Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
115 detections
Filters
Last updated
All Time
Detection languages
59
19
11
10
6
Contributors
20
19
15
9
7
Categories
53
25
22
20
13
Platforms
47
36
29
12
9
Products / Services
40
9
8
7
6
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
IDS Classtypes
5
1
IDS Protocols
4
2
Detects anomalous, high-volume search query activity across multiple SharePoint sites or OneDrive locations, potentially indicating an adversary performing broad data discovery or enumeration across an organization's cloud document repositories.
This rule detects suspicious, high-volume file access or download operations in SharePoint and OneDrive. It filters for activities performed by specific user agents commonly associated with automated scripting tools (e.g., python-requests, Microsoft.Graph.Client), which indicates potential automated exfiltration or unauthorized bulk data collection.
This rule monitors Office 365 SharePoint file operations and search queries for patterns indicative of automated discovery and exfiltration of sensitive content. It specifically identifies high-frequency search queries involving wildcard parameters used in SharePoint content indexing, which may suggest an adversary is systematically crawling or enumerating organizational documents.
Detects anomalous user behavior where a file search query is followed by a high volume of file downloads within a short period (30 minutes) from the same IP address. This behavior is indicative of an attacker searching for sensitive documents and performing bulk extraction or exfiltration.
Detects anomalous, high-volume search query activity across multiple SharePoint sites or OneDrive locations, potentially indicating an adversary performing broad data discovery or enumeration across an organization's cloud document repositories.
Detects anomalous, high-volume search query activity across multiple SharePoint sites or OneDrive locations, potentially indicating an adversary performing broad data discovery or enumeration across an organization's cloud document repositories.
Detects anomalous, high-volume search query activity across multiple SharePoint sites or OneDrive locations, potentially indicating an adversary performing broad data discovery or enumeration across an organization's cloud document repositories.
Detects anomalous, high-volume search query activity across multiple SharePoint sites or OneDrive locations, potentially indicating an adversary performing broad data discovery or enumeration across an organization's cloud document repositories.
This rule monitors Office 365 activity for anomalous search behavior, specifically targeting high volumes of distinct search queries involving site collections, web structures, or index ID patterns. Such patterns are indicative of automated data discovery or enumeration activities performed against SharePoint or OneDrive environments.
This rule monitors Office 365 activity for anomalous search behavior, specifically targeting high volumes of distinct search queries involving site collections, web structures, or index ID patterns. Such patterns are indicative of automated data discovery or enumeration activities performed against SharePoint or OneDrive environments.
This rule monitors Office 365 activity for anomalous search behavior, specifically targeting high volumes of distinct search queries involving site collections, web structures, or index ID patterns. Such patterns are indicative of automated data discovery or enumeration activities performed against SharePoint or OneDrive environments.
This rule detects suspicious, high-volume file access or download operations in SharePoint and OneDrive. It filters for activities performed by specific user agents commonly associated with automated scripting tools (e.g., python-requests, Microsoft.Graph.Client), which indicates potential automated exfiltration or unauthorized bulk data collection.
This rule detects suspicious, high-volume file access or download operations in SharePoint and OneDrive. It filters for activities performed by specific user agents commonly associated with automated scripting tools (e.g., python-requests, Microsoft.Graph.Client), which indicates potential automated exfiltration or unauthorized bulk data collection.
This rule monitors Office 365 SharePoint file operations and search queries for patterns indicative of automated discovery and exfiltration of sensitive content. It specifically identifies high-frequency search queries involving wildcard parameters used in SharePoint content indexing, which may suggest an adversary is systematically crawling or enumerating organizational documents.
This rule monitors Office 365 SharePoint file operations and search queries for patterns indicative of automated discovery and exfiltration of sensitive content. It specifically identifies high-frequency search queries involving wildcard parameters used in SharePoint content indexing, which may suggest an adversary is systematically crawling or enumerating organizational documents.
This rule detects suspicious, high-volume file access or download operations in SharePoint and OneDrive. It filters for activities performed by specific user agents commonly associated with automated scripting tools (e.g., python-requests, Microsoft.Graph.Client), which indicates potential automated exfiltration or unauthorized bulk data collection.
This rule detects when an individual user on a single host launches three or more distinct AI or LLM-related tools (such as ChatGPT, Claude, Cursor, Copilot, Ollama, or LMStudio) within the observed timeframe. This may indicate developers or power users utilizing various AI-assisted coding and productivity tools, but could also indicate unauthorized use of generative AI tools for data processing or exfiltration.
Detects RtkNGUI64.exe creating or writing to tempcache.tmp during command-output staging, scoped to direct process attribution. The rename-away leg of this file's lifecycle is covered by the separate put-command drop-and-rename detection.
This KQL detects activity associated with network traffic to known C2 infrastructure (45.146.252.17), suspicious Node/NPM execution chains and dropped payload/marker files. Also looks for indicators of remote control, clipboard access, screenshot/desktop-control packages, Socket.IO C2 traffic, and file/browser/wallet data exfiltration behavior.
Detects a sequence of file write operations followed by file read operations on specific files named 'AGENTS.md', 'MEMORY.md', 'IDENTITY.md', 'USER.md', or 'SOUL.md' with a significant time gap between the operations. This pattern is indicative of data staging, where an adversary writes sensitive information to a file and subsequently reads it for exfiltration.
This rule detects potential automated data exfiltration or staging behavior by identifying the concurrent execution of email-related processes and vector database memory modification commands (insert/upsert) within a 5-minute window on the same host. This combination may indicate an attacker extracting data from email systems and injecting it into a local vector memory store, likely for subsequent LLM-based analysis or exfiltration.
Page 2 of 6