Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
667 detections
Filters
Last updated
All Time
Detection languages
375
88
48
47
44
Contributors
204
125
117
40
22
Categories
20,432
11,818
5,871
5,150
4,864
667
Platforms
538
93
80
36
23
Products / Services
262
178
41
26
21
MITRE Techniques
438
184
165
133
119
CVEs
3
2
1
1
1
IDS Classtypes
8
6
1
IDS Protocols
7
6
2
Detects an inbound public network or remote interactive logon to a device, followed within 24 hours by credential-dumping activity, and subsequently within 7 days by email data staging (creation or modification of PST, OST, EML, or MBOX files) on the same device.
Detects PowerShell execution spawning 7zr.exe to extract password-protected 7z archives using overwrite and password switches within a specified timeframe, or referencing specific malicious IOC file names and domains.
Detects the archiving of the ProgramData AnyDesk directory using WinRAR/RAR with header encryption or the PowerShell Compress-Archive function, which indicates configuration staging for potential exfiltration.
Detects a sequence where a device runs a staging/archiving utility (such as WinRAR, 7-Zip, or a copy script) followed within 4 hours by a file transfer or synchronization tool (such as rclone or FileZilla), which is indicative of data staging prior to exfiltration.
Detects command output staged in a temporary file (/tmp/nx_cmd.txt) by a Unix shell spawned from ExifTool or Perl, typically resulting from Gotenberg CVE-2026-42589 exploitation, or detects the specific staging filename behavior independently.
Detects ProFTPD FTP server commands where an adversary uses SITE CPFR (Copy From) to reference a sensitive file path (such as /etc/passwd or SSH keys) followed by SITE CPTO (Copy To) on the same host within a 10-minute window, which indicates potential staging or unauthorized copying of sensitive system files via FTP.
Detects endpoint network connections made to known staging IP addresses often associated with data exfiltration or staging activities.
Detects Gryxa staging behavior where files are written across 2 or more distinct toolkit directories (such as WinRTCS, WER .wucache, and Diagnosis .etlcache) within a 1-hour window on a single device.
Detects a burst of uploads to Box from a single account. Where mass download suggests
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
Detects a burst of uploads to Box from a single account. Where mass download suggests
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
Detects a burst of uploads to Box from a single account. Where mass download suggests
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
Detects a burst of uploads to Box from a single account. Where mass download suggests
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
Detects a burst of uploads to Box from a single account. Where mass download suggests
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
Detects a burst of uploads to Box from a single account. Where mass download suggests
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
Detects a burst of uploads to Box from a single account. Where mass download suggests
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
Detects a burst of uploads to Box from a single account. Where mass download suggests
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
Detects a burst of uploads to Box from a single account. Where mass download suggests
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
Detects Gryxa staging behavior where files are written across 2 or more distinct toolkit directories (such as WinRTCS, WER .wucache, and Diagnosis .etlcache) within a 1-hour window on a single device.
Detects payload staging activity associated with threat actor UAC-0099, correlating the creation or modification of executable/DLL files in disguised LocalAppData directories with decoy images or library configuration files within a one-hour window.
Detects payload staging activity associated with threat actor UAC-0099, correlating the creation or modification of executable/DLL files in disguised LocalAppData directories with decoy images or library configuration files within a one-hour window.
Detects payload staging activity associated with threat actor UAC-0099, correlating the creation or modification of executable/DLL files in disguised LocalAppData directories with decoy images or library configuration files within a one-hour window.
Page 1 of 32