Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
115 detections
Filters
Last updated
All Time
Detection languages
59
19
11
10
6
Contributors
20
19
15
9
7
Categories
53
25
22
20
13
Platforms
47
36
29
12
9
Products / Services
40
9
8
7
6
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
IDS Classtypes
5
1
IDS Protocols
4
2
This rule detects when a non-Outlook process running as SYSTEM accesses or creates PST or OST mailbox data files. The logic specifically excludes legitimate Outlook, searchindexer, or searchprotocolhost activity to focus on suspicious mailbox collection sequences.
This rule detects suspicious bulk access and transfer behavior targeting sensitive files, which could indicate data exfiltration. It identifies scenarios where a single account accesses a large number of files, totaling a significant size, within a short timeframe. The rule specifically looks for common sensitive file types such as spreadsheets, documents, PDFs, SQL databases, and backup files. This pattern is often associated with ransomware groups performing data leak extortion without encryption.
Detects the creation of specific folders in AppData used to host the unpacked malicious extension locally, specifically looking for 'manifest.json' within an AppData\Local path, in conjunction with the execution of '7za.exe' (7-Zip archiver). This combination indicates the potential unpacking and setup of a malicious browser extension for sideloading, as observed in UnregStealer campaigns.
This rule detects suspicious bulk access and transfer behavior targeting sensitive files, which could indicate data exfiltration. It identifies scenarios where a single account accesses a large number of files, totaling a significant size, within a short timeframe. The rule specifically looks for common sensitive file types such as spreadsheets, documents, PDFs, SQL databases, and backup files. This pattern is often associated with ransomware groups performing data leak extortion without encryption.
SYSTEM-Context PST or OST Collection
Cortex XDR
This rule detects suspicious access to Outlook data files (.pst or .ost) by processes running in the SYSTEM context, excluding legitimate Outlook-related processes. It focuses on identifying non-standard applications or scripts attempting to collect mailbox data, potentially indicating data exfiltration or unauthorized access. The rule leverages causality fields for enhanced investigation.
Detects an unusually high volume of successful operations related to Azure App Services originating from a single caller within a one-hour window. This could indicate automated activity, reconnaissance, or a misconfigured application.
Detects copying of Outlook PST/OST files for email collection
Detects bulk harvesting of Teams messages for credentials or sensitive data
This rule detects an unusually high number of web search queries (identified by 'search' or 'query' in the URI) originating from a single IP address within a one-hour window. A threshold of 100 or more queries triggers the alert. This behavior could indicate automated activity such as web scraping, reconnaissance, or a denial-of-service attempt against the search functionality.
This rule detects a high volume of document downloads from SharePoint, specifically looking for repeated access to the `/_layouts/download.aspx` URI. A threshold of 30 downloads within 60 seconds from a single source IP address triggers the alert. This behavior could indicate an attempt to exfiltrate a large amount of data from SharePoint.
This rule detects an unusually high number of web search queries (identified by 'search' or 'query' in the URI) originating from a single IP address within a one-hour window. A threshold of 100 or more queries triggers the alert. This behavior could indicate automated activity such as web scraping, reconnaissance, or a denial-of-service attempt against the search functionality.
Detects the export of Microsoft Teams messages, transcripts, recordings, and chat retrieval activities, particularly when performed via the Graph API. This rule identifies suspicious activity by looking for specific operation names in SaaS audit logs from Microsoft Teams and flags user agents commonly associated with automation tools (e.g., python-requests, axios, go-http, curl, wget, powershell, httpx, aiohttp, node) which could indicate post-compromise attackers using stolen tokens to silently export chat history.
Detects file access patterns in the Downloads directory matching cryptocurrency wallet seeds, phrases, and private keys targeted by file grabbers like Amatera. The rule identifies bulk access (more than 3 sensitive files within 5 minutes) to files with specific keywords or extensions commonly associated with crypto wallets.
Detects users accessing, downloading, or copying a high volume of document files (>100 unique files) across multiple SharePoint sites (>1) within a single hour, excluding legitimate OneDrive sync client activity. The rule targets file types commonly associated with sensitive business data — Office documents, PDFs, archives, databases, email exports (PST/OST/MSG), and OneNote notebooks — and aggregates by user and hour to surface bulk collection patterns consistent with insider data theft, account compromise, or pre-exfiltration staging by ransomware affiliates
A large-scale supply-chain attack where 84 compromised npm package artifacts in the tanstack namespace were modified with credential-stealing malware. The incident is tracked as part of the ongoing Mini Shai-Hulud campaign.
ref: https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
ref: https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
Detects users accessing, downloading, or copying a high volume of document files (>100 unique files) across multiple SharePoint sites (>1) within a single hour, excluding legitimate OneDrive sync client activity. The rule targets file types commonly associated with sensitive business data — Office documents, PDFs, archives, databases, email exports (PST/OST/MSG), and OneNote notebooks — and aggregates by user and hour to surface bulk collection patterns consistent with insider data theft, account compromise, or pre-exfiltration staging by ransomware affiliates
Detects programmatic GitHub data exfiltration by identifying non-interactive repository exports, clones, artifact downloads, or gist staging performed using tokens, OAuth applications, or GitHub Apps. The detection focuses on bursty or multi-repository activity within a short time window, which can indicate automated source code collection, misuse of programmatic credentials, or post-compromise data extraction.
This rule detects the XenoRAT info stealer and Remote Access Trojan (RAT) by identifying specific strings related to its functionalities. It looks for configuration parameters like 'HostName', 'PortNumber', 'UserName', and 'Password' which are typically supplied at runtime for C2 communication. The rule also identifies strings associated with browser data exfiltration ('Local Extension Settings', 'Sync Extension Settings', 'chromium_plugins', 'logins.json', 'profiles.ini', 'IndexedDB', 'chrome-extension_'), crypto wallet theft ('ChainingModeGCM'), file grabbing capabilities ('%DRIVE_FIXED%', '%DRIVE_REMOVABLE%', 'File Grabber'), and HVNC-style desktop control ('Chrome_WidgetWinOperaWindowClass', 'CreateDesktopA', 'OpenDesktopA'). Additionally, it includes specific hashes of known XenoRAT samples for direct identification.
Detects the creation of the 'shai-hulud-workflow.yml' file, which is associated with the Shai Hulud worm. This worm targets the NPM supply chain and is designed to exfiltrate GitHub secrets. The rule specifically looks for the creation of this file within the '.github/workflows/' directory.
The following analytic detects the creation of an AWS DataSync task, which could indicate potential data exfiltration. It leverages AWS CloudTrail logs to identify the `CreateTask` event from the DataSync service. This activity is significant because attackers can misuse DataSync to transfer sensitive data from a private AWS location to a public one, leading to data compromise. If confirmed malicious, this could result in unauthorized access to sensitive information, causing severe data breaches and compliance violations.
Detects M365 Copilot users exhibiting suspicious application usage patterns including multi-location access, abnormally high activity volumes, or access to multiple Copilot applications that may indicate account compromise or automated abuse. The detection aggregates M365 Copilot Graph API events per user, calculating metrics like distinct cities/countries accessed, unique IP addresses, number of different Copilot apps used, and average events per day over the observation period. Users are flagged when they access Copilot from multiple cities (cities_count > 1), generate excessive daily activity (events_per_day > 100), or use more than two different Copilot applications (app_count > 2), which are anomalous patterns suggesting credential compromise or bot-driven abuse.
Page 4 of 6