Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
234 detections
Filters
Last updated
All Time
Detection languages
147
31
27
9
7
Contributors
56
43
24
19
15
Categories
89
80
79
56
43
Platforms
181
77
51
45
7
Products / Services
182
34
19
16
15
MITRE Techniques
18,116
15,636
12,583
8,393
6,224
CVEs
1
1
1
IDS Classtypes
3
1
IDS Protocols
3
Alert on when a user has performed an eDiscovery search or exported a PST file from the search. This PST file usually has sensitive information including email body content
Alert when a user has performed an export to a search using 'New-ComplianceSearchAction' with the '-Export' flag. This detection will detect PST export even if the 'eDiscovery search or exported' alert is disabled in the O365.This rule will apply to ExchangePowerShell usage and from the cloud.
Detects adding and using Exchange PowerShell snap-ins to export mailbox data. As seen used by HAFNIUM and APT27
Page 12 of 12