Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,686 detections
Filters
Last updated
All Time
Detection languages
1,342
389
264
219
197
Contributors
620
506
358
209
102
Categories
20,456
11,839
5,876
5,155
4,865
2,686
Platforms
1,168
638
452
382
359
Products / Services
593
445
403
264
229
MITRE Techniques
1,884
787
525
521
510
CVEs
11
5
5
5
3
IDS Classtypes
189
133
34
10
7
IDS Protocols
243
58
33
22
12
This rule detects potentially malicious activities involving Microsoft Copilot and Microsoft Graph, specifically focusing on unauthorized mailbox access via non-interactive sessions and patterns indicative of Server-Side Request Forgery (SSRF) during search operations. It monitors for anomalous interaction with the Graph API, specific Copilot search parameters, and suspicious image search requests.
Detects outbound network connections to a known Djinn Stealer C2 IP address (96.126.130.126) on port 58942, utilizing the specific User-Agent 'telemetry-client/1.0' and 'application/octet-stream' content type. This behavior is indicative of data exfiltration of encrypted/compressed archives.
This rule detects network connections to Discord's API webhooks endpoint, specifically looking for POST requests. This activity can indicate data exfiltration, command and control communications, or other malicious use of Discord webhooks by adversaries.
Detects network activity associated with Djinn Stealer malware, identifying either direct connections to a known command-and-control (C2) server or HTTP exfiltration attempts using a characteristic User-Agent string and binary content type.
Detects anomalous activity associated with the 'SmartWindow' browser exploitation technique, specifically: Firefox communicating with the local SmartWindow PoC C2 API on port 8765, Firefox spawning unexpected child processes, or unauthorized processes accessing Firefox's 'places.sqlite' database to harvest browsing history or private session data.
Detects instances where scripting processes (Python, Node.js) accessed SSH key files or configuration files and subsequently initiated an outbound network connection within 60 seconds, which may indicate potential exfiltration of credentials or unauthorized access.
Detects suspicious app installations, custom app creation, and bot additions within Microsoft Teams. This rule identifies activities such as sideloaded app installations, which can bypass standard vetting processes and serve as a persistence mechanism for attackers. It also flags custom app creation outside of typical development teams, which could indicate the deployment of command and control (C2) bots or data exfiltration applications. Additionally, the rule looks for the addition of bots to teams and suspicious keywords in app names that might suggest impersonation or malicious tooling.
Detects rapid high-volume file and messaging operations across multiple Microsoft 365 services (SharePoint, OneDrive, Teams, Exchange) within a compressed 10-minute window from a single identity and IP address. This behavior can indicate data exfiltration or reconnaissance by an adversary.
Detects data exfiltration using asymmetric encrypted non-C2 protocols
Detects indicators of the Meow RAT malware staging collected data in the /tmp/shub_ directory, compressing it into shub_log.zip using 'ditto', and subsequently exfiltrating it to a hardcoded command and control (C2) domain 'qwqerrqwr2145qw[.]com/gate'. The rule correlates process events, network events, and file events to identify the full attack chain.
Identifies PowerShell using Invoke-RestMethod or Invoke-WebRequest to exfiltrate archives via HTTP POST, specifically looking for multipart/form-data boundaries in the command line.
Detects command-line utilities connecting to notorious cloud storage providers heavily favored by threat actors for data exfiltration.
Detects network connections on port 21 (FTP) where the RemoteUrl contains common FTP data type commands ('TYPE A', 'TYPE I', 'TYPE a', 'TYPE i'). This could indicate active FTP sessions, potentially for data transfer or exfiltration.
Detects the execution of S3 Browser or Office installation executables, followed by network traffic from the same host to known cloud storage or file-sharing sites within a short time window. This behavior aligns with Muddled Libra's method of staging and exfiltrating sensitive data, such as PST files, to adversary-controlled cloud buckets.
Detects rapid high-volume file and messaging operations across multiple Microsoft 365 services (SharePoint, OneDrive, Teams, Exchange) within a compressed 10-minute window. This behavior can indicate data exfiltration or collection by an adversary.
Detects instances of FTP transfer mode switching (ASCII/Binary) by monitoring network events for FTP traffic on port 21 and specific commands like 'TYPE A' or 'TYPE I' in the RemoteUrl. This behavior can be indicative of data transfer activities, potentially related to vulnerabilities or malicious data exfiltration.
This rule detects the execution of suspicious executables ('servertool.exe', 'encrypt.exe') when their command line arguments contain references to common cloud storage services (OneDrive, SharePoint, GoogleDrive, Dropbox, iCloud). This pattern could indicate an attempt to exfiltrate data to cloud storage or encrypt data for impact, potentially as part of a ransomware attack.
This rule detects potential cleartext leakage of usernames and passwords over FTP (port 21) by identifying HTTP requests containing common credential-related keywords in the URL, while explicitly excluding HTTPS traffic. This could indicate sensitive information being transmitted insecurely.
Detects instances of FTP transfer mode switching (ASCII/Binary) by monitoring network events for FTP traffic on port 21 and specific commands like 'TYPE A' or 'TYPE I' in the RemoteUrl. This behavior can be indicative of data transfer activities, potentially related to vulnerabilities or malicious data exfiltration.
Detects unusually large FTP responses containing 'LIST' or 'NLST' commands, potentially indicating an attempt to exploit the Squidbleed vulnerability or similar data exfiltration over FTP. The rule specifically looks for network events on port 21 (FTP) where the action type is 'NetworkSignatureInspected' and the RemoteUrl contains either 'LIST' or 'NLST' with a string length greater than 4000 characters.
Detects the execution of known Oracle database PII exfiltration scripts and patterns associated with the 'MexicanMafia Operation Escaneo' campaign. The rule monitors for specific command-line activity, including the use of extraction scripts like 'dump_oracle_pii.sh', 'fast_extract.py', and database-level exfiltration techniques such as UTL_FILE or sys_eval targeting incremental CSV exports to /tmp.
Page 66 of 128