Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
155 detections
Filters
Last updated
All Time
Detection languages
62
29
14
11
11
Contributors
44
29
13
10
9
Categories
82
75
74
44
38
Platforms
132
22
18
6
1
Products / Services
49
37
12
8
7
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
1
1
1
IDS Classtypes
3
2
2
IDS Protocols
3
2
1
1
Detects the use of PowerShell to archive files (using Compress-Archive) followed by an HTTP network connection to a suspicious external IP address (91.196.32.232) within a short time window. This sequence is often indicative of data staging followed by exfiltration.
Detects evidence of Argamal RAT activity involving screenshot capture using .NET Graphics.CopyFromScreen methods written to a specific temporary file (~wra1269.tmp). The rule monitors both PowerShell execution patterns and file creation events associated with this specific artifact.
Detects macOS.Gaslight malware activity through two branches: direct hash matches of known binaries and the spawning of Python subprocesses with specific command-line arguments indicative of data collection or archiving. The Python subprocess detection looks for Python scripts being executed from '/tmp/' or '/Library/' directories with arguments related to browser data collection, keychain access, or archiving operations.
Detects the execution of the WinRAR archival utility ('rar.exe') using specific command-line flags associated with creating password-protected or encrypted archives. This behavior is often indicative of data staging and collection for exfiltration purposes.
Detects a game-related process creating ZIP, 7z, or encrypted data containers in an inconspicuous AppData subdirectory. This behavior is indicative of data staging prior to exfiltration, often seen in supply chain attacks or targeted espionage.
Detects the use of 7-Zip (7z.exe or 7zip.exe) to archive files within common user directories (Desktop, Documents, Users, AppData). This activity is often associated with staging sensitive data prior to exfiltration.
Detects the execution of PowerShell with the Compress-Archive cmdlet where the process originates from user-writable directories (AppData\Local or AppData\Roaming). This behavior is often associated with the staging of data for exfiltration or the compression of unauthorized tools or logs in a user context.
Detects the execution of command-line archiving utilities (7z, rar, tar) invoked by common scripting engines (PowerShell, CMD, Python, etc.) targeting typical staging directories (Temp, Public, AppData, ProgramData). This pattern is frequently observed during the data staging phase of an attack, where adversaries encrypt or compress gathered files for eventual exfiltration.
This rule detects suspicious activity involving a high volume of file compression using common archiving tools like 7-Zip and WinRAR. Adversaries often compress data before exfiltration or for staging purposes to reduce size and potentially evade detection. A high count of compression events within a short timeframe (1 hour) by a single account could indicate malicious activity.
Detects the execution of rar.exe with command line arguments indicating the creation of a new archive (-a) and the use of the -k switch. The -k switch in RAR is often used to lock an archive, preventing further modifications, which is a technique sometimes used by adversaries to preserve staged data for exfiltration.
Detects the use of WinRAR (rar.exe) to archive files using command-line arguments indicative of data staging or exfiltration (such as continuous archiving or specific extraction flags). The rule focuses on executions originating from suspicious parent processes like web servers (w3wp.exe) or command shells, or occurring within sensitive directories such as backup locations or VMware application folders.
Detects a non-browser process creating copies of at least three Chromium credential or browsing databases in a temporary, roaming, public, or program-data directory. The logic requires the reported SessionGate, Remus, or AnimateClipper structure rather than a standalone executable name.
Detects the use of archive utilities (tar, zip, 7z, gzip, zstd) to bundle sensitive PeopleSoft configuration and application directories (e.g., ps_config_homes, psoft/psft). This behavior is consistent with data staging for exfiltration, frequently associated with the ShinyHunters threat group activity targeting exposed PeopleSoft environments.
Detects the use of the zstd compression utility on PeopleSoft application servers by privileged service accounts such as psoft, oracle, or linuxadm. This behavior is indicative of data staging or archiving activity consistent with ShinyHunters pre-exfiltration tactics.
Detects Python creating an archive containing browser, wallet, developer, cloud, and authentication data from multiple collection roots. This activity is associated with the InvisibleFerret malware.
Detects PowerShell compressing stolen data prior to POST exfiltration. This rule specifically looks for the execution of 'powershell.exe' or 'pwsh.exe' with command-line arguments that include 'Compress-Archive', 'Invoke-WebRequest', and '-Method POST'. This combination indicates an attempt to compress data and then exfiltrate it via an HTTP POST request.
Detects an unsigned game-related process creating an archive and initiating cloud-storage network activity without an interactive cloud client. This rule specifically looks for network events where the process name contains 'bird', 'rok', 'game', 'update', 'python', or 'ruby' (case-insensitive) and the command line includes terms like 'zip', 'archive', 'upload', 'multipart', 'cloud', 'dropbox', or 'pcloud'.
Detects a non-Firefox process creating staged copies of at least three NSS, login, cookie, history, or preference files from Firefox-style profiles. The logic requires the reported SessionGate, Remus, or AnimateClipper structure rather than a standalone executable name.
This rule detects the use of the 'ditto' command-line utility on macOS for data staging and compression, specifically looking for executions that use compression flags (-c, -k) and target the /tmp/ directory. This behavior is indicative of information stealer malware like Amos Stealer, which may compress collected data before exfiltration.
Detects the archiving (tar or zip) of .git directories. This activity can indicate an adversary attempting to exfiltrate full source code history and internal intellectual property.
Detects an untrusted process creating WAV or compressed audio files in a temporary path after loading multimedia capture components. This behavior is indicative of potential audio surveillance or data collection.
Page 5 of 8