Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,115
15,636
12,582
8,393
6,221
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
This rule detects the use of PowerShell cmdlets to exfiltrate email addresses. Specifically, it looks for PowerShell processes executing commands that include 'Add-PSSnapin', 'Get-Recipient', '-ExpandProperty', 'EmailAddresses', 'SmtpAddress', and '-hidetableheaders'. This combination of cmdlets is indicative of an attempt to enumerate and extract email addresses from a system, likely for exfiltration purposes.
Detects the usage of the PowerShell `Set-Mailbox` cmdlet to configure an SMTP forwarding rule for a mailbox. This can be indicative of an adversary setting up automatic email forwarding to an external address for data exfiltration or continued access to communications.
Detects PowerShell script blocks attempting to exfiltrate data using ICMP by creating a System.Net.NetworkInformation.Ping object and sending data. This method allows adversaries to bypass traditional network controls by tunneling data over ICMP.
Detects the execution of "csvde.exe" with the '-f' flag, indicating an attempt to export the Active Directory structure. This tool is often used by adversaries for discovery and collection of domain account information.
Detects DNS queries for the domain "anonfiles.com", which is an anonymous file upload platform often used by adversaries for malicious purposes, including data exfiltration. This rule specifically looks for any DNS query containing '.anonfiles.com'.
Detects an executable initiating a network connection to "ngrok" tunneling domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Detects the use of the PowerShell `New-MailboxExportRequest` cmdlet to export a mailbox to a remote or local share, which has been observed in ProxyShell exploitation scenarios. This activity indicates an attempt to exfiltrate mailbox data.
Detects the execution of "ConfigSecurityPolicy.EXE" with command-line arguments containing URLs (ftp://, http://, https://). This Windows Defender binary can be abused by attackers to download or upload files, potentially leading to arbitrary file download or data exfiltration.
Detects the use of the PowerShell `New-MailboxExportRequest` cmdlet to export a mailbox to a remote or local share. This activity has been observed in ProxyShell exploitation scenarios, where attackers exfiltrate mailbox data. The rule specifically looks for the cmdlet name, the `-Mailbox` parameter, and the `-FilePath` parameter followed by a UNC path (indicating a share).
Detects the use of the built-in Windows utility 'query.exe' to extract information about active user sessions or running processes. This activity can be indicative of an attacker performing reconnaissance or staging data for exfiltration.
Detects suspicious output redirection to the local administrative share (ADMIN$). This technique is often used by malicious scripts or hack tools to stage or exfiltrate data by writing it to a location accessible via the network, specifically targeting the ADMIN$ share on localhost or 127.0.0.1.
This rule detects the execution of the Invoke-DNSExfiltrator PowerShell cmdlet, which is used for exfiltrating data over a DNS request covert channel. The detection specifically looks for the presence of the cmdlet name along with common parameters such as '-i', '-d', '-p', '-doh', and '-t', indicating an attempt to use the DNSExfiltrator tool.
This rule detects the execution of 'tapinstall.exe', which is used to install TAP (Tunnel Adapter) drivers. While legitimate for VPN software like OpenVPN, Avast SecureLine VPN, and ProtonVPN, its execution outside of these known contexts could indicate an adversary preparing for data exfiltration using tunneling techniques. TAP drivers create virtual network interfaces, which can be leveraged to establish covert communication channels or bypass network segmentation.
Detects the execution of WinRAR to compress files with '.dmp', '.dump', or '.hdmp' extensions. This activity could indicate a step in exfiltrating memory dump files or other sensitive dump files.
This rule detects potential data exfiltration attempts using PowerShell by identifying scripts that manipulate binary data into audio file formats, specifically WAV. It looks for PowerShell script block text containing mathematical operations, file I/O mode definitions, and the use of BinaryWriter, combined with specific byte sequences indicative of a WAV file header. This technique can be used to encode arbitrary data into an audio file for covert exfiltration.
Detects PowerShell scripts that read file content, iterate through it, and perform DNS host lookups, potentially for data exfiltration or reconnaissance. This combination of actions is suspicious as it suggests an attempt to process local data and resolve external network information.
Detects the execution of "ldifde.exe" to export Active Directory structure. This tool is often used by attackers to collect information about the domain for reconnaissance or exfiltration purposes. The rule specifically looks for the execution of ldifde.exe with the '-f' flag, which indicates an output file, while excluding the '-i' flag which is used for importing data.
An attempt to export an AWS EC2 instance has been detected. A VM Export might indicate an attempt to extract information from an instance.
Detects the modification of an EC2 snapshot's permissions to enable access from another account
Detection use of the command "split" to split files into parts and possible transfer.
Detects suspicious DNS queries using base64 encoding
Page 121 of 124