Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
This rule detects the presence and activity of the ShadyPanda malware campaign, specifically focusing on malicious Chrome extensions and their associated command and control (C2) and data exfiltration domains. It identifies the creation of files with known malicious Chrome extension IDs (ending in '.crx') and network connections to hardcoded C2 and exfiltration domains linked to the ShadyPanda campaign.
This rule detects command and control (C2) beaconing activity associated with the SHADOW-VOID-042 malware family. Specifically, it looks for HTTP POST requests containing the string "get_module_hello" in the request body, which is indicative of a C2 communication pattern used by this malware.
This rule detects the presence and activity of the ShadyPanda malware campaign, specifically focusing on malicious Chrome extensions and their associated command and control (C2) and data exfiltration domains. It identifies the creation of files with known malicious Chrome extension IDs (ending in '.crx') and network connections to hardcoded C2 and exfiltration domains linked to the ShadyPanda campaign.
Detects network connections to a specific webhook.site URL known to be used by the Shai-Hulud worm for data exfiltration. The rule specifically looks for the URI path 'bb8ca5f6-4175-45d2-b042-fc9ebb8170b7' on webhook.site, which is a strong indicator of this particular threat.
Detects the presence of malicious Google Chrome extension IDs associated with the ShadyPanda campaign. These extensions can act as a backdoor, enabling remote code execution and data exfiltration.
Detects creation of branches and files matching indicators used by Shai-Hulud 2.0 for exfiltration
Detects GitHub Actions activity matching indicators used by Shai-Hulud 2.0 for exfiltration and persistence
This detection rule identifies hosts where data archiving using 7-Zip is closely followed by network traffic to the temp.sh file-sharing service. This correlation suggests a potential data staging and exfiltration sequence, a TTP observed in the Lynx Ransomware campaign.
This rule detects the creation of a public GitHub repository with the specific description "Sha1-Hulud: The Second Coming". This is an indicator of compromise (IOC) associated with the Shai-Hulud 2.0 worm, which uses these repositories to exfiltrate stolen credentials.
This search detects the creation of a public GitHub repository with the description "Sha1-Hulud: The Second Coming". This is a specific indicator of compromise (IOC) associated with the Shai-Hulud 2.0 worm, which uses these repositories to exfiltrate stolen credentials.
Detection use of the command "split" to split files into parts and possible transfer.
This search detects network connections to a specific webhook.site URL known to be used by the Shai-Hulud 2.0 worm for data exfiltration.
Detects attempts to post the file with the usage of wget utility.
The adversary can bypass the permission restriction with the misconfigured sudo permission for wget utility which could allow them to read files like /etc/shadow.
The adversary can bypass the permission restriction with the misconfigured sudo permission for wget utility which could allow them to read files like /etc/shadow.
Detects HTTP/HTTPS POST requests to known Lumma Stealer C2 domain
Data Compressed
Sigma
An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
Detects activity associated with the Hannibal Stealer, a .NET info-stealer known for targeting cryptocurrency wallets, VPN configurations, and browser data.
This rule identifies emails sent from an internal employee email address to external personal email domains where the recipient's local part of the email address contains tokens from the sender's display name for more than 0 words matching. It also analyses attachments for sensitive keywords (e.g., 'confidential', 'secret') and assigns a risk score based on factors like email volume, attachment count, and presence of sensitive attachments. This could indicate an attempt to exfiltrate sensitive company data to a personal account.
It matches first name and last name keywords within the Recipient's email address, including prefixes, suffixes, or in-between parts. Therefore, the false positive rate for this query is lower.
It matches first name and last name keywords within the Recipient's email address, including prefixes, suffixes, or in-between parts. Therefore, the false positive rate for this query is lower.
This rule detects outbound TLS connections to known temporary file sharing services, which can be indicative of data exfiltration. The rule inspects the Server Name Indication (SNI) field in TLS traffic for specific domain names associated with these services.
Detects the collection and staging of sensitive user data, such as credentials from keychains, browser profiles, and cryptocurrency wallets, by compressing them into an archive. This behavior is a key component of the DigitStealer infostealer's data theft process.
When, for example, a printer, camera, IoT appliance, or other device suddenly makes outbound connections to countries such as China, Russia, or Iran, this may not be noise. The following detection helps identify connections from these specific device groups that we were not previously aware of and that could be exfiltrating information.
Detects large HTTP responses for URLs containing keywords associated with F5 BIG-IP configuration or archive files. This could indicate an attacker exfiltrating sensitive system configurations.
Page 92 of 124