating processes to reduce false positives.
Detects a potential logging sink hijack in Google Cloud Platform (GCP) by identifying the deletion of a logging sink's destination bucket followed by the creation of a new bucket with the same name in a different project. This technique could allow an attacker to redirect logs to an attacker-controlled bucket, impairing defenses and potentially exfiltrating sensitive log data.
This rule detects programmatic file downloads from SharePoint and OneDrive using various automation tools and SDKs, rather than typical browser access. It specifically looks for `FileDownloaded`, `FileSyncDownloadedFull`, `FileAccessed`, or `FilePreviewed` operations within SharePoint or OneDrive audit logs where the user agent string indicates the use of PowerShell, PnP, Microsoft Graph SDK, Python, Node.js, or common command-line tools like curl or wget. This behavior can be indicative of data exfiltration.
Detects high-volume SQL UPDATE operations indicating data manipulation attack
Detects network connections attempting to exfiltrate data via Discord webhooks. This rule specifically looks for POST requests to the Discord API webhook endpoint.
Detects new app installations, expansions of OAuth scopes, or the addition of collaborators to Slack applications. These activities can indicate an adversary attempting to gain persistent access, escalate privileges, or exfiltrate data from Slack by leveraging malicious or compromised applications.
Detects high volume Google Cloud Storage (GCS) object listing and downloads, which can indicate reconnaissance of cloud storage contents or data exfiltration. The rule correlates multiple 'storage.objects.list' and 'storage.objects.get' operations within a one-hour window from the same identity, bucket, and project, flagging activity exceeding 50 operations.
Detects DNS resolution to attacker-controlled AWS S3 buckets masquerading as Outlook/OneDrive service pages used by UNC6692 for phishing delivery, SNOWBELT C2, and credential exfiltration. The rule specifically looks for DNS queries to S3 domains with patterns indicative of spoofed Outlook/OneDrive service pages or specific known malicious S3 bucket names.
This rule detects suspicious activities involving AWS CLI or curl commands spawned from IDE-related processes (amazonq-language-server, Code.exe). It monitors for command patterns indicating credential discovery (aws sts get-caller-identity) or data exfiltration (curl POST requests), and correlates these with unusual CloudTrail GetCallerIdentity events occurring from non-AWS source IP addresses.
Detects the creation of an mcp.json file within the .amazonq directory, followed shortly by the execution of suspicious child processes (bash, python, curl, etc.) by VS Code (Code.exe). This pattern is often indicative of an adversary abusing developer tools or IDE extensions to perform credential discovery or data exfiltration from a development environment.
Detects outbound network communication from node.exe to the domain 'stitch-production.org'. This domain is associated with the 'Miasma' (also known as Mini Shai-Hulud) campaign, which uses malicious npm packages with post-install scripts to steal developer credentials, including Git, Docker, SSH, and cloud service configuration files.
This rule detects the execution of common scripting interpreters (PowerShell, WScript, CScript) that include command-line arguments referencing major cloud storage providers and file-hosting services. This behavior is frequently associated with data exfiltration or the staging of malicious payloads using legitimate web services.
This rule correlates a user logging in from a new ISP and immediately navigating to HR/Payroll URIs (specifically Workday or ADP) to modify direct deposit data. The detection logic joins Azure AD sign-in events with Cloud App Security events, filtering for interactive logins and page accesses to specific HR/Payroll URLs containing 'direct-deposit'. It also excludes known corporate IP addresses and requires the HR/Payroll access to occur within 30 minutes of the login.
This rule detects network traffic containing keywords commonly associated with Indian payment gateways and financial transactions (NEFT, RTGS, IMPS, GST, PAN, IFSC). This could indicate data exfiltration or suspicious activity involving financial information, potentially related to malware like Remcos RAT.
Detects anomalous activity where a single user or service principal downloads more than 5 Microsoft Teams meeting recordings within a 1-hour window. This behavior potentially indicates an insider threat or compromised account performing bulk harvesting of sensitive meeting content.
Detects network connections from suspicious or unexpected processes to common public webhook and automation services, which may indicate data exfiltration or automated C2 communication.
Detects the execution of a local, polymorphic HTML file that contains AI-obfuscated JavaScript, followed by an HTTP POST request to an external server within a 5-minute window, indicating potential credential exfiltration.
This rule detects a potential data collection or exfiltration attempt in Microsoft Teams by identifying accounts that have accessed an abnormally high number of messages (more than 100 within a 5-minute window). This behavior may indicate an automated process or a compromised user account attempting to scrape internal communications.
Page 69 of 128