Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,115
15,636
12,582
8,393
6,221
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
Detects potential insider threats or departing employees by correlating abnormal bulk data downloads from cloud repositories (SharePoint/OneDrive/Box/etc.) with subsequent sensitive data access and exfiltration signals. It uses baseline behavioral profiling, requires a threshold of sensitive file interactions, and mandates high-confidence exfiltration indicators (removable media usage, suspicious external domains, or multiple combined destination events) to reduce noise. Archive/staging activity is used as an optional confidence booster.
Detects potential insider threats or departing employees by correlating abnormal bulk data downloads from cloud repositories (SharePoint/OneDrive/Box/etc.) with subsequent sensitive data access and exfiltration signals. It uses baseline behavioral profiling, requires a threshold of sensitive file interactions, and mandates high-confidence exfiltration indicators (removable media usage, suspicious external domains, or multiple combined destination events) to reduce noise. Archive/staging activity is used as an optional confidence booster.
This rule performs a retrospective hunt for indicators of compromise (IOCs) associated with the ClosedQuorum malware. It identifies suspicious activity by matching against known file hashes, specific filenames, and network traffic directed towards services (such as DeepSeek, OpenRouter, Mistral, and Discord) which the malware uses for C2 or data exfiltration. The detection logic aggregates results from file system, process, and network telemetry.
Detects the 'Credential Guard.exe' process (associated with AgtaBackup RAT) accessing sensitive browser files (Login Data, Cookies, History, Bookmarks) and subsequently exfiltrating data to a specific C2 endpoint.
Detects high-volume network activity from a single device/process to public IP addresses over common ports (80, 443) or UDP protocol. This behavior is indicative of potential command and control communication, automated data exfiltration, or a scanning attempt.
Detects HTTP POST requests directed to the URI path '/api/credentials' over the non-standard TCP port 8133, which is indicative of AMOS (Atomic macOS) Stealer exfiltrating stolen credentials to a C2 server.
Detects the use of legitimate data-transfer utilities (rclone, MEGA client, restic, WinSCP) configured to exfiltrate data to cloud storage providers. This behavior is identified as a precursor to double-extortion ransomware attacks, where attackers steal sensitive data before encrypting it.
Detects unauthorized data staging activities using archival utilities followed by data exfiltration to known public cloud storage providers. The rule specifically excludes hosts experiencing mass file renaming activity, focusing on extortion-only scenarios where data is stolen without encryption.
Detects network activity associated with the RatHat Android malware, specifically identifying C2 data exfiltration API calls over FRP (FRP/Go Agent) tunnels and WebSocket handshake traffic for command-and-control communication.
Detects a multi-stage, automated attack chain performed by AI-based development agents (e.g., Claude, Copilot, Cursor). The rule correlates process discovery, credential access, file collection (staging), and exfiltration over web services within a tight 15-minute window, identifying potential autonomous exploitation and data exfiltration. Covered T1046, T1552.001, T1078, T1005, T1567
Detects network traffic indicative of VelvetCake malware exfiltrating data. The rule specifically monitors for HTTP POST requests to 'logout.php' containing 'OKey' and 'Who' parameters, using a user agent string that includes 'WebClient', which is often associated with PowerShell-based network requests.
Detects instances where a non-browser process initiates network connections to multiple AI service providers and Discord within a 15-minute correlation window, potentially indicating automated data exfiltration or unauthorized interaction with AI platforms using tools other than standard web browsers.
Detects two-stage network activity associated with Adversary-in-the-Middle (AiTM) phishing kits. The first part detects the submission of stolen credentials or session data to a local WebDAV panel (xwps.php), and the second part detects the subsequent exfiltration of that captured data to the Telegram Bot API.
This rule monitors for high-frequency download or access events of files associated with AI development, such as model weights (.pt, .ckpt, .safetensors, .h5, .onnx, .pkl, .pb), checkpoints, and research datasets from cloud storage. It triggers when an account accesses or downloads 20 or more unique AI-related files within a 60-minute window, which is indicative of unauthorized data exfiltration of intellectual property.
This rule detects HTTP POST requests from mobile user agents (Android, Dalvik, okhttp) that contain keywords indicative of contactless payment card data exfiltration, specifically looking for fields such as 'track2', 'pan', 'atc', and 'cryptogram'. This behavior is consistent with malicious mobile applications attempting to transmit skimmed NFC credit card data to an external server.
Detects outbound HTTP PUT requests characteristic of data exfiltration associated with Qilin ransomware. The rule monitors for the use of command-line tools like s5cmd or rclone for uploading data, often used during the double extortion phase where stolen data is uploaded to leak sites.
Detects HTTP PUT/POST requests targeting external domains with URI patterns and filename structures characteristic of TheGentlemen ransomware group's data exfiltration activities. The rule monitors for large HTTP request payloads (>50KB) and suspicious TLS subject fields (e.g., presence of CN without an O field) associated with potential C2 communication.
Detects high-risk destructive database operations (DROP, TRUNCATE, or UPDATE) on sensitive tables executed within six hours of a large outbound data transfer from the same host, a pattern indicative of anti-forensic database wiping following data exfiltration.
Detects instances where the rnpkeys.exe process initiates a network connection shortly after its execution. The RNP (OpenPGP) utility is generally used for local cryptographic operations; unexpected network activity from this process may indicate potential misuse, data exfiltration, or malicious use of the tool for command-and-control communication.
This rule detects potentially malicious C2 communication by monitoring high-frequency HTTP POST requests from the 'rnpkeys.exe' process. It aggregates network events over 30-second windows and flags activity exceeding a threshold of 5 POST requests directed at known suspicious domains or specific high-port network destinations, which is characteristic of beaconing or data exfiltration activity.
Detects suspicious processes frequently polling Hugging Face repository endpoints (discussions, raw files, commits). This behavior is characteristic of adversaries using public code/dataset hosting services as a covert command-and-control (C2) channel to fetch instructions or exfiltrate data, bypassing traditional network filters by blending in with legitimate developer traffic.
Page 10 of 124