Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
Detects the execution of the native Windows tar.exe utility with flags that redirect the output to standard output (stdout) instead of a file. This behavior can indicate data being staged for exfiltration or piped to another tool for in-memory execution, bypassing file-based detections.
This rule detects when a system configuration file is downloaded from a FortiGate device within 60 seconds of a successful SSO login from the same user and source IP. This rapid sequence of events is indicative of automated scripts used by attackers to exfiltrate device configurations immediately after gaining initial access.
Detects processes, other than legitimate web browsers or the official Telegram client, making DNS queries for the Telegram Bot API. This behavior is indicative of malware using Telegram for command-and-control (C2) or data exfiltration, as seen in a campaign leveraging Amnesia RAT.
This rule detects potential network beaconing activity by analyzing network connection events. It identifies repetitive outbound connections from a device to a remote IP and port with a consistent time interval (low jitter). The rule filters out known legitimate processes and domains to reduce false positives. It calculates the average time delta between connections, standard deviation, and interquartile range to identify beacon-like patterns. The rule also considers the number of unique devices connecting to the same remote endpoint to identify potentially compromised infrastructure.
Detects network traffic to web services associated with the ggwave project, such as 'ggwave.ggerganov.com'. These services can generate audio payloads from text, which could be used for covert data exfiltration over an acoustic channel, bypassing traditional network monitoring for the data content itself.
This rule detects successful 'GetObject' operations on AWS S3 buckets originating from external IP addresses (not within common private IP ranges). This could indicate an attempt to exfiltrate data from S3 buckets by an unauthorized entity or compromised credential.
Detects large volumes of outbound data transfers using the Cyberduck application to known cloud storage providers. The Qilin ransomware group has been observed using Cyberduck for data exfiltration.
Detects the use of a renamed Rclone binary to exfiltrate data via FTP. This technique was observed in a Lunar Spider intrusion where the actor used 'sihosts.exe' (a renamed rclone.exe) to copy files to an actor-controlled FTP server.
This rule detects network connections and DNS queries to command-and-control (C2) domains associated with malicious Chrome extensions. These extensions are known to steal sensitive data such as ChatGPT and DeepSeek conversations, as well as other browsing data. The rule specifically targets known malicious domains to identify C2 communication and potential data exfiltration.
Detects data exfiltration activity by Turla's Kazuar v3 loader. After performing system reconnaissance, the VBScript loader sends collected information to the C2 server via HTTP POST requests. The exfiltration process collects system information including OS version, boot time, processor architecture, computer name, username, domain, running processes, and file listings, formats the data as plain text, and sends it via HTTP POST to the requestor.php endpoint on the C2 server. The loader uses WinHttp.WinHttpRequest.5.1 with SSL certificate validation disabled and sets User-Agent to "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E)" to appear as legitimate browser traffic. The requestor.php endpoint is a specific indicator of Kazuar v3 C2 communication. This rule detects POST requests to this endpoint targeting any internet-routable IPv4 address, as Turla may use different C2 servers across campaigns. The combination of the specific endpoint name and POST method is a strong indicator of Kazuar v3 data exfiltration.
vvs-stealer
KQL
This rule detects activities associated with the VVS Stealer malware, as described in the Palo Alto Networks Unit 42 blog. It identifies the malware through specific SHA256 hashes of known VVS Stealer executables, network connections to hardcoded Discord webhook URLs used for exfiltration, persistence mechanisms via creation of executables in Windows startup folders, creation of '_vault.zip' files (likely containing stolen data), and suspicious Discord-related process activity indicative of the stealer's operation.
Detects RAT command structure
This rule detects network connections to the Telegram API endpoint (api.telegram.org) from processes other than common web browsers like Chrome or Edge. This activity could indicate the use of Telegram for command and control, data exfiltration, or other malicious purposes by malware or threat actors.
Mythic C2 over SMB Detection
Cortex XDR
This rule detects potential Mythic C2 activity communicating over SMB. It identifies network traffic using the SMB protocol with a total upload size greater than 360 bytes, originating from and destined for private IP address ranges. The rule then groups these connections by agent hostname, local IP, remote IP, and process image name, flagging instances where three or more such connections occur within a 7-day timeframe, indicating potential beaconing behavior.
Detects outbound network connections to a known PCPcat C2 server IP address on specific ports used for API communication, reverse tunneling, and payload distribution. This rule identifies potential command and control activity and data exfiltration attempts by monitoring network traffic to a hardcoded malicious IP and associated non-standard ports.
Detects the DriverFixer0428 macOS credential stealer, attributed to the North Korean 'Contagious Interview' campaign. This rule identifies the malware based on unique internal strings, network IOCs related to Dropbox exfiltration, and social engineering text.
Detects a successful SSO administrative login followed by a system configuration download from the same user and source IP address within 5 minutes. This sequence is a strong indicator of compromise related to CVE-2025-59718 and CVE-2025-59719.
This rule detects PowerShell processes that are initiated by a LOLBAS binary and subsequently establish an outbound network connection to a public IP address. It leverages an external LOLBAS JSON data source to identify suspicious parent processes. This behavior could indicate an adversary using a Living Off The Land Binary or Script (LOLBAS) to execute PowerShell for malicious purposes, such as command and control or data exfiltration.
This rule detects applications, other than common web browsers, that are making network connections to Google Analytics domains and also contain 'microsoft' in the remote URL. This could indicate an application collecting device information or other telemetry and exfiltrating it via Google Analytics, potentially for malicious purposes or unauthorized data collection.
Detects outbound network connections from common web server processes to the Telegram API domain (api.telegram.org). This behavior is indicative of the BlackForce phishing kit exfiltrating stolen credentials, as newer versions use a server-side component to relay data to a Telegram channel.
Detects network connections to Discord webhook URLs from non-standard processes. This technique is often used by malware, such as Phantom Stealer, to exfiltrate stolen data.
Page 91 of 124