Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,686 detections
Filters
Last updated
All Time
Detection languages
1,342
389
264
219
197
Contributors
620
506
358
209
102
Categories
20,443
11,831
5,875
5,151
4,864
2,686
Platforms
1,168
638
452
382
359
Products / Services
593
445
403
264
229
MITRE Techniques
1,884
787
525
521
510
CVEs
11
5
5
5
3
IDS Classtypes
189
133
34
10
7
IDS Protocols
243
58
33
22
12
Detects native Windows scripting hosts (wscript.exe, cscript.exe) establishing outbound network connections over SMTPS (port 465). This is highly anomalous and was observed in the FAUX#ELEVATE campaign where threat actors exfiltrated stolen credentials and browser data using Collaboration Data Objects (CDO) via VBScript to external SMTP servers.
This rule detects a multi-stage exfiltration technique observed on macOS systems, specifically targeting the AMOS malware. It correlates process execution events related to archiving (using 'ditto'), splitting files (using 'split'), and network connections involving 'curl' with specific headers or to known malicious infrastructure. The rule looks for a combination of these activities, indicating data staging and subsequent exfiltration in chunks.
Detects the execution of S3 Browser or Office installation executables, followed by network traffic from the same host to known cloud storage or file-sharing sites within a short time window. This behavior aligns with Muddled Libra's method of staging and exfiltrating sensitive data, such as PST files, to attacker-controlled cloud buckets.
Detects information stealer malware with encrypted configuration parsing
Detects information stealer malware with encrypted configuration parsing
This rule detects network connections and DNS resolution requests to known typosquatted domains used by the TeamPCP threat actor for command and control (C2) and data exfiltration. These domains are associated with a compromised Trivy scanner. Detection indicates successful execution of the compromised scanner and attempted exfiltration.
Detects the execution of a 'kubectl get secrets' command with specific parameters ('--all-namespaces', '-o json', '|| true') via a 'bash' process on Linux systems. This activity is indicative of bulk Kubernetes secret enumeration, a technique used by the TeamPCP stealer as described by Microsoft.
Detects `curl` commands performing `POST` requests with `--data-binary` that are spawned from a process whose command line contains "trivy-action". This behavior is indicative of potential data exfiltration in the context of a compromised Trivy supply chain.
Detects outbound HTTP POST requests containing the specific custom header 'X-Filename: tpcp.tar.gz'. This custom header is used by the TeamPCP credential harvester to exfiltrate collected sensitive credentials (cloud, database, SSH, Kubernetes) to an attacker-controlled server following the compromise of the litellm PyPI package.
Detects the specific OpenSSL command line arguments used by TeamPCP (Trivy compromise) to encrypt stolen credentials before exfiltration using a hybrid AES-256-CBC scheme. This rule looks for the 'openssl' executable being run with 'enc -aes-256-cbc' or 'enc -aes-256' and a passphrase specified via a file using '-pass file:'.
Detects outbound HTTP POST requests containing the specific custom header 'X-Filename: tpcp.tar.gz' used by the TeamPCP credential harvester for data exfiltration. This rule targets a highly specific Indicator of Compromise (IOC) associated with the TeamPCP threat.
Detects the specific OpenSSL command line arguments used by TeamPCP to encrypt stolen credentials before exfiltration. This rule looks for executions of 'openssl' with AES-256 encryption flags ('enc -aes-256-cbc' or 'enc -aes-256') and the use of a file to pass the encryption password ('-pass file:').
This rule detects network communication (DNS queries, HTTP requests, or network connections) to the command and control (C2) domain 'checkmarx.zone', which is associated with the TeamPCP threat group. This activity indicates potential compromise or communication with adversary infrastructure.
This rule detects network connections and DNS resolution requests to known typosquatted domains used by the TeamPCP threat actor for command and control (C2) and data exfiltration. These domains are associated with a compromised Trivy scanner. Detection indicates successful execution of the compromised scanner and attempted exfiltration.
Threat Hunt: RoKRAT Malware – Injection & Steganography 🛠 High‑Level TTPs Initial Access: Malicious .lnk files within compressed archives. Execution & Persistence: PowerShell/BAT‑driven staged loaders with XOR decryption. Defense Evasion: Process injection into trusted Windows binaries & payload concealment via steganography. Command & Control: Abuse of pCloud, Yandex Disk, and Dropbox APIs with embedded tokens to blend with legitimate traffic.
Detects the creation of a GitHub repository named `tpcp-docs`. This specific repository name is utilized as a fallback exfiltration channel by the TeamPCP threat actor. During the Trivy supply chain attack, the malware abused stolen GitHub tokens to create this public repository on the victim's account to host stolen data as release assets when the primary exfiltration method failed.
Detects ShadowSniff info-stealer based on strings, PDB path, and behavioral indicators.
Detects outbound network connections to the known typosquatted C2 domain (`scan.aquasecurtiy.org`) or associated IP address (`45.148.10.212`) used by the TeamPCP threat actor. This infrastructure was utilized during the Trivy supply chain attack for exfiltrating stolen SSH keys, cloud credentials, and CI/CD secrets.
This rule detects outbound network connections to URLs associated with common file sharing services (e.g., Dropbox, Mega, Gofile) or temporary email providers (e.g., Temp-Mail). Such connections can indicate data exfiltration attempts, use of unsanctioned services, or communication with command and control infrastructure.
Detects mass device wipe, retire, or delete operations performed via Microsoft Intune, inspired by the Stryker/Handala attack. This rule combines five detection signals: static velocity threshold, bulk destructive actions from a single operator, first-time operator detection, UEBA anomaly correlation, and ML anomaly detection. Operations are categorized into Tier 1 (critical, zero baseline activity like wipe/retire) and Tier 2 (high, legitimate IT ops activity like device delete, subject to velocity and ML thresholds). Severity escalates based on the number of overlapping signals.
Detects outbound web requests to the Anthropic API containing the specific beta header required to upload files. This can be abused by attackers to exfiltrate sensitive data from the Claude sandbox to an attacker-controlled Anthropic account.
Page 100 of 128