Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
198 detections
Filters
Last updated
All Time
Detection languages
130
15
14
12
9
Contributors
44
38
22
21
9
Categories
114
84
59
48
42
Platforms
134
38
26
21
15
Products / Services
79
27
26
10
10
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
IDS Classtypes
3
1
1
IDS Protocols
2
2
1
Detects the creation of an Alternate Data Stream (ADS) explicitly named 'WDFOO' attached to 'wermgr.exe'. This is a high-fidelity artifact generated by the RoguePlanet zero-day exploit to manipulate Microsoft Defender's remediation.
Detects Python creating an archive containing browser, wallet, developer, cloud, and authentication data from multiple collection roots. This activity is associated with the InvisibleFerret malware.
This rule detects suspicious bulk access and transfer behavior targeting sensitive files, which could indicate data exfiltration. It identifies scenarios where a single account accesses a large number of files, totaling a significant size, within a short timeframe. The rule specifically looks for common sensitive file types such as spreadsheets, documents, PDFs, SQL databases, and backup files. This pattern is often associated with ransomware groups performing data leak extortion without encryption.
Detects a module writing command results, screenshots, file listings, or collection output into a dedicated hidden working directory. This rule specifically looks for file creation events (EventCode 11) in common temporary or application data directories, where the filename matches a pattern indicative of staged results (e.g., 'result', 'output', 'jobs', 'tasks', 'stage' followed by common data file extensions).
This rule detects repeated access attempts (read or write) to files or directories commonly associated with software build artifacts (e.g., 'build', 'release', 'artifact', 'bin', 'dist'). It specifically looks for Security Event ID 4656, which indicates a handle to an object was requested, and filters out common system accounts to focus on user-initiated access. A high number of access attempts (5 or more) within an hour by a non-system user to these sensitive object names could indicate an attempt to compromise or exfiltrate software supply chain components.
Detects patterns indicative of double extortion ransomware attacks, specifically the staging of large volumes of archived data followed by suspicious command and control (C2) communications. The rule identifies the creation, modification, or movement of multiple large archive files (RAR, 7z, ZIP, TAR, GZ, CAB) in common temporary or system directories, and correlates this activity with outbound network connections to known C2 indicators such as Tor/I2P/VPN/proxy services or non-RFC1918 IP addresses.
Detects patterns indicative of double extortion ransomware attacks, specifically the staging of large volumes of archived data followed by suspicious command and control (C2) communications. The rule identifies the creation, modification, or movement of multiple large archive files (RAR, 7z, ZIP, TAR, GZ, CAB) in common temporary or system directories, and correlates this activity with outbound network connections to known C2 indicators such as Tor/I2P/VPN/proxy services or non-RFC1918 IP addresses.
This rule detects repeated access attempts (read or write) to files or directories commonly associated with software build artifacts (e.g., 'build', 'release', 'artifact', 'bin', 'dist'). It specifically looks for Security Event ID 4656, which indicates a handle to an object was requested, and filters out common system accounts to focus on user-initiated access. A high number of access attempts (5 or more) within an hour by a non-system user to these sensitive object names could indicate an attempt to compromise or exfiltrate software supply chain components.
This rule detects the use of the 'ditto' command-line utility on macOS for data staging and compression, specifically looking for executions that use compression flags (-c, -k) and target the /tmp/ directory. This behavior is indicative of information stealer malware like Amos Stealer, which may compress collected data before exfiltration.
This rule detects the creation of common media file types (audio and video) within user-specific application data, temporary, or user profile directories. This activity could be indicative of various malicious behaviors, including data exfiltration, staging of malicious payloads, or the dropping of decoy files by malware.
Detects bulk cloning of GitHub repositories for source code collection
Detects upload of offensive security tools to cloud storage for staging
This rule identifies when a single account creates three or more files containing 'backup', 'export', or 'dump' in their filenames within a one-hour period. This activity could be indicative of data staging for exfiltration or an attempt to back up sensitive information prior to a malicious action.
This rule detects users uploading a high volume of files (50 or more within an hour) to SharePoint or OneDrive. This activity could indicate data exfiltration or unauthorized mass data transfer.
Detects bulk downloading of SharePoint document libraries
This rule detects users uploading a high volume of files (50 or more within an hour) to SharePoint or OneDrive. This activity could indicate data exfiltration or unauthorized mass data transfer.
Detects when a single user account creates 5 or more files within an hour that contain keywords like 'confidential', 'secret', or 'restricted' in their filenames. This behavior could indicate an attempt to stage sensitive data for exfiltration or unauthorized access to sensitive information.
Detects creation of large archives used to stage data for exfiltration
This rule detects a high volume of network connections (10 or more within an hour) from a single process to remote URLs containing 'artifact' or 'maven' on standard HTTP (port 80) or HTTPS (port 443) ports. This activity could indicate legitimate software development or build processes, but also potentially malicious activities such as supply chain compromise, data staging, or exfiltration of development-related artifacts.
Detects an unusually high number of file copy operations to 'public' or 'external' folders within a one-hour window, initiated by the same process account. This behavior could indicate data exfiltration or unauthorized data staging.
Detects creation of archives for staging collected data before exfiltration
Page 6 of 10