Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
177 detections
Filters
Last updated
All Time
Detection languages
78
23
20
17
13
Contributors
70
35
11
8
7
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
150
29
17
8
4
Products / Services
64
42
23
11
9
MITRE Techniques
163
109
82
44
39
IDS Classtypes
6
1
IDS Protocols
5
2
Detects the use of the WinRAR utility to archive sensitive directories (like backup folders, web root directories, or VMware configuration data) using common flags associated with command-line archiving. This behavior is often indicative of data staging for exfiltration.
Detects the macOS.Gaslight Python collection module compressing staged data into a ZIP archive (collected_data.zip) using shutil.make_archive for subsequent exfiltration over Telegram C2. The module calls compress_output() which archives browser credentials, keychain, terminal history, and process snapshots into temp/collected_data.zip.
Detects WinRAR executing with archiving flags (create, add, move) on sensitive paths, followed by an outbound network connection to a non-private IP address within a 10-minute window, which is characteristic of data staging and exfiltration.
Detects a game-related process creating ZIP, 7z, or encrypted data containers in an inconspicuous AppData subdirectory. This behavior is indicative of data staging prior to exfiltration, often seen in supply chain attacks or targeted espionage.
Detects processes creating a high volume of archive files (zip, rar, 7z, etc.) within common user-writable or temporary system directories. This behavior is indicative of data collection and staging activities, often a precursor to exfiltration. The rule filters out trusted Microsoft processes and established backup or synchronization applications to reduce noise.
Detects processes creating a high volume of archive files (zip, rar, 7z, etc.) within common user-writable or temporary system directories. This behavior is indicative of data collection and staging activities, often a precursor to exfiltration. The rule filters out trusted Microsoft processes and established backup or synchronization applications to reduce noise.
Detects the use of 7-Zip (7z.exe or 7zip.exe) to archive files within common user directories (Desktop, Documents, Users, AppData). This activity is often associated with staging sensitive data prior to exfiltration.
Detects the execution of PowerShell with the Compress-Archive cmdlet where the process originates from user-writable directories (AppData\Local or AppData\Roaming). This behavior is often associated with the staging of data for exfiltration or the compression of unauthorized tools or logs in a user context.
This rule detects suspicious activity involving a high volume of file compression using common archiving tools like 7-Zip and WinRAR. Adversaries often compress data before exfiltration or for staging purposes to reduce size and potentially evade detection. A high count of compression events within a short timeframe (1 hour) by a single account could indicate malicious activity.
This rule correlates the credential scraping phase with the invocation of zip, tar, or ditto to compress stolen artifacts into a single file in the /tmp directory. Specifically, it looks for these archiving utilities being executed with a command line that targets a .zip or .tar.gz file within /tmp, and joins this activity with the prior access of a file named 'Login Data' by the same initiating process.
Detects IDE processes creating ZIP archives in temporary directories, which can indicate exfiltration of cryptocurrency wallets. The rule specifically looks for 'Code.exe' (VS Code) or 'cursor.exe' creating '.zip' files in common temporary paths like 'AppData\Local\Temp' or '/tmp/'.
Detects the execution of rar.exe with command line arguments indicating the creation of a new archive (-a) and the use of the -k switch. The -k switch in RAR is often used to lock an archive, preventing further modifications, which is a technique sometimes used by adversaries to preserve staged data for exfiltration.
Detects the use of WinRAR (rar.exe) to archive files using command-line arguments indicative of data staging or exfiltration (such as continuous archiving or specific extraction flags). The rule focuses on executions originating from suspicious parent processes like web servers (w3wp.exe) or command shells, or occurring within sensitive directories such as backup locations or VMware application folders.
Detects the execution of 'rar.exe' with specific command-line arguments indicative of file archiving or extraction (using switches like '-k', '-r', '-s', '-t', '-o-p'). The rule monitors for instances where this activity originates from a web server process (w3wp.exe) or command interpreter (cmd.exe), or involves specific sensitive paths like backups or VMware configuration directories, which may suggest unauthorized data staging or exfiltration preparation.
Identifies the use of the macOS ditto utility to compress stolen datasets into a single archive, specifically preserving resources, as observed in AMOS malware activity.
Detects the use of archive utilities (tar, zip, 7z, gzip, zstd) to bundle sensitive PeopleSoft configuration and application directories (e.g., ps_config_homes, psoft/psft). This behavior is consistent with data staging for exfiltration, frequently associated with the ShinyHunters threat group activity targeting exposed PeopleSoft environments.
Detects the use of the zstd compression utility on PeopleSoft application servers by privileged service accounts such as psoft, oracle, or linuxadm. This behavior is indicative of data staging or archiving activity consistent with ShinyHunters pre-exfiltration tactics.
Detects Python creating an archive containing browser, wallet, developer, cloud, and authentication data from multiple collection roots. This activity is associated with the InvisibleFerret malware.
Detects the AMOS Stealer archiving collected data using the 'ditto' command with specific flags and output file names. This rule identifies the use of '-c', '-k', and '--sequesterRsrc' flags, along with '/tmp/osalogging.zip' or '/tmp/out.zip' as target archive names, which are characteristic of AMOS Stealer's data staging and archiving behavior.
Detects the creation of archive files (ZIP, 7z, RAR, TAR, GZ) within common user staging directories such as Downloads, AppData Roaming, Desktop, or Temp folders. The detection specifically targets archives created by command-line shells (cmd, PowerShell), dedicated archiving utilities (7z, WinRAR, tar), or remote access tools (AnyDesk, Bomgar, ScreenConnect, Splashtop, Atera). This activity is indicative of data staging prior to exfiltration.
Hunts for the malware compressing the collected host and browser data into a temporary .zip file prior to network exfiltration. Specifically looks for file creation events of .zip files with a specific naming convention (8-15 alphanumeric characters) in common temporary directories, initiated by 'AutoIt3.exe'.
Page 6 of 9