Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,686 detections
Filters
Last updated
All Time
Detection languages
1,342
389
264
219
197
Contributors
620
506
358
209
102
Categories
20,456
11,839
5,876
5,155
4,865
2,686
Platforms
1,168
638
452
382
359
Products / Services
593
445
403
264
229
MITRE Techniques
1,884
787
525
521
510
CVEs
11
5
5
5
3
IDS Classtypes
189
133
34
10
7
IDS Protocols
243
58
33
22
12
This rule detects persistent Microsoft 365 access established by an attacker using OAuth refresh tokens, typically following a device_code phishing attack. It correlates three key events: initial device_code sign-ins from non-compliant or non-managed devices, the subsequent consent to a new OAuth application (likely attacker-controlled) from the same user and within a short timeframe, and finally, Microsoft Graph mail API access originating from that newly registered application. This sequence indicates an adversary has successfully phished a user, gained consent for a malicious application, and is now using it to access the user's mailbox data.
Detects non-browser processes that load 'clr.dll' (indicating in-process .NET/CLR usage) and are sending large volumes of outbound data to Google API domains (sheets.googleapis.com, oauth2.googleapis.com, googleapis.com). This behavior is consistent with the SHEETCREEP threat actor's use of Google Sheets API for command and control (C2) and data exfiltration.
This rule detects attempts by common scripting or utility processes (like osascript, curl, zsh, bash, sh, python) to access sensitive macOS files, specifically targeting browser data (Chrome, Brave, Firefox) and keychain files. This activity could indicate an attacker attempting to exfiltrate credentials, session tokens, or other sensitive user data.
This rule detects outbound POST requests to the Telegram Bot API (api.telegram.org) originating from internal network hosts. The detection specifically looks for requests containing the 'sendMessage' path, which is characteristic of bots transmitting stolen data (such as credentials) or command-and-control communication. It focuses on traffic initiated by common command-line tools like 'python-requests' or 'curl', which are frequently abused by automated malware scripts.
This rule detects suspicious process command lines that indicate potential tunneling activity. It looks for commands containing 'tunnel', '--url', and '--logfile', while excluding legitimate 'cloudflared.exe' processes. This pattern is often used by adversaries to establish covert communication channels or exfiltrate data.
Detects the configuration and usage of personal Microsoft OneDrive accounts on corporate endpoints. This is achieved by monitoring for OneDrive process execution with personal account command-line arguments, OneDrive setup utilities configured with personal tenant identifiers, and file system activity within directory paths associated with personal OneDrive synchronization.
This rule detects DNS queries with suspicious characteristics that may indicate DNS tunneling, data exfiltration, or command and control activity. It identifies queries with unusually long names, long first labels combined with high entropy, or a high number of subdomains combined with a long first label. Exclusions are made for common legitimate DNS suffixes and specific service-related domains.
Detects malicious browser extension activity related to the StegoAd infostealer. The rule identifies a dual-indicator pattern consisting of outbound network connections to 'mitarchive.info' combined with concurrent read access to browser-specific credential store files (Google Chrome, Microsoft Edge, Mozilla Firefox) on the same host.
Detects network communication to the malicious domain 'mitarchive.info' from common web browsers (Chrome, Edge, Firefox, Brave). This domain is associated with the StegoAd browser extension, which intercepts Google and WordPress login flows to exfiltrate stolen credentials and 2FA codes.
Detects network connections to a specific suspicious IP address (94.156.181.89) or to domains associated with Cloudflare Tunnel (.trycloudflare.com). This could indicate command and control activity, data exfiltration, or other malicious network communication.
Detects suspicious network connections to 'outlook-one.vercel.app' or 'api.telegram.org' when initiated by common web browsers (msedge.exe, chrome.exe, firefox.exe) or Outlook (outlook.exe). This pattern can indicate phishing attempts, credential harvesting, or data exfiltration via Telegram bots.
Detects execution of rclone or the creation of an rclone configuration file (rclone.conf) occurring on a host within 24 hours of QEMU virtualization activity. This combination may indicate an adversary using virtualization software for staging or research, followed by data exfiltration via rclone to a remote cloud destination.
Detects execution of SharpHound (BloodHound) for Active Directory enumeration and subsequent exfiltration of collected datasets, specifically tracking activity attributed to the MexicanMafia (Operation Escaneo).
Detects outbound network traffic to api.telegram.org. This pattern is commonly observed in malware such as Sauron ransomware to establish command and control (C2) channels and perform data exfiltration by abusing the legitimate Telegram Bot API.
This rule detects the creation of a 'logs.dat' file, which is often associated with Remcos RAT for data exfiltration, in common user-related directories (AppData, Temp, Users, Documents) with a file size greater than or equal to 100KB. This pattern suggests an attempt to stage or exfiltrate collected data.
This rule detects suspicious activities related to AWS S3 buckets that could indicate a bucket hijacking attempt or unauthorized replication to an external account. Specifically, it looks for two scenarios: 1) an S3 bucket being deleted and then recreated by a different AWS account within a one-hour window, suggesting a namespace hijacking, or 2) an S3 bucket being deleted while a PutBucketReplication event references an external AWS account, indicating an attempt to exfiltrate data or maintain access through replication.
Detects network requests from the Firefox browser process containing URI patterns and parameters often associated with data exfiltration or browser-based reconnaissance, including suspicious leakage parameters and local proxy/loopback communication attempts on non-standard ports.
Detects anomalous, high-volume data transfers to Telegram API endpoints (api.telegram.org, specific IP ranges), which is indicative of data exfiltration by malware such as KuinaExtractor. The rule monitors for cumulative outbound traffic exceeding 500MB within a 1-hour session window per process.
This rule detects the use of native network utilities (wget.exe, curl.exe) executing with flags indicative of file uploads (HTTP PUT or POST) targeting archive files (zip, rar, 7z). This behavior is often associated with the direct exfiltration of staged data to attacker-controlled infrastructure.
This rule detects a potential AWS S3 bucket name hijacking scenario. It looks for instances where an S3 bucket is deleted and then a new bucket with the exact same name is created within a short time frame (up to 1 hour) by a *different* AWS account. This pattern can be used to hijack S3 replication rule destinations, enabling silent data exfiltration to an attacker-controlled account. The rule also attempts to identify if the original bucket had replication configured.
Identifies native network tools (curl.exe, wget.exe) using HTTP PUT or POST parameters to upload local archive files (zip, rar, 7z) directly to attacker-controlled IPs.
Page 61 of 128