Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,115
15,636
12,582
8,393
6,221
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
Detects "svchost.exe" spawning "rundll32.exe" with command arguments like C:\windows\system32\davclnt.dll,DavSetCookie. This could be an indicator of exfiltration or use of WebDav to launch code (hosted on WebDav Server) or potentially a sign of exploitation of CVE-2023-23397
Detects when a user tampers with S3 data management in Amazon Web Services.
Detects when a Microsoft Cloud App Security reported when a user or IP address uses an app that is not sanctioned to perform an activity that resembles an attempt to exfiltrate information from your organization.
Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors
WebDav Put Request
Sigma
A General detection for WebDav user-agent being used to PUT files on a WebDav network share. This could be an indicator of exfiltration.
Detects suspicious Windows strings in URI which could indicate possible exfiltration or webshell communication
Detects DNS queries for subdomains related to MEGA sharing website
Detects the installation of a well-known TAP driver service. This could be a sign of potential preparation for data exfiltration using tunnelling techniques.
Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration
Detects an executable initiating a network connection to "ngrok" tunneling domains.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.
The data may also be sent to an alternate network location from the main command and control server.
The data may also be sent to an alternate network location from the main command and control server.
Detects PowerShell scripts that have capabilities to read files, loop through them and resolve DNS host entries.
Detects the execution of "ConfigSecurityPolicy.EXE", a binary part of Windows Defender used to manage settings in Windows Defender.
Users can configure different pilot collections for each of the co-management workloads.
It can be abused by attackers in order to upload or download files.
Users can configure different pilot collections for each of the co-management workloads.
It can be abused by attackers in order to upload or download files.
Detects the execution of "csvde.exe" in order to export organizational Active Directory structure.
Well-known TAP software installation. Possible preparation for data exfiltration using tunneling techniques
Detects the change of database master password. It may be a part of data exfiltration.
Detects the recovery of a new public database instance from a snapshot. It may be a part of data exfiltration.
Detects when a Microsoft Cloud App Security reported suspicious email forwarding rules, for example, if a user created an inbox rule that forwards a copy of all emails to an external address.
Detects when a Microsoft Cloud App Security reported when an app downloads multiple files from Microsoft SharePoint or Microsoft OneDrive in a manner that is unusual for the user.
Detects DNS queries for anonfiles.com, which is an anonymous file upload platform often used for malicious purposes
Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration
Page 122 of 124