Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
198 detections
Filters
Last updated
All Time
Detection languages
130
15
14
12
9
Contributors
44
38
22
21
9
Categories
114
84
59
48
42
Platforms
134
38
26
21
15
Products / Services
79
27
26
10
10
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
IDS Classtypes
3
1
1
IDS Protocols
2
2
1
Detects the execution of OSQL.EXE to perform a database table dump to a file on the local system. The rule specifically monitors for OSQL connecting to a local SQL instance (localhost or 127.0.0.1) and utilizing the output flag (-o) to save query results to a file with a .sql extension, which is a common indicator of unauthorized data staging or collection.
Detects a game launcher writing a new executable beneath AppData or the user profile, which is unusual for signed platform updates and may represent RokRAT or BirdCall staging. This rule specifically looks for file creation events where the file is an executable (.exe), the path is within a user's AppData, Documents, or Downloads folder, and the creating process is identified as a game, launcher, update, or patch executable.
This rule detects suspicious file activity involving Alternate Data Streams (ADS) and file names containing 'WDFOO' or 'wermgr.exe' within specific 'RP_' staging directories. Such activity is often associated with file-based staging, persistence, or potential obfuscation techniques using NTFS streams.
Detects the macOS.Gaslight Python collection module compressing staged data into a ZIP archive (collected_data.zip) using shutil.make_archive for subsequent exfiltration over Telegram C2. The module calls compress_output() which archives browser credentials, keychain, terminal history, and process snapshots into temp/collected_data.zip.
Detects a sequence of activity where WinRAR is used to archive data, followed by the use of WinSCP to potentially exfiltrate that data, occurring on the same host within a 24-hour window.
Detects a game-related process creating ZIP, 7z, or encrypted data containers in an inconspicuous AppData subdirectory. This behavior is indicative of data staging prior to exfiltration, often seen in supply chain attacks or targeted espionage.
This rule detects large internal data transfers within the home network, specifically looking for TCP traffic with a data size greater than 65000 bytes. It triggers an alert if more than 50 such transfers occur from a single source within a 60-second window. This behavior is indicative of data staging, where an adversary might be collecting and consolidating data prior to exfiltration.
Detects unauthorized processes attempting to access sensitive web browser files (Login Data, Local State, Cookies) and subsequently copying or staging these files to temporary directories (Windows Temp or AppData Temp) within a 5-minute window, a technique often used for credential harvesting.
Detects processes creating a high volume of archive files (zip, rar, 7z, etc.) within common user-writable or temporary system directories. This behavior is indicative of data collection and staging activities, often a precursor to exfiltration. The rule filters out trusted Microsoft processes and established backup or synchronization applications to reduce noise.
Detects processes creating a high volume of archive files (zip, rar, 7z, etc.) within common user-writable or temporary system directories. This behavior is indicative of data collection and staging activities, often a precursor to exfiltration. The rule filters out trusted Microsoft processes and established backup or synchronization applications to reduce noise.
This rule detects when a non-Outlook process running as SYSTEM accesses or creates PST or OST mailbox data files. The logic specifically excludes legitimate Outlook, searchindexer, or searchprotocolhost activity to focus on suspicious mailbox collection sequences.
This rule detects suspicious staging activity by monitoring for the creation of 'editor.dat' files in sensitive directories like C:\Users\Public or C:\Windows\Tasks, or the rapid accumulation of multiple executable files (.exe, .dll, .cpl) within the C:\Users\Public directory, which is a common technique used by attackers to stage tools before execution or lateral movement.
This rule detects suspicious staging activity by monitoring for the creation of 'editor.dat' files in sensitive directories like C:\Users\Public or C:\Windows\Tasks, or the rapid accumulation of multiple executable files (.exe, .dll, .cpl) within the C:\Users\Public directory, which is a common technique used by attackers to stage tools before execution or lateral movement.
Detects the creation of specific file names ('oBKhrQLe1CKmO3RhHO', 'logs.txt', 'ExitCode.txt', 'Key10.txt') within the user AppData Local Temp directory, which is indicative of staging or logging activity by potential malware.
Detects the use of 7-Zip (7z.exe or 7zip.exe) to archive files within common user directories (Desktop, Documents, Users, AppData). This activity is often associated with staging sensitive data prior to exfiltration.
Detects the execution of PowerShell with the Compress-Archive cmdlet where the process originates from user-writable directories (AppData\Local or AppData\Roaming). This behavior is often associated with the staging of data for exfiltration or the compression of unauthorized tools or logs in a user context.
This rule detects suspicious activity involving a high volume of file compression using common archiving tools like 7-Zip and WinRAR. Adversaries often compress data before exfiltration or for staging purposes to reduce size and potentially evade detection. A high count of compression events within a short timeframe (1 hour) by a single account could indicate malicious activity.
This rule detects suspicious bulk access and transfer behavior targeting sensitive files, which could indicate data exfiltration. It identifies scenarios where a single account accesses a large number of files, totaling a significant size, within a short timeframe. The rule specifically looks for common sensitive file types such as spreadsheets, documents, PDFs, SQL databases, and backup files. This pattern is often associated with ransomware groups performing data leak extortion without encryption.
Correlates PowerShell invoking the download of 7za.exe to extract the hidden payload out.7z. This rule specifically looks for instances where '7za.exe' is executed with 'out.7z' in its command line, and this execution is preceded by 'powershell.exe' with '7-zip.org' in its command line on the same device. This pattern is indicative of the UnregStealer malware's method of extracting its payload.
Detects the use of WinRAR (rar.exe) to archive files using command-line arguments indicative of data staging or exfiltration (such as continuous archiving or specific extraction flags). The rule focuses on executions originating from suspicious parent processes like web servers (w3wp.exe) or command shells, or occurring within sensitive directories such as backup locations or VMware application folders.
Detects macOS Python processes creating zip archives in temporary or 'collected_data' folders, potentially indicating data collection and exfiltration staging. The rule specifically looks for Python processes that have previously accessed sensitive paths like 'login.keychain-db' or performed data collection/compression activities.
Page 5 of 10