Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
150 detections
Filters
Last updated
All Time
Detection languages
85
24
19
13
5
Contributors
31
25
20
13
12
Categories
127
75
30
25
16
Platforms
51
41
31
27
25
Products / Services
37
34
27
19
13
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
5
1
IDS Classtypes
2
IDS Protocols
2
This rule detects a potential AWS S3 bucket name hijacking scenario. It looks for instances where an S3 bucket is deleted and then a new bucket with the exact same name is created within a short time frame (up to 1 hour) by a *different* AWS account. This pattern can be used to hijack S3 replication rule destinations, enabling silent data exfiltration to an attacker-controlled account. The rule also attempts to identify if the original bucket had replication configured.
Detects the execution of QEMU hypervisor binaries (qemu-system-x86_64, qemu.exe, etc.) when initiated from non-standard parent processes or from non-standard directories, or when associated with disk image files. This behavior may indicate the unauthorized deployment of virtualization software to facilitate lateral movement, data exfiltration, or environment evasion.
Detects anomalous activities targeting SaaS CRM applications (Salesforce, Microsoft Dynamics 365, HubSpot), including high-volume bulk exports, off-hours access, mass API queries for sensitive objects, and suspicious OAuth token grants.
Detects the execution of S3 Browser or Office installation executables, followed by network traffic from the same host to known cloud storage or file-sharing sites within a short time window. This behavior aligns with Muddled Libra's method of staging and exfiltrating sensitive data, such as PST files, to adversary-controlled cloud buckets.
Detects a potential S3 bucket hijacking attempt where a bucket is deleted by one AWS account and subsequently recreated by a different AWS account within a 30-minute window. This behavior could indicate an attempt to intercept cross-account replication or misdirected data flows.
Detects potential financial data exfiltration by monitoring for bulk downloads of files with financial keywords from SaaS/Office365 platforms, and identifies unauthorized processes attempting to access sensitive financial application data files (.qbw, .qbb, etc.) on local systems.
This rule detects suspicious activity related to high-volume Server Message Block (SMB) share enumeration and the execution of a specific Python script named 'backup_dfs.py'. It combines three detection logics: identifying processes executing 'backup_dfs.py', detecting an unusual number of SMB network connections to common administrative shares (SYSVOL, NETLOGON, DFS), and flagging high-volume SMB-related identity directory events targeting SYSVOL or NETLOGON. This behavior could indicate an adversary performing discovery of network shares, collecting data, or preparing for data exfiltration.
This rule detects successful configuration modifications to diagnostic settings or storage services where the destination resource is identified as being outside of the organization's trusted subscriptions or expected storage naming conventions. This activity may indicate an adversary attempting to exfiltrate logs or data to an attacker-controlled storage account.
Detects a potential logging sink hijack in Google Cloud Platform (GCP) by identifying the deletion of a logging sink's destination bucket followed by the creation of a new bucket with the same name in a different project. This technique could allow an attacker to redirect logs to an attacker-controlled bucket, impairing defenses and potentially exfiltrating sensitive log data.
Detects high-volume SQL UPDATE operations indicating data manipulation attack
This rule detects suspicious activity related to high-volume Server Message Block (SMB) share enumeration and the execution of a specific Python script named 'backup_dfs.py'. It combines three detection logics: identifying processes executing 'backup_dfs.py', detecting an unusual number of SMB network connections to common administrative shares (SYSVOL, NETLOGON, DFS), and flagging high-volume SMB-related identity directory events targeting SYSVOL or NETLOGON. This behavior could indicate an adversary performing discovery of network shares, collecting data, or preparing for data exfiltration.
Detects the deletion of a storage bucket immediately followed by the creation of a new bucket with the same name across different cloud providers (GCP, AWS S3, Azure). This rule specifically flags scenarios where the deleting actor or project differs from the creating actor or project, indicating a potential cross-account hijack or data exfiltration attempt.
This rule detects a potential Azure storage account name hijacking scenario. It identifies instances where a storage account is deleted and then recreated with the exact same name in a different subscription within the same Azure tenant, all within a 60-minute window. This activity could indicate an attempt to exfiltrate data via Azure Monitor diagnostic settings by taking over a previously used storage account name.
Detects a potential S3 bucket hijacking attempt where an S3 bucket is deleted and shortly after, an AWS Firehose delivery stream is created or updated to target a bucket with the same name, but under a different AWS account. This could indicate an adversary attempting to exfiltrate data by redirecting data intended for the original bucket to their own controlled bucket.
Detects the use of rclone, MEGAcmd, or common command-line tools like curl/wget to transfer data to known cloud storage endpoints (mega.nz, gofile.io, anonfiles, pixeldrain) when initiated from non-standard system paths (i.e., not 'C:\Program Files'). This rule aims to identify data exfiltration activities, particularly those associated with the Qilin threat actor's double extortion tactics.
Detects extraction of Azure Storage account keys (ListKeys) used to facilitate programmatic, static-auth data exfiltration.
Detects bulk download of AWS S3 objects indicating cloud data theft
This rule detects when a Key Vault item is deleted in Azure. Monitoring deletions of sensitive items like those in Key Vaults is crucial for detecting potential data exfiltration, sabotage, or unauthorized access attempts by adversaries.
Detects bulk download of AWS S3 objects indicating cloud data theft
This rule detects an unusually high volume of file sharing events from a single user in OneDrive within a one-hour window. Specifically, it looks for five or more 'SharingSet' or 'AnonymousLinkCreated' operations by the same UserId within an hour, which could indicate data exfiltration or unauthorized sharing.
This rule detects when a Key Vault item is deleted in Azure. Monitoring deletions of sensitive items like those in Key Vaults is crucial for detecting potential data exfiltration, sabotage, or unauthorized access attempts by adversaries.
Page 4 of 8