Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,116
15,636
12,583
8,393
6,221
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
The following analytic identifies a spike in the number of AWS Security Hub alerts for an EC2 instance within a 4-hour interval. It leverages AWS Security Hub findings data, calculating the average and standard deviation of alerts to detect anomalies. This activity is significant for a SOC as a sudden increase in alerts may indicate potential security incidents or misconfigurations requiring immediate attention. If confirmed malicious, this could signify an ongoing attack, leading to unauthorized access, data exfiltration, or disruption of services on the affected EC2 instance.
The analytic identifies when a user with sufficient access to the O365 Security & Compliance portal uses premium investigation features (Threat Explorer) to directly view email. Adversaries may exploit privileged access with this premium feature to enumerate or exfiltrate sensitive data.
The following analytic detects anomalous changes in resource utilization ratios for processes running on a Kubernetes node. It leverages process metrics collected via an OTEL collector and hostmetrics receiver, analyzed through Splunk Observability Cloud. The detection uses a lookup table containing average and standard deviation values for various resource ratios (e.g., CPU:memory, CPU:disk operations). Significant deviations from these baselines may indicate compromised processes, malicious activity, or misconfigurations. If confirmed malicious, this could signify a security breach, allowing attackers to manipulate workloads, potentially leading to data exfiltration or service disruption.
The analytic identifies the use of SNICat tool commands within the TLS SNI field, indicating potential data exfiltration attempts. It leverages Zeek SSL data to detect specific SNICat commands such as LIST, LS, SIZE, LD, CB, EX, ALIVE, EXIT, WHERE, and finito in the server_name field. This activity is significant as SNICat is a known tool for covert data exfiltration using TLS. If confirmed malicious, this could allow attackers to exfiltrate sensitive data undetected, posing a severe threat to data confidentiality and integrity.
This analytic identifies DNS queries with unusually large lengths by computing the standard deviation of query lengths and filtering those exceeding twice the standard deviation. It leverages DNS query data from the Network_Resolution data model, focusing on the length of the domain names being resolved. This activity is significant as unusually long DNS queries can indicate data exfiltration or command-and-control communication attempts. If confirmed malicious, this activity could allow attackers to stealthily transfer data or maintain persistent communication channels within the network.
The analytic identifies suspicious file-sharing activity on Google Drive, where internal users share documents with more than 50 external recipients. It leverages GSuite Drive logs, focusing on changes in user access and filtering for emails outside the organization's domain. This activity is significant as it may indicate compromised accounts or intentional data exfiltration. If confirmed malicious, this behavior could lead to unauthorized access to sensitive information, data leaks, and potential compliance violations.
The following analytic detects the execution of the PowerShell command `Start-BitsTransfer`, which can be used for file transfers, including potential data exfiltration. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events and command-line arguments. This activity is significant because `Start-BitsTransfer` can be abused by adversaries to upload sensitive files to remote locations, posing a risk of data loss. If confirmed malicious, this could lead to unauthorized data exfiltration, compromising sensitive information and potentially leading to further exploitation of the network.
The analytic detects the initiation of traffic mirroring sessions on Cisco network devices. It leverages logs with specific mnemonics and facilities related to traffic mirroring, such as "ETH_SPAN_SESSION_UP" and "PKTCAP_START." This activity is significant because adversaries may use traffic mirroring to exfiltrate data by duplicating and forwarding network traffic to an external destination. If confirmed malicious, this could allow attackers to capture sensitive information, monitor network communications, and potentially compromise the integrity and confidentiality of the network.
This analytic detects a sharp increase in the number of files written to a specific host. It leverages the Endpoint.Filesystem data model, focusing on 'created' actions and comparing current file write counts against historical averages and standard deviations. This activity is significant as a sudden spike in file writes can indicate malicious activities such as ransomware encryption or data exfiltration. If confirmed malicious, this behavior could lead to significant data loss, system compromise, or further propagation of malware within the network.
Detects suspicious child processes spawned by web servers, indicating potential webshell activity used for credential dumping, exfiltration, or other post-exploitation actions. The rule looks for specific command-line patterns and executables commonly associated with these malicious activities originating from known web server processes.
Detects network communication initiated to the 'portmap.io' domain. This domain is often associated with port forwarding services that can be abused by malicious actors for command and control (C2) communication or data exfiltration, potentially masking the true destination of the traffic.
This rule detects when a Python process initiates an outbound network connection. While this activity can be legitimate for tasks like package installation or updates, it can also be indicative of malicious behavior, such as a Python-based script establishing communication with a command and control (C2) server or performing network reconnaissance. The rule includes filters to reduce false positives from common activities like Anaconda updates, Jupyter Notebook local communication, and 'pip install' commands.
Detects an executable accessing the portmap.io domain, which could be a sign of forbidden C2 traffic or data exfiltration by malicious actors
This rule detects file downloads from Office 365 or Microsoft Graph Activity logs, specifically excluding anonymous file links. It looks for 'FileDownloaded' events from Office 365 and HTTP GET requests with a 302 response code from Microsoft Graph Activity, ensuring the download is not initiated by an anonymous user.
This rule detects the creation or modification of anonymous links in OneDrive. Anonymous links can be used to export files from OneDrive, posing a risk of data leakage, especially in organizations that do not support their creation.
This rule detects when files are downloaded from OneDrive using anonymous links. While not inherently malicious, some organizations prohibit anonymous links due to data leakage risks. The rule specifically looks for 'FileDownloaded' events from Office 365 where the principal user ID indicates an anonymous access (e.g., 'urn:spo:anon#' or 'anonymous').
This rule detects when anonymous links are used to access files from OneDrive. While not always malicious, some organizations prohibit anonymous links due to data leakage risks. The rule specifically looks for 'USER_RESOURCE_ACCESS' events with 'FileAccessed' product event type from Office 365, where the principal user ID indicates an anonymous access (e.g., 'urn:spo:anon#' or 'anonymous').
This rule detects when anonymous links are used to access files from OneDrive. While this isn't always a sign of malicious activity, some organizations do not support the use of anonymous links because of the risk of data leakage. The rule specifically looks for 'USER_RESOURCE_ACCESS' events with 'AnonymousLinkUsed' as the product event type, originating from 'Office 365' and 'Microsoft', where the user ID is 'anonymous'.
Detects file downloads using O365 or Graph Activity logs, not including anonymous file links
Anonymous links can be used to export files from OneDrive. While this isn't always a sign of malicious activity, some organizations do not support the use of anonymous links because of the risk of data leakage. This rule detects when anonymous links are used to access files from OneDrive.
Anonymous links can be used to export files from OneDrive. While this isn't always a sign of malicious activity, some organizations do not support the use of anonymous links because of the risk of data leakage. This rule detects when anonymous links are used to download files from OneDrive.
Page 116 of 124