Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
640 detections
Filters
Last updated
All Time
Detection languages
302
82
80
57
53
Contributors
139
126
122
26
24
Categories
510
318
124
86
79
Platforms
309
155
127
112
91
Products / Services
164
119
84
80
76
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
8
2
1
1
1
IDS Classtypes
44
25
6
5
1
IDS Protocols
60
12
5
1
Detects outbound HTTP POST requests containing the word 'secret' in the request body directed to the external service 'webhook.site', which is often used by adversaries for quick data exfiltration or testing during post-exploitation activities.
Detects network connections to Zoho WorkDrive (workdrive.zoho.com) initiated by processes other than standard web browsers. This activity may indicate the use of unauthorized or automated tools to access cloud storage, potentially for data exfiltration or staging.
This rule monitors outbound HTTP POST requests and flags URLs that contain strings indicative of sensitive personal identifiable information (PII) such as national IDs, passports, or financial data including credit cards and bank account details. This is often an indicator of potential data exfiltration where sensitive information is being transmitted via URL parameters.
Detects outbound web requests to OpenAI, Anthropic, or Google Gemini API endpoints that contain suspected API keys (OpenAI 'sk-proj-', Anthropic 'sk-ant-', or Google 'AIza' prefixes) in the request stream, potentially indicating hardcoded credentials, malicious script activity, or data exfiltration.
Detects network communication with the Telegram API (api.telegram.org) originating from processes located in suspicious, user-writable directories such as Downloads, Temp, or AppData. This behavior is indicative of potential command and control (C2) communication or data exfiltration via the Telegram Bot API by malware.
Detects potential data exfiltration (CVE-2026-42824) where an attacker leverages an SSRF vulnerability in Bing's search-by-image functionality to relay sensitive M365 Copilot data. The rule identifies outbound network requests to the image search endpoint containing a suspicious 'imgurl' parameter pointing to non-Microsoft infrastructure, initiated by common web browser processes.
This rule detects attempts to exploit Microsoft 365 Copilot through prompt injection, where attackers inject HTML/script elements into search queries. It specifically identifies when these queries attempt to force Copilot to interact with external URLs via Bing image search (SSRF), potentially exfiltrating sensitive data such as MFA codes, email content, or meeting details to an attacker-controlled external domain.
This rule detects network connections or DNS queries originating from common web browsers (chrome.exe, msedge.exe, chromium.exe) towards domains related to Perplexity AI. Such activity may indicate data exfiltration or the use of AI tools for processing sensitive organizational data via browser-based interfaces.
Detects outbound network communication to an IP address (64.20.53.230) identified as a staging server associated with the JadePuffer activity. This activity involves potential data exfiltration following self-narrated deletion payloads.
Detects high-volume data access or exfiltration from Azure/Office 365 cloud environments via common scripting/automation user-agents. The rule monitors API requests to users, mail, drive, or files endpoints by non-standard clients (e.g., python, curl, Go) from previously unseen locations, calculating a risk score based on the number of endpoints accessed and the total data volume.
Detects potential data exfiltration activity to the file sharing service 'easyupload.io' by monitoring DNS queries, HTTP POST requests, and general network connections to the domain.
Detects high-volume outbound network connections (exceeding 10MB) originating from processes associated with AI-driven chatbot or productivity applications (e.g., ChatGPT, Perplexity). This rule identifies potential data exfiltration occurring over legitimate, expected software channels.
This rule detects potential data exfiltration by monitoring for the creation of zip archives followed by an network connection to Telegram's API by the same device within a 10-minute window. This behavior often indicates that a user or an attacker is staging data in an archive and subsequently uploading it to a cloud file-sharing service.
Detects anomalous outbound network traffic from Firefox processes indicative of CVE-2025-15661 exploitation. The rule monitors for communication with a specific non-standard port (8765) associated with a SmartWindow PoC server, or requests containing suspicious URI query parameters ('u0', 'u1', 'u2', 'source=history') frequently used for exfiltrating private browsing tabs and history via the '/leak' endpoint.
Detects activity associated with the RoguePlanet exploit, which involves creating EICAR content and NTFS Alternate Data Streams (ADS) within specific staging directories (wdtest_temp or RP_<UUID>). This behavior is intended to trigger Windows Defender scans and induce a TOCTOU race condition (CVE-2026-50656) by manipulating file operations near the wermgr.exe process.
Detects network communication to the Telegram Bot API (api.telegram.org) initiated by processes other than standard web browsers. This behavior is indicative of malicious activity such as automated data exfiltration, C2 communication, or victim status reporting, as observed in ransomware campaigns like BQTLock.
Detects evidence of SearchLeak (CVE-2026-42824), a post-exploitation technique where M365 Copilot prompt injection causes a browser to perform a Bing 'searchbyimage' request. The 'imgurl' parameter points to an attacker-controlled server, with the URL path containing exfiltrated mailbox data (e.g., MFA codes, email content) encoded as underscore-delimited segments. The Bing service performs an SSRF, fetching the image from the attacker's server and thereby delivering the data while bypassing local client-side security controls like CSP.
Detects the SearchLeak (CVE-2026-42824) attack chain targeting M365 Copilot. The rule monitors for a three-stage sequence within 1 minute: (1) A user accessing a crafted Enterprise Search URL with an injected prompt in the query string; (2) Evidence of bulk data access (MailItemsAccessed or FileAccessed, 5+ events); and (3) An outbound HTTP request to a Bing image search endpoint containing exfiltrated data encoded within a long (>500 chars) 'imgurl' parameter, indicating a potential SSRF/CSP bypass exfiltration path.
This rule detects processes making three or more successful outbound network connections within an hour to known code or text sharing sites like Pastebin, GitHub, or Gist. This activity can be indicative of data exfiltration, command and control (C2) communication, or staging of malicious code.
This rule detects indicators of activity associated with a Firefox smart_window PoC, specifically designed to exfiltrate private browsing URLs. It monitors for suspicious network connections from the Firefox process to port 8765, the creation of PoC-related scripts, and the execution of associated Node.js processes or command lines.
Detects network communication behavior indicative of Yuta or Glove Stealer malware, where suspicious processes (specifically 'winupdate.exe' in common staging directories or Python-based requests) exfiltrate data via HTTP POST requests to known attacker-controlled infrastructure platforms like Discord or Telegram.
Page 17 of 31