Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
155 detections
Filters
Last updated
All Time
Detection languages
62
29
14
11
11
Contributors
44
29
13
10
9
Categories
82
75
74
44
38
Platforms
132
22
18
6
1
Products / Services
49
37
12
8
7
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
1
1
1
IDS Classtypes
3
2
2
IDS Protocols
3
2
1
1
This rule detects the use of the 7-Zip utility (7z.exe) located in 'C:\Users\Public\Documents\' to archive files, specifically monitoring for the creation of an archive file named 'p.7z' within the same directory. This pattern of staging files and using an archive utility in public, writeable directories is a common behavior observed in adversary data exfiltration preparation.
This rule detects the use of the 7-Zip utility (7z.exe) located in 'C:\Users\Public\Documents\' to archive files, specifically monitoring for the creation of an archive file named 'p.7z' within the same directory. This pattern of staging files and using an archive utility in public, writeable directories is a common behavior observed in adversary data exfiltration preparation.
Detects the use of the FTP 'STOR' command to transmit a file with the '.pcap' extension to an external network. This behavior is indicative of potential data exfiltration where captured network traffic is being uploaded to an attacker-controlled server.
This rule detects when a .zip archive file is created on a host. The creation of archive files can be a precursor to data exfiltration or a method for adversaries to bundle malicious tools for movement.
This rule detects PowerShell processes (powershell.exe, powershell_ise.exe, pwsh.exe) that execute the 'Compress-Archive' cmdlet in conjunction with strings indicative of data staging or exfiltration workflows (e.g., 'ZIPDOWNLOAD', '-DestinationPath'). The detection logic further narrows the scope by identifying if the parent process (InitiatingProcessCommandLine) involved activities related to downloading or uploading files, suggesting an automated staging and potential exfiltration sequence often seen in malicious backdoors.
Detects unusually large 7-Zip/WinRAR archive creation from non-standard staging directories followed by outbound network activity, consistent with Gunra's data-staging step before double-extortion exfiltration.
Detects macOS infostealer malware using the curl utility to exfiltrate archived data (zip, tar, tgz, etc.) via multipart POST requests to specific known staging endpoints associated with the ClickFix campaign.
This rule detects the creation of Google Cloud Platform (GCP) persistent disk snapshots. Monitoring for disk snapshot creation is critical as adversaries may use this functionality to create backups of sensitive virtual machine disks for exfiltration, staging, or offline analysis, effectively bypassing traditional network-based egress controls.
Detects a process accessing browser credential-related files (Login Data, Cookies) across three or more distinct browser profiles within a 5-minute window, followed by the creation of a ZIP archive by the same process within 10 minutes. This behavior is indicative of credential theft activities where browser profiles are harvested and bundled for exfiltration, consistent with techniques used by infostealers like Dolphin X.
Detects an untrusted process accessing sensitive browser credential and cookie files across multiple browser families and profiles in a short period, followed immediately by the creation of a ZIP archive. This pattern is consistent with the behavior of credential-stealing malware like Dolphin X, which aggregates stolen browser data into an archive for exfiltration.
Detects a single unrecognized process combining two or more distinct PRO/ULTIMATE surveillance behaviors: webcam capture via Win32 Media Foundation, screenshot/screen-recorder file drops, and keystroke/clipboard dump file creation, within a short 15-minute window. Excludes known legitimate screen-recording, remote-support, and accessibility software.
MAL AMOS yara x
YARA
This YARA rule detects the Amos Stealer malware on macOS by matching a specific Mach-O dylib hash and entitlement hash, which are consistent markers for samples of this information stealer.
Detects execution or file activity associated with 'nvidia-sysruntime.exe', a known masquerading file name used by LabubaRAT, which often performs unauthorized archiving or staging of data.
Detects macOS Mach-O binaries containing AES-GCM cipher references combined with /tmp staging paths, consistent with CrashStealer encrypting stolen data locally with AES-GCM before staging it in /tmp for exfiltration
Detects execution of the process named nvidia-sysruntime.exe, which is identified as a malicious component associated with LabubaRAT. The rule monitors for file system events triggered by this specific binary, which is masquerading as a legitimate NVIDIA component.
Detects execution or file activity associated with 'nvidia-sysruntime.exe', a known masquerading file name used by LabubaRAT, which often performs unauthorized archiving or staging of data.
Detects execution or file activity associated with 'nvidia-sysruntime.exe', a known masquerading file name used by LabubaRAT, which often performs unauthorized archiving or staging of data.
This YARA rule suite is designed to detect the Qbit Stealer malware and associated development artifacts. It uses specific string matches indicative of the stealer's configuration, logging, and functionality (such as file archiving and exfiltration) alongside development indicators like developer contact information and project metadata.
Detects execution of WinRAR utilities (rar.exe, winrar.exe) where the command line contains the '-a' (add to archive) flag or involves paths typically associated with data staging (Temp, AppData, Users, or Public directories), which may indicate an attempt to archive collected data prior to exfiltration.
Detects the execution of common archival utilities (7zip, WinRAR) with command-line arguments specifying password protection. Attackers often use these utilities to compress and encrypt data prior to exfiltration to evade detection and prevent unauthorized access to sensitive files.
Detects the Yuta/Glove stealer malware (winupdate.exe) communicating with Discord webhooks or API endpoints. This behavior is indicative of data exfiltration or receipt of interactive RAT commands, such as shell, webcam, keylogger, and system tracing.
Page 3 of 8