Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,613 detections
Filters
Last updated
All Time
Detection languages
1,725
690
264
214
190
Contributors
985
505
494
256
209
Categories
814
787
728
629
473
Platforms
2,069
629
488
459
346
Products / Services
769
666
525
193
185
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,613
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
This rule detects the creation of an email auto-forwarding rule within Microsoft Exchange via the Exchange Web Services (EWS) interface. It specifically looks for HTTP requests to the '/EWS/Exchange.asmx' endpoint containing the string 'ForwardToRecipients' in the client body, indicating an attempt to configure email forwarding.
This rule detects a high volume of HTTP requests to graph.microsoft.com with the URI containing '/messages', indicating a potential bulk download of emails from Office 365 via the Graph API. The threshold is set to 30 requests within 60 seconds from a single source IP.
This rule detects when a file with the ".pst" extension (Outlook Personal Storage Table file) is copied locally via the Server Message Block (SMB) protocol. This could indicate data exfiltration or unauthorized access to sensitive email archives.
This rule detects the creation of in-memory archives using the .NET Compression Library by inspecting HTTP client-bound data for the presence of both "System.IO.Compression" and "ZipArchive" strings. This combination suggests that a .NET application is creating a ZIP archive in memory, which could be indicative of data staging or exfiltration activities.
This rule detects potential data exfiltration attempts where data is archived using scripting libraries. It specifically looks for HTTP traffic (flow:to_client,established) containing the strings "zipfile", "ZipFile(", and "write(" in the file data, indicating the use of a scripting library to create and write to a zip archive. This combination suggests that a client is receiving or downloading an archived file that was likely created programmatically for exfiltration.
This rule detects the string "zip -e" within TCP traffic on port 22 (SSH). This string is commonly used to create password-protected zip archives, and its presence in an SSH session could indicate an attempt to prepare data for exfiltration, especially if combined with SSH's secure tunneling capabilities. The rule specifically looks for traffic flowing from the client to the server.
This rule detects HTTP requests that contain both '7z' and '-p' in the URI, which could indicate the use of 7zip or WinRAR to archive data with a password, potentially for exfiltration. The rule specifically looks for these strings in the URI of an HTTP request flowing from the internal network to an external server.
This rule detects a high volume of HTTP GET requests to storage.googleapis.com, indicating a potential bulk download of objects from Google Cloud Storage. The threshold is set to 50 requests within 60 seconds from a single source IP address.
This rule detects potential bulk export of customer data from CRM applications like Salesforce, HubSpot, or Dynamics. It triggers when HTTP requests to these services contain 'export' in the URI, indicating a data export operation. A threshold of 5 such requests within 60 seconds from the same source IP is set to identify bulk activity.
Detects the execution of the GitHub CLI command 'gh auth token'. This behavior was observed being used by the hijacked Bitwarden CLI npm package (TeamPCP campaign) to extract and steal active GitHub credentials from developer environments.
This rule detects network traffic indicative of an 'Evil Twin' access point credential capture portal. It specifically looks for HTTP POST requests where the URI contains both 'wifi' and 'password' (case-insensitive). This pattern suggests a malicious portal designed to trick users into entering their Wi-Fi credentials.
Detects the execution of mshta.exe where the command line arguments reference a file with a .pdf extension. This technique is used by Gamaredon (GammaPhish) to execute disguised HTA payloads after WinRAR exploitation.
Detects the presence of 'search:' or 'search-ms:' URI schemes embedded in inbound emails. These schemes can be abused to force outbound NTLM authentication and leak Net-NTLMv2 hashes via a single link click.
Identifies a risky sign-in to a known O365 landing page followed shortly by the creation of an inbox rule that deletes messages or moves them to junk/trash. This pattern frequently indicates account compromise (e.g., BEC or AiTM) attempting to hide malicious activity.
Detects the execution of commands indicative of a user pasting a malicious script into the Terminal, often associated with ClickFix or fake CAPTCHA social engineering attacks. This typically involves using tools like `curl` to download and pipe payloads directly to a shell, or the use of `pbpaste` to execute clipboard contents.
Detects the execution of 'cg.exe', a secondary compiled Python executable deployed by SilentRunLoader (associated with TA4922) to pack and steal Google Chrome browser data. The detection specifically looks for 'cg.exe' where the initiating process or command line contains 'python'.
Detects command line execution of 'search:' or 'search-ms:' URI handlers utilizing the 'crumb=location:' parameter pointing to a remote UNC path, which forces outbound NTLM authentication. This technique can be used by adversaries to capture NTLM hashes.
This rule detects an unusually high number of file rename events (20 or more within a 1-hour window) initiated by a single process account. This behavior can be indicative of malicious activities such as data staging prior to exfiltration, ransomware encryption, or attempts to evade detection by renaming malicious files or legitimate system utilities.
This rule detects bulk Server Message Block (SMB) file read activity from a network share. It specifically looks for TCP traffic on port 445 (SMB) from any source within the home network to any destination within the home network, indicating established connections. The rule triggers if it observes 100 or more SMB packets (identified by the content "|FF|SMB") within a 60-second window from a single source IP address. This behavior could be indicative of data collection or exfiltration from network shares.
This rule detects suspicious NTLM network or remote interactive logon activity. It specifically looks for multiple distinct accounts logging in from the same device and remote IP address within a one-hour window, using NTLM authentication via NtLmSsp or Seclogon processes. This pattern can indicate credential stuffing, NTLM relay attacks, or other forms of credential misuse.
This rule detects multiple unauthorized access attempts to files identified as machine learning models, weights, or checkpoints. It specifically looks for Security Event ID 4656 (Auditing of object access) where the object name contains keywords like 'model', 'weights', or 'checkpoint', and the access mask indicates unauthorized access attempts (0x0001 for ReadData or ListDirectory, 0x0002 for WriteData or AddFile). The rule then summarizes these attempts by user, computer, and hour, triggering an alert if 5 or more attempts are made within an hour.
Page 124 of 173