Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,686 detections
Filters
Last updated
All Time
Detection languages
1,342
389
264
219
197
Contributors
620
506
358
209
102
Categories
20,456
11,839
5,876
5,155
4,865
2,686
Platforms
1,168
638
452
382
359
Products / Services
593
445
403
264
229
MITRE Techniques
1,884
787
525
521
510
CVEs
11
5
5
5
3
IDS Classtypes
189
133
34
10
7
IDS Protocols
243
58
33
22
12
Detects a sequence of events indicative of data exfiltration: an unknown process creates an image file in a temporary folder, followed by the creation of an archive file (ZIP/RAR) by the same or a related process within 10 minutes, and concludes with a successful outbound network connection to a non-private IP address from the same device.
Detects GitHub Actions runner processes (e.g., node, bash, python) accessing sensitive CI/CD environment variables (GITHUB_TOKEN, NPM_TOKEN) followed within 30 seconds by an outbound network connection to a non-GitHub domain. This pattern is indicative of potential secret exfiltration by compromised CI/CD pipelines or malicious build steps.
This rule monitors for three categories of potentially suspicious network behavior: connections to common CDN providers over non-standard ports, high-volume HTTPS connections directly to IP addresses (IP-direct) bypassing standard domain resolution, and high-volume traffic to CDN infrastructure that may indicate domain fronting or C2 communication. Such patterns are often used by adversaries to mask egress traffic or exfiltrate data.
Detects network connections to Google Cloud services (calendar.google.com, googleapis.com) over port 443 originating from processes other than known web browsers or standard Google background applications. This behavior may indicate unauthorized tools, custom scripts, or malware using Google services for command and control or data exfiltration.
Detects suspicious OpenProcess calls initiated by common user applications (explorer.exe, winword.exe, outlook.exe) targeting svchost.exe, followed by an outbound network connection from the target svchost.exe to the file sharing service filen.io within a 30-minute window. This behavior is indicative of process injection used to facilitate network communication or data exfiltration under the guise of a system process.
Detects the execution of known command-line sync tools (Rclone, MEGAsync) or commands attempting to sync or move data to various cloud storage services (s3, gdrive, onedrive, mega, dropbox). The rule focuses on executions from suspicious or temporary directory paths and excludes processes signed by trusted publishers to minimize noise.
This rule detects suspicious process command lines that indicate potential tunneling activity. It looks for commands containing 'tunnel', '--url', and '--logfile', while excluding legitimate 'cloudflared.exe' processes. This pattern is often used by adversaries to establish covert communication channels or exfiltrate data.
Detects a high volume of file uploads (greater than 50) to OneDrive or SharePoint by a single user within a 5-minute window, potentially indicating bulk exfiltration of data.
Detects bulk file access, download, or sync operations by a single user account within a 30-minute window in Microsoft SharePoint Online or OneDrive for Business. This behavior is indicative of potential data exfiltration or unauthorized mass collection of sensitive information.
Detects network traffic duplication using GRE for covert exfiltration
Detects data exfiltration split into many small HTTP POST requests
Detects the creation or modification of a large file named 'logs.dat' (100KB or greater) within common user-related directories such as AppData, Temp, Users, or Documents. This pattern can indicate data staging for exfiltration, where an adversary collects sensitive information into a single file before attempting to move it off the system.
Detects the creation or modification of an email compliance or forwarding rule containing the specific typo "Patroit". This indicator is associated with the UNC6508 threat actor's data exfiltration activities via silently BCC-forwarding sensitive emails.
Tracks the Kali365 tool iterating through the victim's inbox, performing mass mail item reads or API-driven exports of mailbox contents.
Detects activity associated with the Lightlife RAT, which involves PowerShell scripts accessing cryptocurrency wallet browser extension directories, staging data using archive utilities, and exfiltrating collected data to external destinations like the Telegram Bot API.
Detects network connections to Microsoft OneDrive or SharePoint domains from processes that are not standard, known-good applications (e.g., browsers or standard sync clients). This behavior may indicate an adversary leveraging cloud storage for command-and-control (C2) operations or data exfiltration.
This rule detects anomalous DNS query activity that may indicate command and control (C2) or data exfiltration over the DNS protocol. It monitors for three specific indicators: excessive query volume to a single domain family within a short timeframe, the use of abnormally long DNS subdomain labels, and the transmission of TXT record queries from endpoints not acting as designated DNS servers.
This rule detects potential data exfiltration by identifying devices that make a high number of network connections (3 or more within an hour) to various remote IPs using common file transfer and email protocols (FTP, SFTP, SMB, SMTP) on their standard ports (21, 22, 445, 25, 587). This pattern can indicate an adversary attempting to exfiltrate collected data from a compromised system.
Tracks network connections from non-browser processes that transmit an abnormally large volume of outbound bytes, indicating active data exfiltration. This rule specifically excludes common browser processes (chrome.exe, msedge.exe, firefox.exe) and OneDrive (onedrive.exe) to reduce false positives. It aggregates outbound network activity over 10-minute intervals and flags any instance where the total outbound bytes exceed 100MB.
Detects explorer.exe making DNS requests to Discord or Telegram, which is anomalous and indicates potential process injection for data exfiltration. This behavior is associated with information stealer malware like Phantom Stealer.
Detects command line activity attempting to push, commit, or create repositories containing specific Miasma exfiltration signatures, which are associated with the Shai-Hulud malware variant. This rule looks for distinct string patterns in process command lines indicating the use of these signatures for data exfiltration to code repositories.
Page 62 of 128