Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
Detects action of git clone or git push in a repo where the source actor is not coming from a Corp IP Space. (Add your IP Blocks as needed to the filter)
Detects execution of tools and artefacts reported in Unit 42 Muddled Libra operational playbook, including Chisel tunnelling, PsExec, ADExplorer, S3 Browser, and goon.zip staging.
This rule detects activity related to the DKnife gateway AitM (Adversary-in-the-Middle) threat, as detailed in Talos Intelligence reporting. It identifies specific binary names (dknife.bin, sslmm.bin, postapi.bin, rules.bin, sshapi.bin, inotify.bin, curlapi.bin) associated with the threat, either as process names or file names. Additionally, it looks for configuration artifacts (rules.conf, sslmm.cfg, url.cfg) used by the proxy/redirect logic, either as file names or within process command lines. Finally, the rule identifies exfiltration or tagging markers (dkimsi=, 460110672021628, PASSWORD) observed in logs or artifacts, which are indicative of DKnife's reporting mechanisms.
This rule detects potential DNS tunneling or data exfiltration by identifying high volumes of DNS queries with unusually long subdomains from a single process on a device. It aggregates DNS connection inspection events, extracts the subdomain length, and then summarizes the count of queries, unique domains, and average subdomain length within a 10-minute window. An alert is triggered if the query count exceeds 100 or if more than 50 unique domains are observed, combined with subdomain lengths greater than 30 characters.
Detects access to file sharing and exfiltration services reported in the Unit 42 Muddled Libra operational playbook, including S3 Browser and multiple upload services.
This rule detects suspicious processes (e.g., powershell.exe, cmd.exe, mshta.exe) making outbound network connections to public IP addresses on non-standard ports. This behavior can indicate command and control (C2) communication or data exfiltration attempts, as adversaries often use non-standard ports to evade detection.
Detects data exfiltration patterns used by HoneyMyte scripts. The rule monitors for rar.exe compressing files with a specific password or curl.exe uploading data to the Pixeldrain file-sharing service.
Detects network connections to the 10xprofit backend infrastructure. Connections to these domains indicate the presence of a malicious browser extension and potential exfiltration of scraped e-commerce data or tracking activity.
This rule detects a suspicious sequence of events: a file named 'host.exe' being created in the Windows Startup folder, a 'runtime.zip' file being created in the local temporary directory, and subsequent network communication to the Telegram API (api.telegram.org) from the same device. This pattern is indicative of malware establishing persistence, staging data, and exfiltrating it via Telegram, potentially associated with malware like Small Sieve.
Detects periodic network traffic (beaconing) from browser processes to external domains, which may indicate automated data exfiltration by a malicious extension like the ChatGPT Stealer. This threat is known to exfiltrate data at approximately 30-minute intervals.
This rule detects the presence of hardcoded tokens associated with the dYdX supply chain attack. These tokens were used for C2 authentication and as an API key for data exfiltration. The rule searches across process command lines, network URLs, network headers, and common security logs for these specific tokens.
This rule detects outbound network connections to known Command and Control (C2) and exfiltration domains associated with the SANDWORM_MODE campaign. These domains are used to exfiltrate stolen credentials and other sensitive data.
This rule detects network connections from common web browsers to known command and control (C2) domains associated with the ChatGPT Stealer campaign. These domains are used to exfiltrate stolen AI session tokens and conversation data.
Detects execution of curl.exe uploading data to temp.sh using custom user-agent parameters, consistent with publicly reported malicious Notepad++ updater activity.
Detects programmatic GitHub data exfiltration by identifying non-interactive repository exports, clones, artifact downloads, or gist staging performed using tokens, OAuth applications, or GitHub Apps. The detection focuses on bursty or multi-repository activity within a short time window, which can indicate automated source code collection, misuse of programmatic credentials, or post-compromise data extraction.
This rule detects network connections to malicious infrastructure associated with a supply chain attack targeting dYdX npm and PyPI packages. The infrastructure is used for credential exfiltration and as a C2 for a RAT.
Detects network requests to specific URI endpoints associated with the DOMOAuth2_ and IRAOAuth2.0 malicious NuGet packages. These packages exfiltrate ASP.NET Identity data to a local C2 proxy. The rule specifically looks for traffic to these URIs on localhost via port 7152.
This rule set detects various stages of the OysterLoader malware activity, including its registration and login attempts to a command and control (C2) server, specific C2 communication patterns via HTTP URIs, and connections to known OysterLoader C2 domains and IP addresses. The rules look for specific HTTP URI paths like "/reg" and "/login" combined with distinct User-Agent strings ("WordPressAgent" and "FingerPrint"), as well as specific API paths under "/api/" and hardcoded C2 domains and IP addresses.
This detection identifies network connections from non-browser processes to known Large Language Model (LLM) API endpoints. While some connections may be legitimate developer or application traffic, unexpected processes connecting to these services could indicate unauthorized data exfiltration, corporate espionage, or misuse of AI services.
This rule detects suspicious activity related to a malicious Notepad++ updater, specifically looking for command strings that indicate data exfiltration to 'temp.sh' using 'curl.exe'. It identifies the presence of 'temp.sh/upload', '--user-agent', 'temp.sh/', '/list', and 'curl.exe' within the analyzed content, suggesting an attempt to upload data or list contents to a temporary sharing service.
This rule set looks for signs linked to the Shadow Campaigns espionage group. It flags the use of their loader, checks for connections to known servers they have used, spots fake security software used as bait, and highlights suspicious activity coming from web server processes that may indicate a hidden backdoor.
Page 88 of 124