Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
177 detections
Filters
Last updated
All Time
Detection languages
78
23
20
17
13
Contributors
70
35
11
8
7
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
150
29
17
8
4
Products / Services
64
42
23
11
9
MITRE Techniques
163
109
82
44
39
IDS Classtypes
6
1
IDS Protocols
5
2
This rule detects the use of the 7-Zip utility (7z.exe) located in 'C:\Users\Public\Documents\' to archive files, specifically monitoring for the creation of an archive file named 'p.7z' within the same directory. This pattern of staging files and using an archive utility in public, writeable directories is a common behavior observed in adversary data exfiltration preparation.
This rule detects the use of the 7-Zip utility (7z.exe) located in 'C:\Users\Public\Documents\' to archive files, specifically monitoring for the creation of an archive file named 'p.7z' within the same directory. This pattern of staging files and using an archive utility in public, writeable directories is a common behavior observed in adversary data exfiltration preparation.
This rule detects the use of the 7-Zip utility (7z.exe) located in 'C:\Users\Public\Documents\' to archive files, specifically monitoring for the creation of an archive file named 'p.7z' within the same directory. This pattern of staging files and using an archive utility in public, writeable directories is a common behavior observed in adversary data exfiltration preparation.
This rule detects the use of the 7-Zip utility (7z.exe) located in 'C:\Users\Public\Documents\' to archive files, specifically monitoring for the creation of an archive file named 'p.7z' within the same directory. This pattern of staging files and using an archive utility in public, writeable directories is a common behavior observed in adversary data exfiltration preparation.
This rule detects when a .zip archive file is created on a host. The creation of archive files can be a precursor to data exfiltration or a method for adversaries to bundle malicious tools for movement.
This rule detects PowerShell processes (powershell.exe, powershell_ise.exe, pwsh.exe) that execute the 'Compress-Archive' cmdlet in conjunction with strings indicative of data staging or exfiltration workflows (e.g., 'ZIPDOWNLOAD', '-DestinationPath'). The detection logic further narrows the scope by identifying if the parent process (InitiatingProcessCommandLine) involved activities related to downloading or uploading files, suggesting an automated staging and potential exfiltration sequence often seen in malicious backdoors.
This rule detects the creation of Google Cloud Platform (GCP) persistent disk snapshots. Monitoring for disk snapshot creation is critical as adversaries may use this functionality to create backups of sensitive virtual machine disks for exfiltration, staging, or offline analysis, effectively bypassing traditional network-based egress controls.
Detects the execution of tar.exe with passphrase-protected extraction flags (-xf and --passphrase) originating from or operating within a Microsoft Edge User Data directory. This behavior aligns with the 'Edgecution' malware deployment technique, where attackers leverage Edge application paths for staging and executing malicious payloads, as observed in UNC6692 campaigns.
Detects a process accessing browser credential-related files (Login Data, Cookies) across three or more distinct browser profiles within a 5-minute window, followed by the creation of a ZIP archive by the same process within 10 minutes. This behavior is indicative of credential theft activities where browser profiles are harvested and bundled for exfiltration, consistent with techniques used by infostealers like Dolphin X.
Detects a PowerShell process executing with a hidden window style while using the Compress-Archive cmdlet to target the tokyocore_data directory or archive, a behavior consistent with TOKYOCORE ransomware data staging for exfiltration.
This YARA rule suite is designed to detect the Qbit Stealer malware and associated development artifacts. It uses specific string matches indicative of the stealer's configuration, logging, and functionality (such as file archiving and exfiltration) alongside development indicators like developer contact information and project metadata.
Detects zip archives matching the .zx_ filename prefix convention used by CrashStealer to stage encrypted exfiltration data in /tmp prior to transmission to its C2 server.
Detects a sequence of suspicious activities characteristic of information-stealing malware (e.g., Vidar/SnappyClient). The rule correlates browser credential access (Login Data/Cookies), screen capturing (GDI API calls), and keylogging (SetWindowsHookEx) with subsequent archive staging activities (compression of sensitive data in temp folders) within a one-hour window.
Detects execution of WinRAR utilities (rar.exe, winrar.exe) where the command line contains the '-a' (add to archive) flag or involves paths typically associated with data staging (Temp, AppData, Users, or Public directories), which may indicate an attempt to archive collected data prior to exfiltration.
Detects the execution of common archival utilities (7zip, WinRAR) with command-line arguments specifying password protection. Attackers often use these utilities to compress and encrypt data prior to exfiltration to evade detection and prevent unauthorized access to sensitive files.
Detects the creation of large archive files (.zip, .7z, .rar, .tar) exceeding 100MB within sensitive or high-risk directory paths such as Desktop, Temp, or AppData, or on non-system drives. This behavior is often associated with the staging of sensitive data for exfiltration.
This rule detects suspicious activity involving a high volume of file compression using common archiving tools like 7-Zip and WinRAR. Adversaries often compress data before exfiltration or for staging purposes to reduce size and potentially evade detection. A high count of compression events within a short timeframe (1 hour) by a single account could indicate malicious activity.
Detects the use of common archive utilities (7-Zip, WinRAR) to perform file archiving operations within sensitive user-profile directories (Desktop, Documents, Downloads, etc.). This pattern is often used by adversaries to stage or bundle sensitive data prior to exfiltration.
Detects the execution of 7-Zip (7z.exe) when launched from a specific directory path ('Traiolx Custom Utils') while operating on specific files named 'drata.dat' or 'data.dat'. This behavior is indicative of an adversary staging or archiving sensitive data for potential exfiltration.
Detects the creation of multiple archive files (ZIP, 7Z, RAR, TAR) by common utilities (7z, WinRAR, tar) in sensitive temporary directories (Temp, tmp). The rule aggregates activity over a 10-minute window to identify suspicious staging behaviors often associated with ransomware data preparation.
Detects suspicious file activity associated with the GIFTEDCROOK (UAC-0226) threat actor. The rule identifies the creation of randomized staging directories under the user profile, the creation of ZIP archives in the user root, and the creation of extensionless files within the Windows TEMP directory.
Page 3 of 9