Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
155 detections
Filters
Last updated
All Time
Detection languages
62
29
14
11
11
Contributors
44
29
13
10
9
Categories
82
75
74
44
38
Platforms
132
22
18
6
1
Products / Services
49
37
12
8
7
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
1
1
1
IDS Classtypes
3
2
2
IDS Protocols
3
2
1
1
Detects the creation of large archive files (.zip, .7z, .rar, .tar) exceeding 100MB within sensitive or high-risk directory paths such as Desktop, Temp, or AppData, or on non-system drives. This behavior is often associated with the staging of sensitive data for exfiltration.
This rule detects suspicious activity involving a high volume of file compression using common archiving tools like 7-Zip and WinRAR. Adversaries often compress data before exfiltration or for staging purposes to reduce size and potentially evade detection. A high count of compression events within a short timeframe (1 hour) by a single account could indicate malicious activity.
Detects the use of common archive utilities (7-Zip, WinRAR) to perform file archiving operations within sensitive user-profile directories (Desktop, Documents, Downloads, etc.). This pattern is often used by adversaries to stage or bundle sensitive data prior to exfiltration.
Detects the execution of 7-Zip (7z.exe) when launched from a specific directory path ('Traiolx Custom Utils') while operating on specific files named 'drata.dat' or 'data.dat'. This behavior is indicative of an adversary staging or archiving sensitive data for potential exfiltration.
This rule detects the use of 7za.exe to extract specific files (data2.bin) from an archive using a hardcoded password while located within an Avast Software directory. This behavior is indicative of potential malicious activity involving the tampering or extraction of security software components or data.
Detects the execution of 7z.exe with specific command line arguments that include references to 'data.dat' and 'Traiolx Custom Utils', which may indicate the use of 7-Zip for staging or archiving collected data for exfiltration.
Detects suspicious bulk archiving activity or file drops of archive formats in staging directories. The rule monitors for common archival utilities (7zip, WinRAR) or PowerShell's Compress-Archive command being used, or the creation of archive files in suspicious paths (e.g., Temp, AppData, Public). It alerts when high volumes of archives are created, password-protected archives are used, or rapid archival operations are performed.
Detects the execution of known archive utilities (e.g., 7-Zip, WinRAR) when interacting with sensitive user or system directories. This behavior is often indicative of data staging prior to potential exfiltration, especially when the originating process is not a recognized installer or backup application.
This rule detects potential data staging activities by monitoring for specific file paths and filenames associated with unauthorized collection of sensitive data (such as VPN configs, password databases, and office documents). It triggers when processes not typically associated with these file types access or interact with sensitive directories and file extensions.
Detects the creation of large archive files (.zip, .7z, .rar, .tar) exceeding 100MB within sensitive or high-risk directory paths such as Desktop, Temp, or AppData, or on non-system drives. This behavior is often associated with the staging of sensitive data for exfiltration.
This rule detects activities associated with the VILE ransomware, specifically the creation of file staging artifacts (vile_user_files.zip), execution of associated binaries, and network communication with Gofile.io infrastructure used for exfiltration.
Detects the use of 7-Zip (7z.exe or 7zip.exe) to archive files within common user directories (Desktop, Documents, Users, AppData). This activity is often associated with staging sensitive data prior to exfiltration.
Detects a sequence of events indicative of data exfiltration: an unknown process creates an image file in a temporary folder, followed by the creation of an archive file (ZIP/RAR) by the same or a related process within 10 minutes, and concludes with a successful outbound network connection to a non-private IP address from the same device.
This rule detects the outbound transmission of email attachments via SMTP (ports 25 and 587) that contain archived file formats (zip, 7z, tar.gz, tgz). Attackers often compress collected data into archives to facilitate exfiltration and minimize the time required for data transfer.
This rule detects the outbound transmission of email attachments via SMTP (ports 25 and 587) that contain archived file formats (zip, 7z, tar.gz, tgz). Attackers often compress collected data into archives to facilitate exfiltration and minimize the time required for data transfer.
Detects file creation events associated with the UAC-0226 campaign, specifically targeting Ukrainian military-themed lures and staging artifacts related to the GIFTEDCROOK malware. This rule monitors for the presence of specific file paths and naming conventions indicative of ongoing espionage operations.
Detects the use of common archive utilities (7-Zip, WinRAR) to perform file archiving operations within sensitive user-profile directories (Desktop, Documents, Downloads, etc.). This pattern is often used by adversaries to stage or bundle sensitive data prior to exfiltration.
Detects the execution of known archive utilities (e.g., 7-Zip, WinRAR) when interacting with sensitive user or system directories. This behavior is often indicative of data staging prior to potential exfiltration, especially when the originating process is not a recognized installer or backup application.
Detects the execution of common archival utilities (7zip, WinRAR) with command-line arguments specifying password protection. Attackers often use these utilities to compress and encrypt data prior to exfiltration to evade detection and prevent unauthorized access to sensitive files.
Detects the execution of command-line archiving utilities (7z, rar, tar) invoked by common scripting engines (PowerShell, CMD, Python, etc.) targeting typical staging directories (Temp, Public, AppData, ProgramData). This pattern is frequently observed during the data staging phase of an attack, where adversaries encrypt or compress gathered files for eventual exfiltration.
This rule detects a suspicious sequence of network connections indicative of information stealer activity, specifically targeting behaviors observed with malware like VVS Stealer. It identifies instances where a non-browser process, originating from common user-writable or temporary directories (AppData, Temp, Downloads, Users\Public), first connects to an external IP discovery service (ipify.org) and then subsequently communicates with Discord services (discord.com or discordapp.com) within a ten-minute window. This pattern suggests that malware is collecting the victim's public IP address before exfiltrating stolen data (e.g., account or browser information) to Discord infrastructure, often used as a command and control or data exfiltration channel by stealers.
Page 4 of 8