Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
Detects network traffic indicating the use of Slack APIs as a command and control (C2) channel or for exfiltration. The rules monitor for specific TLS SNI strings, hardcoded Slack bot tokens, and specific channel IDs associated with the 'indexed-btree' malware campaign, which utilizes Slack as a C2 platform.
Detects high-frequency access to mail items via specific client applications, or high-frequency file downloads/access within SharePoint and OneDrive. These patterns may indicate suspicious data collection or exfiltration attempts by a compromised account.
Detection of suspicious network traffic directed toward Slack APIs, characterized by the use of hardcoded Slack bot tokens and specific communication patterns associated with the 'indexed-btree' npm malware family, indicating potential C2 communication or data exfiltration.
Detects instances where AI coding assistants or tools (e.g., Claude, Copilot, Gemini) invoke git.exe to clone or fetch repositories from non-standard (non-GitHub) hosts, followed by a checkout operation within a short timeframe. This behavior may indicate an attacker using automated tools to stage or exfiltrate sensitive code repositories to unauthorized infrastructure.
This rule detects internal users submitting potentially sensitive data to public generative AI applications (e.g., ChatGPT, Claude, Gemini) where Microsoft Purview DLP or a comparable inspection service has triggered a policy match. It correlates cloud application outbound signals with content inspection logs to identify high-risk exfiltration events while excluding sanctioned enterprise-licensed AI instances.
Detects outbound HTTP requests to the Telegram Bot API associated with the malicious 'indexed-btree' npm package. The rule specifically monitors for hardcoded Telegram bot tokens and chat IDs used for data exfiltration.
Detects outbound network traffic attempting to exfiltrate data to Slack or Telegram APIs using hardcoded bot tokens or channel identifiers associated with the 'indexed-btree' malware campaign.
Detects instances where AI-based coding or agent-driven tools (e.g., Cursor, Claude Code, AutoGPT) perform suspicious file archiving/packaging activities followed by network egress to unauthorized or known exfiltration-prone services. This helps identify potential data exfiltration by AI agents or compromised development environments.
Detects instances where AI-based coding or agent-driven tools (e.g., Cursor, Claude Code, AutoGPT) perform suspicious file archiving/packaging activities followed by network egress to unauthorized or known exfiltration-prone services. This helps identify potential data exfiltration by AI agents or compromised development environments.
Detects repeated large HTTP PUT or POST requests (exceeding 5MB) from a internal host to external destinations. This pattern is indicative of potential bulk data exfiltration over web services.
Detects specific FTP commands (STOR, RETR, TYPE I) and passive mode responses directed to or originating from identified malicious IP addresses associated with the LucidRook threat actor. This rule monitors for potential file exfiltration, payload retrieval, and command-and-control communication over the FTP protocol.
Detects HTTP POST requests targeting the '/api/credentials' path on non-standard port 8133, which is indicative of AMOS (Atomic macOS Stealer) malware exfiltrating stolen credentials to a remote command and control server.
Detects multiple HTTP POST requests to a specific credential-related API path (/api/credentials) directed at an external IP address (95.163.153.80) on a non-standard port (8133). This pattern is indicative of potential automated credential exfiltration or brute-force activity.
Detects a pattern of frequent (6 or more per minute) small HTTP POST requests (up to 16KB) targeting specific sensitive API or internal URI paths. The detection logic also filters for traffic originating from a specific Microsoft Edge browser user agent string on Windows 64-bit systems, which may indicate automated data exfiltration, beaconing, or communication with a Command and Control (C2) server.
Detects HTTP POST requests to '/api/credentials' over a non-standard port (8133) typical of AMOS (Atomic macOS Stealer) command and control traffic. The rule specifically looks for established network connections originating from the local network and targeting external hosts, flagging multiple occurrences within a 30-second window.
Detects HTTP POST requests to '/api/credentials' over a non-standard port (8133) typical of AMOS (Atomic macOS Stealer) command and control traffic. The rule specifically looks for established network connections originating from the local network and targeting external hosts, flagging multiple occurrences within a 30-second window.
Detects activity associated with the Sauron Loader malware, specifically monitoring for the execution of rnpkeys.exe or loading of tdwp.dll, followed by a high volume of HTTPS POST requests to the same destination host, which is characteristic of chunked screenshot exfiltration.
Detects HTTP POST requests to '/api/credentials' which is indicative of the AMOS (Atomic macOS) Stealer malware exfiltrating stolen credentials. The rule uses a threshold to identify multiple exfiltration attempts from the same source within a short time window.
Detects HTTP POST requests to '/api/credentials' which is indicative of the AMOS (Atomic macOS) Stealer malware exfiltrating stolen credentials. The rule uses a threshold to identify multiple exfiltration attempts from the same source within a short time window.
This rule detects a correlation between host-level reconnaissance activity using WMI (via PowerShell or WMIC) to query system information, followed by network exfiltration to a known C2 IP address over a specific URI within a 10-minute window.
Detects anomalous, high-volume file access or preview activity in OneDrive or SharePoint from non-browser user agents. This pattern is indicative of potential data exfiltration where adversaries use scripted clients or APIs to mass-read or preview files, bypassing traditional download-based alerts.
Page 20 of 124