Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
This rule identifies outbound network connections where the destination IP address is geo-located to a specific country, which is configured as 'France' in this instance. It can be adapted to monitor traffic to any country of interest. The rule itself does not specify malicious behavior but flags network communication to a particular geographic region. This could be indicative of potential data exfiltration, command and control (C2) communication, or unauthorized access attempts if the country is considered high-risk or unusual for the organization's normal operations.
Identifies when a Google Workspace user downloads a file from Google Drive after a suspicious login event occurred.
Detect when GCP Compute Image is opened to public by adding allAuthenticatedUsers to the access policy.
Identifies when a user sends multiple files from Google Drive as an email attachment to a free email domain, which may indicate data exfiltration.
Detects when an Amazon RDS Snapshot is shared publicly.
Identifies when a user deletes multiple files from Google Drive, which may indicate data destruction.
Identifies when a user downloads multiple files from Google Drive, which may indicate data exfiltration.
Detects instances where a TFTP service on an OpenCanary node has had a request.
Detect a user downloads GCP BigQuery results from multiple tables which might indicate data exfiltration activity.
Identifies when a Google Workspace user shares a file on Google Drive after a suspicious login event occurred.
Detects when an Amazon EC2 AMI or Snapshot is shared publicly.
Identifies when a user shares a file on Google Drive with a free email domain, which may indicate data exfiltration.
Identifies when a user copies multiple files from Google Drive, which may indicate data exfiltration.
Detects modifications to an AWS RDS cluster or its deletion, which may indicate potential data exfiltration attempts, unauthorized access, or exposure of sensitive information. These actions can be performed by an attacker to disrupt services, remove evidence, or facilitate data theft.
Detects modifications to an RDS cluster or its deletion, which may indicate potential data exfiltration attempts, unauthorized access, or exposure of sensitive information.
This rule detects the creation or modification of email forwarding or redirection rules within Microsoft 365 audit logs. It specifically looks for operations related to 'UpdateInboxRules', 'Set-Mailbox', 'New-InboxRule', and 'Set-InboxRule' that include parameters indicative of forwarding or redirecting emails, such as 'Forward', 'Recipients', 'ForwardingSmtpAddress', 'ForwardingAddress', 'ForwardAsAttachmentTo', 'ForwardTo', 'RedirectTo', and 'RedirectToRecipients'. This activity can be a sign of an attacker attempting to exfiltrate sensitive information from a compromised mailbox or maintain persistence.
This rule detects the execution of a PowerShell script that utilizes the "Send-MailMessage" cmdlet along with the "-Attachments" flag. This combination is a strong indicator of potential data exfiltration via email, where an adversary might be sending sensitive files as attachments through SMTP. The rule aims to identify attempts to steal data by exfiltrating it over an unencrypted network protocol, specifically SMTP, to an alternative network location.
Detects suspicious DNS queries to Monero mining pools
Detects executables located in potentially suspicious directories initiating network connections towards file sharing domains. This behavior can indicate data exfiltration or the staging of malicious tools.
Detects execution of "tar.exe" in order to create a compressed file.
Adversaries may abuse various utilities to compress or encrypt data before exfiltration.
Adversaries may abuse various utilities to compress or encrypt data before exfiltration.
Detects execution of "tar.exe" in order to extract compressed file.
Adversaries may abuse various utilities in order to decompress data to avoid detection.
Adversaries may abuse various utilities in order to decompress data to avoid detection.
Page 118 of 124