Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
191 detections
Filters
Last updated
All Time
Detection languages
95
36
20
19
10
Contributors
35
34
27
18
13
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
58
51
41
23
22
Products / Services
40
30
18
17
13
MITRE Techniques
90
44
34
28
27
CVEs
6
2
2
2
2
IDS Classtypes
14
8
6
3
1
IDS Protocols
20
9
4
1
This rule detects attempts to exploit a vulnerability in the WordPress Super Forms plugin (CVE-2026-14894). The rule monitors for malicious file upload requests containing embedded PHP code or attempts to bypass filename extensions for PHP files via the super_submit_form AJAX action.
Detects incoming HTTP POST requests targeting the 'admin-ajax.php' endpoint with parameters associated with a malicious file upload exploit against Elementor Pro (CVE-2026-32475). The rule specifically looks for the 'elementor_pro_forms_send_form' action and the presence of PHP file extensions within form fields, indicating an attempt to upload a web shell.
Detects high-frequency S3 object upload activity (PutObject/CompleteMultipartUpload) originating from the Rclone tool, a common indicator of potential data exfiltration to cloud storage.
Detects high-frequency S3 object upload activity (PutObject/CompleteMultipartUpload) originating from the Rclone tool, a common indicator of potential data exfiltration to cloud storage.
Detects upload requests targeting executable or server-side script file extensions.
Detects HTTP upload requests directed to common web directory paths that contain suspicious file extensions, specifically archive formats (e.g., zip, rar, tar) or macro-enabled Office documents (e.g., docm, xlsm). This behavior is often associated with the delivery of malware payloads.
This rule detects large file uploads (greater than 100MB) from endpoints to unmanaged or personal cloud storage services such as Google Drive, OneDrive, and Dropbox. This behavior may indicate unauthorized data exfiltration or the improper use of unapproved cloud storage platforms to move sensitive data outside of corporate control.
This rule monitors Netskope cloud application events to detect potential data exfiltration. It triggers if there is a significant volume anomaly (z-score >= 2) for any cloud application activity, or if a 'Share' or 'Upload' activity occurs that is only configured to 'Alert' rather than being blocked. This helps identify unusual spikes in data movement or sensitive operations that bypass formal enforcement controls.
Detects DLP events from Netskope where sensitive data (PII, PCI, Source Code, or Credentials) is being uploaded or shared, indicating potential data exfiltration.
Detects DLP policy violations flagged by Netskope when users upload, share, post, or send files within Slack or Microsoft Teams. This rule monitors for DLP profile matches which may indicate unauthorized exfiltration or exposure of sensitive data via collaboration tools.
Detects DLP policy violations flagged by Netskope when users upload, share, post, or send files within Slack or Microsoft Teams. This rule monitors for DLP profile matches which may indicate unauthorized exfiltration or exposure of sensitive data via collaboration tools.
This rule detects large file uploads (greater than 100MB) from endpoints to unmanaged or personal cloud storage services such as Google Drive, OneDrive, and Dropbox. This behavior may indicate unauthorized data exfiltration or the improper use of unapproved cloud storage platforms to move sensitive data outside of corporate control.
Detects instances where sensitive or organizational data is uploaded to public text storage repositories like Pastebin or GitHub Gists through Netskope, which may indicate data exfiltration.
Detects instances where Netskope Advanced Threat Protection (ATP) identifies a malicious file during a user-initiated upload or download operation.
Detects instances where Netskope Advanced Threat Protection (ATP) identifies a malicious file during a user-initiated upload or download operation.
Detects DLP events from Netskope where sensitive data (PII, PCI, Source Code, or Credentials) is being uploaded or shared, indicating potential data exfiltration.
Detects instances where sensitive or organizational data is uploaded to public text storage repositories like Pastebin or GitHub Gists through Netskope, which may indicate data exfiltration.
Detects potentially unauthorized or suspicious file activities such as bulk downloads, external file sharing, or CASB policy violations monitored by Zscaler ZIA, which may indicate data exfiltration or policy non-compliance.
Detects potentially unauthorized or suspicious file activities such as bulk downloads, external file sharing, or CASB policy violations monitored by Zscaler ZIA, which may indicate data exfiltration or policy non-compliance.
Detects macOS infostealer malware using the curl utility to exfiltrate archived data (zip, tar, tgz, etc.) via multipart POST requests to specific known staging endpoints associated with the ClickFix campaign.
Detects anomalous activity in Microsoft 365 calendar events where potential C2 data is exfiltrated or synchronized. This is identified by the creation or modification of calendar events containing suspicious file names (e.g., File0.txt, File1.txt) or specific command-and-control markers within the event subject.
Page 4 of 10