Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
177 detections
Filters
Last updated
All Time
Detection languages
78
23
20
17
13
Contributors
70
35
11
8
7
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
150
29
17
8
4
Products / Services
64
42
23
11
9
MITRE Techniques
163
109
82
44
39
IDS Classtypes
6
1
IDS Protocols
5
2
This rule detects a suspicious sequence of events indicative of ransomware activity, specifically the Prinz Eugen ransomware. It looks for the execution of common file compression utilities (7z.exe, rar.exe, WinRAR.exe, winzip.exe) followed by the execution of known ransomware encryption executables (servertool.exe, encrypt.exe) on the same device within a 30-minute window. This pattern suggests that an attacker is compressing files before encrypting them, a common tactic to reduce the size of data for faster encryption or exfiltration.
Detects PowerShell compressing stolen data prior to POST exfiltration. This rule specifically looks for the execution of 'powershell.exe' or 'pwsh.exe' with command-line arguments that include 'Compress-Archive', 'Invoke-WebRequest', and '-Method POST'. This combination indicates an attempt to compress data and then exfiltrate it via an HTTP POST request.
Detects the creation or modification of large Zstandard (.zst or .tar.zst) archive files (100MB or larger) within common temporary, data exfiltration, staging, or PeopleSoft-related directories. This activity can indicate an attacker archiving collected data for exfiltration or staging it for further actions.
Detects an unsigned game-related process creating an archive and initiating cloud-storage network activity without an interactive cloud client. This rule specifically looks for network events where the process name contains 'bird', 'rok', 'game', 'update', 'python', or 'ruby' (case-insensitive) and the command line includes terms like 'zip', 'archive', 'upload', 'multipart', 'cloud', 'dropbox', or 'pcloud'.
Detects PHP or web server processes launching archive and compression utilities. A compromised web application may use these tools to package REDCap files, database exports, credentials, or research data before exfiltration. This behaviour should be rare outside documented backup or deployment activity.
Detects the creation of large archive files (zip, rar, 7z, tar.gz) exceeding 50MB in common temporary or program data folders, specifically when these archives are created shortly after files from user document directories (Documents, Desktop, Downloads, Finance, HR, Accounting) were copied or read. This behavior is indicative of data staging by the MedusaLocker ransomware variant prior to encryption or exfiltration.
Detects use of custom encoding methods to archive data for exfiltration
Detects use of custom encoding methods to archive data for exfiltration
This rule detects the use of the 'ditto' command-line utility on macOS for data staging and compression, specifically looking for executions that use compression flags (-c, -k) and target the /tmp/ directory. This behavior is indicative of information stealer malware like Amos Stealer, which may compress collected data before exfiltration.
Detects the archiving (tar or zip) of .git directories. This activity can indicate an adversary attempting to exfiltrate full source code history and internal intellectual property.
Detects creation of large archives used to stage data for exfiltration
Detects creation of archives for staging collected data before exfiltration
Detects the creation of zip archives matching the specific naming convention (Unix-[HOSTNAME]-[ID].zip) used by the UnixStealer malware family. Detecting these host artifacts enables early discovery before successful exfiltration.
This rule detects potential data exfiltration attempts where data is archived using scripting libraries. It specifically looks for HTTP traffic (flow:to_client,established) containing the strings "zipfile", "ZipFile(", and "write(" in the file data, indicating the use of a scripting library to create and write to a zip archive. This combination suggests that a client is receiving or downloading an archived file that was likely created programmatically for exfiltration.
This rule detects HTTP requests that contain both '7z' and '-p' in the URI, which could indicate the use of 7zip or WinRAR to archive data with a password, potentially for exfiltration. The rule specifically looks for these strings in the URI of an HTTP request flowing from the internal network to an external server.
This rule detects HTTP POST requests that contain data resembling a ZIP archive (indicated by 'PK' header) and have a size greater than 50,000 bytes. This pattern is often associated with data exfiltration where collected data is archived before being sent out of the network.
Detects the creation of archive files (zip, rar, 7z, tar.gz) by processes other than common archiving utilities. This could indicate data staging or preparation for exfiltration by an adversary.
Detects PowerShell command-line executions attempting to compress data originating from the Windows RDP Bitmap Cache directory. Attackers perform this action to stealthily exfiltrate captured RDP session image fragments for offline reconstruction.
Detects PowerShell command-line executions attempting to compress data originating from the Windows RDP Bitmap Cache directory. Attackers perform this action to stealthily exfiltrate captured RDP session image fragments for offline reconstruction.
This rule detects a multi-stage exfiltration technique observed on macOS systems, specifically targeting the AMOS malware. It correlates process execution events related to archiving (using 'ditto'), splitting files (using 'split'), and network connections involving 'curl' with specific headers or to known malicious infrastructure. The rule looks for a combination of these activities, indicating data staging and subsequent exfiltration in chunks.
This rule detects the use of the 'makecab.exe' utility to compress the Active Directory database (ntds.dit) or the SYSTEM registry hive. This is a technique used by attackers to prepare credentials and system secrets for exfiltration, as observed in intrusions following FortiGate compromises.
Page 7 of 9