Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
Detects the use of rclone, a command-line program to manage files on cloud storage, by identifying its default user-agent string in proxy logs. This activity can indicate data exfiltration to cloud storage services.
This rule detects instances where the 'winlogon.exe' process initiates outbound network connections to public IP addresses. Winlogon.exe is a critical Windows component responsible for user logon/logoff and the secure attention sequence. Typically, winlogon.exe should not be making outbound network connections to public IPs. Such activity could indicate compromise, potentially by malware like BlackLotus, which has been observed to leverage winlogon.exe for malicious purposes, including command and control or data exfiltration.
Detects DNS queries to "ufile.io", which has been observed as a method for data exfiltration by malware and threat actors. This rule specifically looks for Event ID 3008 in the Microsoft-Windows-DNS Client Events/Operational log where the QueryName contains 'ufile.io'.
Detects 'svchost.exe' spawning 'rundll32.exe' with command arguments like 'C:\windows\system32\davclnt.dll,DavSetCookie'. This could be an indicator of exfiltration or use of WebDav to launch code (hosted on a WebDav server).
Detects when Microsoft Cloud App Security identifies a user or IP address using an unsanctioned application to perform activities resembling data exfiltration from the organization. This rule specifically triggers on 'Data exfiltration to unsanctioned apps' events with a 'success' status from the SecurityComplianceCenter event source.
This rule detects the execution of the 'split' command, which is commonly used to break large files into smaller, more manageable pieces. Adversaries may use this technique to circumvent data transfer size limits during exfiltration or to prepare data for transfer through channels with size restrictions. The detection focuses on the command line execution of the 'split' utility.
This rule detects suspicious Windows file path strings (e.g., 'C:/Users', 'C:/Windows', 'C:/Program Files') within the URI query component of web requests. The presence of such strings in a URI could indicate an attempt to exfiltrate data from a Windows system or communicate with a webshell that is attempting to access local files or directories. The rule looks for both standard and URL-encoded variations of these paths.
Detects the execution of copy commands or utilities (robocopy, xcopy, cmd copy, PowerShell Copy-Item/Move-Item) targeting or originating from Windows Admin shares (e.g., C$) or the Sysvol folder. This activity can indicate lateral movement, data collection, or exfiltration by an adversary.
This rule identifies activities related to Google Cloud Platform (GCP) Packet Mirroring. Packet Mirroring allows capturing full network traffic, which can be abused by adversaries to intercept and collect sensitive data from unencrypted internal network communications. The rule specifically looks for various API calls related to the creation, modification, deletion, or listing of Packet Mirroring configurations.
This rule detects DNS queries for subdomains associated with the MEGA cloud storage service, specifically 'userstorage.mega.co.nz'. Such queries can indicate attempts to exfiltrate data to MEGA, potentially using tools like Rclone, or legitimate usage of the service. The rule focuses on the DNS layer to identify communication with this cloud storage provider.
Detects DNS queries to "ufile.io", which has been observed as a method for data exfiltration by malware and threat actors. This service can be used to upload and share files, making it a convenient target for adversaries to move stolen data out of a compromised network.
Detects 'svchost.exe' spawning 'rundll32.exe' with command arguments indicating the use of 'davclnt.dll,DavSetCookie' and a remote IP address. This activity is suspicious as it can be an indicator of data exfiltration, execution of code hosted on a WebDAV server, or exploitation related to CVE-2023-23397, particularly for NTLM hash theft.
This rule detects various keywords associated with data transfer and staging activities on Cisco devices. These activities could indicate an adversary attempting to move data onto the device for further exfiltration or to move data off the device. The keywords include common protocols and commands like 'tftp', 'rcp', 'puts', 'copy', 'configure replace', and 'archive tar', which are often used for file transfers and configuration management on network devices.
Detects when Microsoft Cloud App Security reports suspicious email forwarding rules, such as a user creating an inbox rule to forward copies of all emails to an external address. This activity can indicate an attempt to exfiltrate sensitive information.
Detects DNS queries for 'anonfiles.com', which is an anonymous file upload platform frequently used for malicious purposes, including data exfiltration by malware such as BlackByte ransomware. This rule specifically looks for Event ID 3008 from the Microsoft-Windows-DNS Client Operational log, indicating a DNS query for a domain containing '.anonfiles.com'.
This rule detects the installation of a TAP (Tunnel Adapter) driver, specifically looking for 'tap0901' in the service's ImagePath. TAP drivers are commonly used by VPN software like OpenVPN to create virtual network interfaces, which can be leveraged for tunneling and data exfiltration. The detection aims to identify potential preparation for data exfiltration using tunneling techniques.
Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. This rule detects suspicious outbound SMTP connections by looking for connections to common SMTP ports (25, 587, 465, 2525) from processes that are not common mail client applications like Thunderbird or Outlook, or Microsoft Exchange Server processes.
Detects the execution of a Chromium-based browser process with the "--headless" flag and a URL pointing to mockbin.org or run.mocky.io. This activity can indicate an attempt to exfiltrate data or use the browser in an automated, potentially malicious, fashion without a visible user interface.
This rule detects HTTP PUT requests where the User-Agent header contains 'WebDAV' and the destination IP address is not a private or loopback address. This activity could indicate an attempt to exfiltrate data to an external WebDAV share.
Detects the creation of Rclone configuration files, which are typically stored in a specific user directory path. Rclone is a command-line program used for syncing files with various cloud storage services and is often leveraged by adversaries for data exfiltration.
This rule detects the use of DataSvcUtil.exe, a legitimate Microsoft utility, with command-line arguments indicative of data exfiltration. Specifically, it looks for the presence of '/in:', '/out:', and '/uri:' parameters in the command line, combined with the execution of 'DataSvcUtil.exe'. This behavior is often associated with Living Off The Land Binaries (LOLBAS) techniques where adversaries leverage legitimate system tools for malicious purposes, in this case, to exfiltrate data.
Page 120 of 124