Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
198 detections
Filters
Last updated
All Time
Detection languages
130
15
14
12
9
Contributors
44
38
22
21
9
Categories
114
84
59
48
42
Platforms
134
38
26
21
15
Products / Services
79
27
26
10
10
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
IDS Classtypes
3
1
1
IDS Protocols
2
2
1
Detects instances where AI developer tools or IDE assistants (e.g., Claude, Copilot, Cursor) execute data collection commands (such as directory traversal or archiving) followed by or concurrent with the bulk access of sensitive files (credentials, configuration files) or personal user data.
Detects instances where AI developer tools or IDE assistants (e.g., Claude, Copilot, Cursor) execute data collection commands (such as directory traversal or archiving) followed by or concurrent with the bulk access of sensitive files (credentials, configuration files) or personal user data.
Detects the use of 7-zip (7z.exe) to interact with a specific file (drata.dat) using command-line arguments typical of an archival or extraction operation. This may indicate an adversary attempting to stage, compress, or exfiltrate sensitive data.
Detects hosts exhibiting multiple distinct file-manipulation commands (upload, download, stop, delete, append, copy, move) within a single session as identified by the PivotPipe C2 protocol, indicating potential staging, collection, or exfiltration activity.
Detects suspicious PowerShell activity involving compression commands (e.g., Expand-Archive) within APPDATA, correlated with the execution of hypersnap.exe with hidden window arguments, and the creation of persistence via scheduled tasks. This pattern is indicative of automated staging or malicious tool execution and persistence setup.
This rule detects the presence of files and folders associated with the Rapuncel infostealer malware. It monitors DeviceFileEvents for specific SHA256 hashes known to be malicious, as well as specific file names related to data exfiltration and log collection (e.g., 'browser_decryption.log', 'sends.log'), and the creation of files within folders containing 'Filegraber'.
Detects the use of database or archiving command-line utilities to export data related to RADIUS services. The rule filters out known backup service accounts and authorized backup processes, flagging activity that occurs outside of standard business hours or is performed by accounts not explicitly designated for administrative or database maintenance tasks.
Detects the use of database or archiving command-line utilities to export data related to RADIUS services. The rule filters out known backup service accounts and authorized backup processes, flagging activity that occurs outside of standard business hours or is performed by accounts not explicitly designated for administrative or database maintenance tasks.
Detects instances where a process running as 'root' modifies files within an Acronis-related directory. This specifically alerts when the modifying process is not identified as a known, authorized Acronis backup service, potentially indicating unauthorized tampering with backup archives or configuration files.
Detects network communication patterns associated with the RUSTYSHADE malware family, which leverages the GitHub REST API for command-and-control (C2) operations. The rule monitors for specific SNI indicators, GitHub API URL patterns for command retrieval, task/result file interactions, exfiltration of files (screenshots/webcam photos), and custom encrypted request body markers.
Detects the creation of compressed archive files (zip, rar, 7z, dat) followed by a significant network upload (exceeding 5MB) on the same host within a 30-minute window, which is indicative of staging and exfiltrating collected data.
This rule detects potentially unauthorized access or large-scale extraction of sensitive RADIUS server configuration and credential databases. It monitors for common database management tools and commands used in conjunction with RADIUS-specific paths, particularly when executed by unexpected processes, during off-hours, or in a manner indicative of bulk data export.
This rule detects potentially unauthorized access or large-scale extraction of sensitive RADIUS server configuration and credential databases. It monitors for common database management tools and commands used in conjunction with RADIUS-specific paths, particularly when executed by unexpected processes, during off-hours, or in a manner indicative of bulk data export.
Detects the use of database or archiving command-line utilities to export data related to RADIUS services. The rule filters out known backup service accounts and authorized backup processes, flagging activity that occurs outside of standard business hours or is performed by accounts not explicitly designated for administrative or database maintenance tasks.
Detects activity where potential staging files (e.g., .dat or .dll files with specific naming patterns) are created or accessed within suspicious directories like AppData or RuntimeBroker folders, followed by the execution or loading of 'libcurl.dll'. This pattern is indicative of a loader or malware component staging its payload before using a network library to communicate with an external server.
Detects Node.js or Electron processes executing from suspicious paths (e.g., Temp, Roaming) while interacting with web browser credential files or executing commands consistent with automated credential dumping tools.
Detects suspicious file activity within directories named 'ShieldCrash' followed by a cloud provider registration or placeholder creation event within a 5-minute window. This behavior is indicative of unauthorized software or an adversary attempting to stage data for exfiltration or create persistent storage aliases outside of legitimate cloud client applications.
This rule detects potentially unauthorized access or large-scale extraction of sensitive RADIUS server configuration and credential databases. It monitors for common database management tools and commands used in conjunction with RADIUS-specific paths, particularly when executed by unexpected processes, during off-hours, or in a manner indicative of bulk data export.
Detects the use of database or archiving command-line utilities to export data related to RADIUS services. The rule filters out known backup service accounts and authorized backup processes, flagging activity that occurs outside of standard business hours or is performed by accounts not explicitly designated for administrative or database maintenance tasks.
Detects the use of database or archiving command-line utilities to export data related to RADIUS services. The rule filters out known backup service accounts and authorized backup processes, flagging activity that occurs outside of standard business hours or is performed by accounts not explicitly designated for administrative or database maintenance tasks.
Detects Node.js or Electron processes executing from suspicious paths (e.g., Temp, Roaming) while interacting with web browser credential files or executing commands consistent with automated credential dumping tools.
Page 2 of 10