Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
198 detections
Filters
Last updated
All Time
Detection languages
130
15
14
12
9
Contributors
44
38
22
21
9
Categories
114
84
59
48
42
Platforms
134
38
26
21
15
Products / Services
79
27
26
10
10
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
IDS Classtypes
3
1
1
IDS Protocols
2
2
1
Detects access, creation, or modification of sensitive browser files (Cookies, Login Data, Local State) associated with Google Chrome or Microsoft Edge. The rule specifically flags when these files are interacted with within standard user directories or when they are copied to known browser backup folders, a common behavior during credential theft or data staging.
Detects large outbound network transmissions occurring on a host shortly after the creation of staged or archive files. This behavior is indicative of an attacker consolidating sensitive data (such as credentials or intelligence) into an archive and subsequently exfiltrating it over a Command and Control (C2) or other established network channel.
Detects zip archives matching the .zx_ filename prefix convention used by CrashStealer to stage encrypted exfiltration data in /tmp prior to transmission to its C2 server.
This rule monitors for the execution of the 'pg_dump' utility by Python-based applications (like Langflow), followed by the deletion of a file on the same host within 60 minutes. This behavior may indicate an adversary staging data, dumping a database, and then attempting to remove evidence of the activity.
Detects an unusually high number of file copy operations to 'public' or 'external' folders within a one-hour window, initiated by the same process account. This behavior could indicate data exfiltration or unauthorized data staging.
Detects when a single user account creates 5 or more files within an hour that contain keywords like 'confidential', 'secret', or 'restricted' in their filenames. This behavior could indicate an attempt to stage sensitive data for exfiltration or unauthorized access to sensitive information.
This rule identifies accounts that create or modify 10 or more files, each larger than 200MB, within a one-hour period. This behavior can be indicative of data exfiltration, staging of large files, or other suspicious bulk file operations.
This rule detects suspicious activity involving a high volume of file compression using common archiving tools like 7-Zip and WinRAR. Adversaries often compress data before exfiltration or for staging purposes to reduce size and potentially evade detection. A high count of compression events within a short timeframe (1 hour) by a single account could indicate malicious activity.
Detects instances where the 'pg_dump' database utility is executed, followed by the deletion of a file within a one-hour window by the same agent. This behavior is indicative of an attacker extracting sensitive database contents and subsequently attempting to remove evidence of the dump or staging files.
This rule detects users uploading a high volume of files (50 or more within an hour) to SharePoint or OneDrive. This activity could indicate data exfiltration or unauthorized mass data transfer.
This rule identifies when a single account creates three or more files containing 'backup', 'export', or 'dump' in their filenames within a one-hour period. This activity could be indicative of data staging for exfiltration or an attempt to back up sensitive information prior to a malicious action.
Detects the use of 'curl' with '-X PUT' and '--data-binary' options, which can indicate data exfiltration or staging activities. This combination is often used to upload raw data to a specified endpoint.
This rule detects an unusually high number of file rename events (20 or more within a 1-hour window) initiated by a single process account. This behavior can be indicative of malicious activities such as data staging prior to exfiltration, ransomware encryption, or attempts to evade detection by renaming malicious files or legitimate system utilities.
This rule detects a high volume of network connections (10 or more within an hour) from a single process to remote URLs containing 'artifact' or 'maven' on standard HTTP (port 80) or HTTPS (port 443) ports. This activity could indicate legitimate software development or build processes, but also potentially malicious activities such as supply chain compromise, data staging, or exfiltration of development-related artifacts.
Detects the use of WinRAR (rar.exe/winrar.exe) to create archives with password protection or recursive flags in common staging directories (Temp, AppData, ProgramData, Users\Public, Share). This behavior is often associated with the staging and obfuscation of collected data prior to exfiltration.
Detects the execution of WinRAR or rar.exe with command-line arguments often used for staging data, including file addition, archive creation, and extraction. This activity is frequently associated with the preparation of files for exfiltration or the unpacking of malicious payloads.
Detects the use of 7-Zip (7z.exe or 7zip.exe) to archive files within common user directories (Desktop, Documents, Users, AppData). This activity is often associated with staging sensitive data prior to exfiltration.
Detects upload of encrypted archive files indicating staged exfiltration
Detects the creation or modification of a large file named 'logs.dat' (100KB or greater) within common user-related directories such as AppData, Temp, Users, or Documents. This pattern can indicate data staging for exfiltration, where an adversary collects sensitive information into a single file before attempting to move it off the system.
This rule detects the creation of common media file types (audio and video) within user-specific application data, temporary, or user profile directories. This activity could be indicative of various malicious behaviors, including data exfiltration, staging of malicious payloads, or the dropping of decoy files by malware.
This rule detects a suspicious sequence of network connections indicative of information stealer activity, specifically targeting behaviors observed with malware like VVS Stealer. It identifies instances where a non-browser process, originating from common user-writable or temporary directories (AppData, Temp, Downloads, Users\Public), first connects to an external IP discovery service (ipify.org) and then subsequently communicates with Discord services (discord.com or discordapp.com) within a ten-minute window. This pattern suggests that malware is collecting the victim's public IP address before exfiltrating stolen data (e.g., account or browser information) to Discord infrastructure, often used as a command and control or data exfiltration channel by stealers.
Page 4 of 10