Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,686 detections
Filters
Last updated
All Time
Detection languages
1,342
389
264
219
197
Contributors
620
506
358
209
102
Categories
20,456
11,839
5,876
5,155
4,865
2,686
Platforms
1,168
638
452
382
359
Products / Services
593
445
403
264
229
MITRE Techniques
1,884
787
525
521
510
CVEs
11
5
5
5
3
IDS Classtypes
189
133
34
10
7
IDS Protocols
243
58
33
22
12
Detects outbound FTP STOR (Store) commands directed to external networks. This indicates that a host inside the local network is attempting to upload data to an external server. The rule uses a threshold to filter out isolated commands, triggering when 3 or more STOR commands are detected within 120 seconds, which is characteristic of data exfiltration or staging behavior.
Analyzes HTTP network events to detect the Komari agent executing HTTP POST requests with large data payloads, indicating data exfiltration. This rule specifically looks for HTTP POST requests combined with recent file access events for common archive file types (zip, rar, 7z, db) on the same device and by the same initiating process.
This rule detects attempts by processes located outside of standard system directories (C:\Windows, C:\Program Files) but within user or program data directories (C:\Users, C:\ProgramData, C:\AppData) to access clipboard data. This could indicate malicious activity where an unauthorized application is trying to exfiltrate sensitive information from the clipboard.
This rule detects HTTP PUT requests with specific URL parameters ('buildtxd=', 'upload_id=', 'chunk_index=', 'total_chunks=') and a 'Mozilla/5.0' user agent, directed towards known malicious domains ('bestbuydomain.com', 'premierrentalpurchase.com'). This pattern is indicative of data exfiltration, potentially by malware uploading stolen data in chunks.
Detects potential data exfiltration attempts initiated by 'explorer.exe' over common third-party services or protocols such as Telegram, Discord webhooks, FTP, or SMTP. This rule specifically looks for network connections made by 'explorer.exe' to known exfiltration channels, which is unusual behavior for the Windows Explorer process.
Detects anomalous svchost.exe behavior involving the use of libjpeg-turbo compression function symbols in the command line, alongside potential C2 communication with a known suspicious domain (kkxqbh.top) or connection over non-standard ports, which may indicate malicious exfiltration or data staging.
Detects outbound network connections initiated by common CLI tools (curl, wget, python, node) when spawned as child processes of an IDE or extension host (e.g., VS Code). This pattern is indicative of potential AWS credential exfiltration where an adversary manipulates IDE configurations (like .amazonq/mcp.json) to execute unauthorized network requests containing AWS secrets.
Detects thousands of OneDrive or SharePoint file downloads by a single account during a short period, indicating automated collection rather than ordinary user activity.
Detects a sequence of activity where WinRAR is used to archive data, followed by the use of WinSCP to potentially exfiltrate that data, occurring on the same host within a 24-hour window.
Detects WinRAR executing with archiving flags (create, add, move) on sensitive paths, followed by an outbound network connection to a non-private IP address within a 10-minute window, which is characteristic of data staging and exfiltration.
This rule detects the staging of data using WinRAR, followed by potential exfiltration to known public file-sharing services (easyupload.io, anonfiles.com, gofile.io, transfer.sh) within a 2-hour window. It monitors for either DNS requests to these domains or the execution of web browsers or common command-line tools (curl, wget, PowerShell) with these domains in the command line arguments following WinRAR usage.
Detects a non-cloud client process issuing API-style requests associated with object listing, content upload, or content download to a cloud storage service. The rule specifically targets processes with names matching patterns like 'bird', 'rok', 'game', or 'update' followed by '.exe', and command lines containing API-related keywords ('files/list', 'files/upload', 'files/download', 'oauth', 'bearer', 'api') in conjunction with cloud storage service names ('dropbox', 'pcloud', 'cloud'). This behavior is indicative of malware using legitimate cloud services for command and control or data exfiltration.
Detects FTP data connections initiated by 'squid.exe' on high port ranges (1024-65535). This could indicate an attempt to exfiltrate data using an alternative protocol, potentially related to the 'Squidbleed' vulnerability or other malicious activity.
This rule detects potential exposure of API keys, tokens, or secrets within FTP directory listings. It specifically looks for network events on remote port 21 (FTP) where the 'RemoteUrl' contains keywords like 'api_key', 'apikey', 'token', 'secret', or 'key=' during a network signature inspection.
Detects unusually large FTP responses containing 'LIST' or 'NLST' commands, potentially indicating an attempt to exploit the Squidbleed vulnerability or similar data exfiltration over FTP. The rule specifically looks for network events on port 21 (FTP) where the action type is 'NetworkSignatureInspected' and the RemoteUrl contains either 'LIST' or 'NLST' with a string length greater than 4000 characters.
Hunts for the stealer exfiltrating compressed host profiling information (sw_vers, system_profiler) via HTTP POST using curl.
This rule detects an unsigned process executing from the AppData or Temp directories that loads user32.dll, a required step for installing keyboard hooks (SetWindowsHookEx). This activity is correlated with network connections from the same process to the Telegram Bot API, a common technique for exfiltrating captured keystrokes or other sensitive data.
Detects a single new session identifier accessing Exchange, SharePoint, and OneDrive within a short period, which may indicate broad post-authentication collection following an adversary-in-the-middle (AiTM) attack.
Detects instances where 'node.exe' is copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories, potentially indicating data exfiltration or staging. This behavior has been observed in supply chain attacks like the 'easy-day-js' incident involving the 'protocal.cjs' backdoor.
This rule detects HTTP POST connections initiated by 'AutoIt3.exe' which is indicative of Vidar Stealer attempting to exfiltrate data to its C2 server. The rule specifically looks for network events where the HTTP method is POST and joins them with process events where the initiating process is 'AutoIt3.exe'.
Detects a rapid burst of file upload activity to cloud storage applications from a single account, including unusual proxy or device context. This rule identifies scenarios where an account performs 20 or more upload events or uploads 20 or more distinct objects within a 15-minute time window to common cloud storage services like Google Drive, Dropbox, Box, MEGA, OneDrive, or ShareFile. It also highlights if any of these uploads originate from an anonymous proxy.
Page 72 of 128