Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
23 detections
Filters
Last updated
All Time
Detection languages
11
5
4
2
1
Contributors
4
3
3
3
2
Categories
13
13
6
5
5
Platforms
9
9
3
3
2
Products / Services
6
5
4
3
2
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
IDS Classtypes
1
IDS Protocols
1
This analytic detects when an excessive number of files are downloaded from Office 365 by the same user over a short period of time. Office 365 may bundle these files together as a ZIP file, however each file will have its own download event. This behavior may indicate an attacker staging data for exfiltration or an insider threat removing organizational data. Additional attention should be taken with any Azure Guest (#EXT#) accounts.
The analytic identifies successful access to an S3 bucket from a new or previously unseen remote IP address. This activity is significant because access from unfamiliar IP addresses could indicate unauthorized access or potential data exfiltration attempts. If confirmed malicious, this activity could lead to unauthorized data access, data theft, or further exploitation of the compromised S3 bucket, posing a significant risk to sensitive information stored within the bucket.
Page 2 of 2