Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,686 detections
Filters
Last updated
All Time
Detection languages
1,342
389
264
219
197
Contributors
620
506
358
209
102
Categories
20,439
11,829
5,873
5,151
4,864
2,686
Platforms
1,168
638
452
382
359
Products / Services
593
445
403
264
229
MITRE Techniques
1,884
787
525
521
510
CVEs
11
5
5
5
3
IDS Classtypes
189
133
34
10
7
IDS Protocols
243
58
33
22
12
This rule detects potential data exfiltration attempts using PowerShell by identifying scripts that manipulate binary data into audio file formats, specifically WAV. It looks for PowerShell script block text containing mathematical operations, file I/O mode definitions, and the use of BinaryWriter, combined with specific byte sequences indicative of a WAV file header. This technique can be used to encode arbitrary data into an audio file for covert exfiltration.
Detects PowerShell scripts that read file content, iterate through it, and perform DNS host lookups, potentially for data exfiltration or reconnaissance. This combination of actions is suspicious as it suggests an attempt to process local data and resolve external network information.
Detects the execution of "ldifde.exe" to export Active Directory structure. This tool is often used by attackers to collect information about the domain for reconnaissance or exfiltration purposes. The rule specifically looks for the execution of ldifde.exe with the '-f' flag, which indicates an output file, while excluding the '-i' flag which is used for importing data.
An attempt to export an AWS EC2 instance has been detected. A VM Export might indicate an attempt to extract information from an instance.
Detects the modification of an EC2 snapshot's permissions to enable access from another account
Detects when a Microsoft Cloud App Security reported when a user or IP address uses an app that is not sanctioned to perform an activity that resembles an attempt to exfiltrate information from your organization.
Alert when a user has performed an export to a search using 'New-ComplianceSearchAction' with the '-Export' flag. This detection will detect PST export even if the 'eDiscovery search or exported' alert is disabled in the O365.This rule will apply to ExchangePowerShell usage and from the cloud.
WebDav Put Request
Sigma
A General detection for WebDav user-agent being used to PUT files on a WebDav network share. This could be an indicator of exfiltration.
Detects DNS queries for subdomains related to MEGA sharing website
Detects the recovery of a new public database instance from a snapshot. It may be a part of data exfiltration.
Detects when a Microsoft Cloud App Security reported when an app downloads multiple files from Microsoft SharePoint or Microsoft OneDrive in a manner that is unusual for the user.
Detects DNS queries for anonfiles.com, which is an anonymous file upload platform often used for malicious purposes
Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration
This rule detects the Menorah backdoor by identifying specific bytecode patterns related to its functionality. The patterns indicate capabilities such as sending system fingerprints to a command and control (C2) server, enumerating files and directories, and uploading files to the C2 server. The rule specifically targets .NET bytecode (MSIL) and requires all three sets of patterns to be present for a match, reducing false positives.
This rule detects the Konni backdoor, a remote access tool. It identifies specific byte patterns associated with the malware's network communication, handling of C2 commands, creation and uploading of CAB files, and payload expansion. The rule is designed to catch the presence of this specific malware family.
This rule detects the LumarStealer infostealer malware based on specific byte patterns (YARA signatures) associated with its core functionalities. These functionalities include collecting operating system information, sending data to a command and control (C2) server, finding files of interest, and specifically identifying cryptocurrency wallets. The rule requires all these distinct patterns to be present in a file, indicating a high confidence detection of LumarStealer.
This rule detects the MultigrainPOS infostealer by identifying specific byte patterns associated with its data exfiltration, memory scraping (likely for credentials), process searching, and service creation functionalities. It includes two versions of these patterns (v10_1 and v11_1) to cover different variants of the malware. The rule specifically targets executable files (MZ header check).
This YARA rule detects various versions of the GandCrab ransomware family by identifying specific byte patterns associated with its core functionalities. These functionalities include establishing remote connections, encrypting files, searching for files to encrypt, and enumerating antivirus processes to evade detection. The rule uses multiple sets of signatures to cover different versions and obfuscation techniques of GandCrab, ensuring a broad detection capability. The presence of these combined byte patterns within a Windows executable (MZ header check) indicates a high probability of GandCrab ransomware infection.
Yara rule that detects MultigrainPOS infostealer.
Page 128 of 128