Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
177 detections
Filters
Last updated
All Time
Detection languages
78
23
20
17
13
Contributors
70
35
11
8
7
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
150
29
17
8
4
Products / Services
64
42
23
11
9
MITRE Techniques
163
109
82
44
39
IDS Classtypes
6
1
IDS Protocols
5
2
Detects the use of 7-Zip (7z.exe) executed via the command-line interpreter (cmd.exe) to interact with a specific data file named 'data.dat' associated with the 'Traiolx Custom Utils' project, which may indicate data staging or archival activities performed by an adversary.
Detects the execution of 7z.exe with specific command line arguments that include references to 'data.dat' and 'Traiolx Custom Utils', which may indicate the use of 7-Zip for staging or archiving collected data for exfiltration.
Detects usage of the WinRAR utility (rar.exe) with command-line arguments indicative of file archival, specifically using flags commonly associated with automated data collection or suspicious staging patterns such as password-protected archives (-hp) or specific file paths like 'web.rar' or those within VMware directories.
Detects the use of common archive utilities (7zip, WinRAR, zip) to interact with files located in suspicious directories commonly used for data staging (AppData, Temp, Users Public). The rule tracks multiple occurrences of these commands by the same user on a host to identify potentially malicious collection and staging activities before exfiltration.
This rule detects the execution of common archival utilities (7-Zip, WinRAR, RAR, ZIP) with parameters indicative of password-protected archive creation. It specifically flags instances where a user account, with no recorded prior history of running these utilities in the last 30 days, creates a large archive (exceeding 1GB) spanning multiple directories. This pattern is commonly used for data staging and preparation prior to exfiltration.
Detects suspicious bulk archiving activity or file drops of archive formats in staging directories. The rule monitors for common archival utilities (7zip, WinRAR) or PowerShell's Compress-Archive command being used, or the creation of archive files in suspicious paths (e.g., Temp, AppData, Public). It alerts when high volumes of archives are created, password-protected archives are used, or rapid archival operations are performed.
Detects the execution of known archive utilities (e.g., 7-Zip, WinRAR) when interacting with sensitive user or system directories. This behavior is often indicative of data staging prior to potential exfiltration, especially when the originating process is not a recognized installer or backup application.
Detects behavior indicative of the Vidar information stealer, specifically the mass access of web browser credential stores (Login Data, Cookies) followed by the execution of archive utilities (7z, rar, WinRAR) to stage stolen data for exfiltration.
Detects the use of WinRAR or rar.exe to create password-protected archives or archive files within temporary, user-writable, or public directories. This behavior is indicative of data staging by an adversary to prepare information for exfiltration.
Detects the use of WinRAR (rar.exe or WinRAR.exe) to archive files, specifically flagging operations that involve recursion, password protection (-hp), or targeting network shares. This behavior is commonly used by adversaries for data staging prior to exfiltration.
This rule detects potentially malicious data exfiltration activity. It identifies sequences of events where a process performs file enumeration (directory listing), followed by the creation of a ZIP or RAR archive in temporary or local application data directories with randomized filenames. Finally, it correlates this behavior with subsequent outbound network connections from the same process to known cloud storage and file-sharing providers, flagging anomalous archive creation rates.
Detects the use of WinRAR or rar.exe to archive sensitive web directory content (e.g., wwwroot, web.config, database files) when spawned from web server processes like w3wp.exe or cmd.exe. This behavior is indicative of data staging for exfiltration, a common tactic for actors like those associated with the CL-STA-1062 intrusion campaign.
Detects the creation of large archive files (.zip, .7z, .rar, .tar) exceeding 100MB within sensitive or high-risk directory paths such as Desktop, Temp, or AppData, or on non-system drives. This behavior is often associated with the staging of sensitive data for exfiltration.
Detects outbound HTTP POST requests where the Content-Length is at least 10MB and the Content-Type header indicates the transfer of archived data (zip or x-tar). This pattern is often associated with the staging and exfiltration of compressed sensitive data from an internal host to an external network destination.
Detects the use of WinRAR (rar.exe) to archive files containing web server or database source code. The detection monitors for common staging flags (-k, -r, -s, -m1), password protection (-hp), or output paths indicative of staging activity (e.g., to a 'backup' directory or 'web.rar'), originating from standard Windows program file paths.
Detects the use of WinRAR (rar.exe/winrar.exe) to create archives with password protection or recursive flags in common staging directories (Temp, AppData, ProgramData, Users\Public, Share). This behavior is often associated with the staging and obfuscation of collected data prior to exfiltration.
Detects the execution of WinRAR or rar.exe with command-line arguments often used for staging data, including file addition, archive creation, and extraction. This activity is frequently associated with the preparation of files for exfiltration or the unpacking of malicious payloads.
Detects the execution of WinRAR or rar.exe with command-line arguments specifying password protection or outputting to common staging directories. This behavior is frequently associated with attackers staging and compressing sensitive data prior to exfiltration.
Detects the execution of known archival utilities (7-Zip or WinRAR) with command-line arguments indicative of file staging or compression, commonly associated with the collection and preparation of data for exfiltration.
Detects the use of 7-Zip (7z.exe or 7zip.exe) to archive files within common user directories (Desktop, Documents, Users, AppData). This activity is often associated with staging sensitive data prior to exfiltration.
Detects a sequence of events indicative of data exfiltration: an unknown process creates an image file in a temporary folder, followed by the creation of an archive file (ZIP/RAR) by the same or a related process within 10 minutes, and concludes with a successful outbound network connection to a non-private IP address from the same device.
Page 4 of 9