Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
The analytic detects the execution of the 'gdrive' tool on a Linux host. This tool allows standard users to perform tasks associated with Google Drive via the command line, such as downloading, uploading, listing, updating, syncing, sharing, and managing accounts or files. Adversaries can use this tool to stage other tools or exfiltrate data. The detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. If confirmed malicious, this activity could lead to system compromise or sensitive data theft.
This rule detects suspicious activity where scripting interpreters (node.exe, python.exe, pwsh.exe, powershell.exe) are observed accessing a large number of potentially sensitive files (e.g., .env, secret, wallet, keypair, credential, recovery files, or common document/data file types like .pdf, .docx, .csv, .json, .txt) and subsequently exfiltrating a significant amount of data over the network. It correlates file access events with network outbound traffic from the same process within a 10-minute window, flagging instances where more than 20 distinct sensitive files are accessed and over 500KB of data is sent out.
Detects the connection of an IP KVM (Keyboard, Video, Mouse) device, which could be used for unauthorized remote access or data exfiltration.
The analytic detects the execution of the 'gdrive' tool on a Windows host. This tool allows standard users to perform tasks associated with Google Drive via the command line, such as downloading, uploading, listing, updating, syncing, sharing, and managing accounts or files. Adversaries commonly use this tool to stage other tools or exfiltrate data. Detection leverages Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. If confirmed malicious, this activity could lead to system compromise or sensitive data theft.
Detects the use of the 'mdimport' command to index sensitive user directories. This is a key step in the Sploitlight TCC bypass technique (CVE-2025-31199), where a malicious Spotlight importer is triggered to run within the 'mdworker' process and exfiltrate data from TCC-protected locations by writing it to the system log.
This rule detects potential data exfiltration attempts using the built-in Windows `ping.exe` utility. Specifically, it looks for `ping.exe` executions where a large payload size (greater than 1024 bytes) is specified using the -L command-line argument. This technique can be used to tunnel data over ICMP, which might bypass some network defenses.
Detects the use of GoodSync command-line tools for data exfiltration, a TTP associated with the Chaos ransomware group. The rule looks for suspicious command-line patterns, including masquerading as wininit.exe.
Detects network connections to BTunnels domains initiated by a process on the system.
Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Detects an executable initiating a network connection to "ngrok" domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
This rule detects suspicious network connections to Dropbox API endpoints (api.dropboxapi.com or content.dropboxapi.com) originating from any executable that is not the legitimate Dropbox application. This behavior can indicate an adversary using a non-standard or malicious process to exfiltrate data or establish command and control via Dropbox.
Detects large data transfers over SSH/SCP (port 22) to or from an ESXi host. This activity is highly suspicious and could indicate an attacker delivering a ransomware payload to the hypervisor or exfiltrating sensitive data (like VMDK files).
Detects network connections to Devtunnels domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Detects network connections to Visual Studio Code tunnel domains initiated by a process on a system. Attackers can abuse this feature to establish a reverse shell, persistence, or exfiltrate data from a compromised machine.
Detects network connections to Cloudflared tunnels domains initiated by a process on the system. Attackers can abuse this feature to establish a reverse shell or persistence on a machine.
Detects potential Raven Stealer activity by identifying known artifacts such as specific file paths, created filenames, command-line arguments, network connections, and file hashes.
Detects when a non-browser process initiates network communication with the Telegram API. This activity is suspicious as it could indicate the use of Telegram for covert command and control (C2) or data exfiltration by malware, bypassing typical browser-based interactions.
This rule detects network connections initiated by any binary to the domains 'mega.co.nz' or 'mega.nz'. Attackers have been observed using file-sharing services like MEGA for uploading and downloading additional payloads, facilitating data exfiltration or staging. This detection aims to identify such suspicious communication patterns.
Detects PowerShell scripts leveraging the "Invoke-WebRequest" or "Invoke-RestMethod" cmdlets to send data using either the "PUT" or "POST" HTTP method. This behavior can indicate an attempt to exfiltrate data from the system.
Detects an executable initiating a network connection to "ngrok" domains.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Detects the HazyBeacon backdoor, which leverages AWS Lambda URLs for C2 communication and uses custom tools for data exfiltration. The rule identifies known malicious file hashes, suspicious tool drops in C:\ProgramData, specific service creation commands for persistence, and network connections from the sideloaded host process (mscorsvw.exe) to AWS Lambda URLs.
This detection identifies the use of a remote tool to download virtual machine disk files from a datastore. The NFC protocol is used by management tools to transfer files to and from ESXi hosts, but it can also be abused by attackers or insiders to exfiltrate full virtual disk images.
Page 99 of 124