Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
640 detections
Filters
Last updated
All Time
Detection languages
302
82
80
57
53
Contributors
139
126
122
26
24
Categories
510
318
124
86
79
Platforms
309
155
127
112
91
Products / Services
164
119
84
80
76
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
8
2
1
1
1
IDS Classtypes
44
25
6
5
1
IDS Protocols
60
12
5
1
Detects network communication to specific Gusercontent endpoints consistent with malicious browser extensions exfiltrating captured session tokens or cookies. The rule monitors for POST requests containing parameters like leadId, email, and data, often used to transmit stolen authentication material.
Detects anomalous anti-forensic behavior where a Salesforce Bulk API query job is deleted shortly after its creation or completion. This sequence is often associated with efforts to obscure data exfiltration activities by removing the metadata trail of bulk data exports.
Detects anomalous Salesforce API export patterns where a user or connected application maintains a daily record export volume below typical burst thresholds, yet accumulates a high total volume over a rolling 7-day period. This pattern mimics 'low-and-slow' data exfiltration techniques used by actors like ShinyHunters to evade standard volume-based DLP alerts.
Detects anomalous, high-volume data access patterns within Salesforce, specifically monitoring for bulk API or SOQL query requests by a single user or application. This behavior is indicative of mass data exfiltration from a CRM instance, a tactic observed in extortion-themed campaigns such as those associated with the ShinyHunters group.
Detects high-volume database or CRM read activity performed by a user, followed by significant outbound network traffic to known public cloud storage, file-sharing, or messaging services. This pattern is consistent with data staging and exfiltration behaviors often attributed to the ShinyHunters threat actor group.
Detects high-volume data exports or bulk API queries against sensitive Salesforce CRM objects (Accounts, Contacts, Cases, Opportunities) performed by connected applications. This pattern is characteristic of exfiltration efforts where a newly authorized OAuth application is used to quickly extract large quantities of sensitive records.
Detects high-volume data exports or bulk API queries against sensitive Salesforce CRM objects (Accounts, Contacts, Cases, Opportunities) performed by connected applications. This pattern is characteristic of exfiltration efforts where a newly authorized OAuth application is used to quickly extract large quantities of sensitive records.
Detects an suspicious progression of activities originating from identified AI assistant/agent processes. The rule monitors for a chain of behaviors occurring within a 15-minute window: execution of an AI agent/tool, followed by host discovery (network/system enumeration), access to sensitive local credential files, archival of data, and outbound network communication to common file-sharing/exfiltration platforms.
Detects an suspicious progression of activities originating from identified AI assistant/agent processes. The rule monitors for a chain of behaviors occurring within a 15-minute window: execution of an AI agent/tool, followed by host discovery (network/system enumeration), access to sensitive local credential files, archival of data, and outbound network communication to common file-sharing/exfiltration platforms.
Detects instances where AI-based coding or agent-driven tools (e.g., Cursor, Claude Code, AutoGPT) perform suspicious file archiving/packaging activities followed by network egress to unauthorized or known exfiltration-prone services. This helps identify potential data exfiltration by AI agents or compromised development environments.
Detects HTTP POST requests containing potential credential exfiltration indicators, specifically targeting the '/google.php' endpoint with 'do=login&', 'user=', and 'pass=' parameters. This pattern is associated with FlowerStorm (Storm-1167) AiTM phishing kits.
Detects an AI agent session that performs a data exfiltration action (e.g., sending an email, webhook, or file share) to an unauthorized or non-allowlisted destination shortly after the agent has ingested potentially untrusted external content. This behavior is indicative of an AI agent being manipulated to exfiltrate data after processing malicious or adversarial inputs.
Detects instances where a single process on a device communicates with two or more distinct hosted LLM provider APIs (OpenAI, Anthropic, DeepSeek, Google) within a 24-hour window. This behavior is indicative of multi-model orchestration or 'consensus' techniques, which may be employed by sophisticated implants for automated tasking, data processing, or evasion.
Detects the execution of zsh with potentially suspicious command-line arguments (e.g., usage of curl, pipes, or osascript) occurring within a 15-minute window of network activity connecting to iCloud CalDAV servers. This behavior pattern may indicate unauthorized data access or exfiltration via legitimate cloud services.
Detects network connections to the Slack API (api.slack.com) initiated by processes executing from temporary directories commonly used by the Go build system ('go-build'). This pattern is indicative of a second-stage RAT or malicious payload compiled on-the-fly using 'go run' or similar mechanisms, utilizing Slack's infrastructure for C2 communication.
Detects exfiltration of sensitive information, including Dahua camera credentials and internal identifiers, to the Telegram Bot API over HTTPS. These rules monitor for specific API endpoints (/sendPhoto) and common credential patterns (Login:, Password:, Model:) or indicators (Shodan links, VKontakte references) within HTTP POST requests directed toward api.telegram.org.
Detects a non-browser process initiating network connections to four distinct commercial LLM API providers (DeepSeek, OpenRouter, Mistral, and Google Gemini) within a 5-minute interval. This behavior is indicative of a C2 pattern where an adversary uses multiple LLM backends to perform plurality-vote or redundant queries, bypassing typical browser-based AI aggregation services.
Detects a non-browser process initiating network connections to four distinct commercial LLM API providers (DeepSeek, OpenRouter, Mistral, and Google Gemini) within a 5-minute interval. This behavior is indicative of a C2 pattern where an adversary uses multiple LLM backends to perform plurality-vote or redundant queries, bypassing typical browser-based AI aggregation services.
Detects outbound HTTP/HTTPS POST requests where the URI, query string, or path contains evidence of sensitive credential material, such as AWS access keys, private key blocks, or common environment variable patterns, indicative of potential credential harvesting and exfiltration to an external destination.
This rule detects outgoing HTTP POST requests to discord.com API webhooks, specifically containing patterns characteristic of XWorm malware, such as exfiltrating machine information identified by Username and IP fields.
Detects network traffic from mobile devices to the Google Gemini API (generativelanguage.googleapis.com) specifically targeting the 'generateContent' endpoint. This behavior is indicative of mobile malware (e.g., RatHat/PromptSpy) that may be utilizing AI-assisted UI-automation, potentially to exfiltrate screen content or automate malicious interactions by processing visual layout data through a generative model.
Page 6 of 31