Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,686 detections
Filters
Last updated
All Time
Detection languages
1,342
389
264
219
197
Contributors
620
506
358
209
102
Categories
20,443
11,831
5,875
5,151
4,864
2,686
Platforms
1,168
638
452
382
359
Products / Services
593
445
403
264
229
MITRE Techniques
1,884
787
525
521
510
CVEs
11
5
5
5
3
IDS Classtypes
189
133
34
10
7
IDS Protocols
243
58
33
22
12
Detects network connections to domains associated with the DarkSpectre threat actor's campaigns, including GhostPoster, ShadyPanda, and The Zoom Stealer. These campaigns leverage malicious browser extensions for data theft, affiliate fraud, and corporate espionage.
Detects network traffic to web services associated with the ggwave project, such as 'ggwave.ggerganov.com'. These services can generate audio payloads from text, which could be used for covert data exfiltration over an acoustic channel, bypassing traditional network monitoring for the data content itself.
This rule detects successful 'GetObject' operations on AWS S3 buckets originating from external IP addresses (not within common private IP ranges). This could indicate an attempt to exfiltrate data from S3 buckets by an unauthorized entity or compromised credential.
High AWS S3 Object Deletion Count
Cortex XDR
Detects when a single IP address or identity performs a high number of S3 object or bucket deletions within a short timeframe. This could indicate an attacker attempting to destroy data, evade detection, or disrupt services.
Detects large volumes of outbound data transfers using the Cyberduck application to known cloud storage providers. The Qilin ransomware group has been observed using Cyberduck for data exfiltration.
Detects the use of a renamed Rclone binary to exfiltrate data via FTP. This technique was observed in a Lunar Spider intrusion where the actor used 'sihosts.exe' (a renamed rclone.exe) to copy files to an actor-controlled FTP server.
This rule detects network connections and DNS queries to command-and-control (C2) domains associated with malicious Chrome extensions. These extensions are known to steal sensitive data such as ChatGPT and DeepSeek conversations, as well as other browsing data. The rule specifically targets known malicious domains to identify C2 communication and potential data exfiltration.
vvs-stealer
KQL
This rule detects activities associated with the VVS Stealer malware, as described in the Palo Alto Networks Unit 42 blog. It identifies the malware through specific SHA256 hashes of known VVS Stealer executables, network connections to hardcoded Discord webhook URLs used for exfiltration, persistence mechanisms via creation of executables in Windows startup folders, creation of '_vault.zip' files (likely containing stolen data), and suspicious Discord-related process activity indicative of the stealer's operation.
Detects RAT command structure
This rule detects network connections to the Telegram API endpoint (api.telegram.org) from processes other than common web browsers like Chrome or Edge. This activity could indicate the use of Telegram for command and control, data exfiltration, or other malicious purposes by malware or threat actors.
Mythic C2 over SMB Detection
Cortex XDR
This rule detects potential Mythic C2 activity communicating over SMB. It identifies network traffic using the SMB protocol with a total upload size greater than 360 bytes, originating from and destined for private IP address ranges. The rule then groups these connections by agent hostname, local IP, remote IP, and process image name, flagging instances where three or more such connections occur within a 7-day timeframe, indicating potential beaconing behavior.
Detects outbound network connections to a known PCPcat C2 server IP address on specific ports used for API communication, reverse tunneling, and payload distribution. This rule identifies potential command and control activity and data exfiltration attempts by monitoring network traffic to a hardcoded malicious IP and associated non-standard ports.
Detects the DriverFixer0428 macOS credential stealer, attributed to the North Korean 'Contagious Interview' campaign. This rule identifies the malware based on unique internal strings, network IOCs related to Dropbox exfiltration, and social engineering text.
Detects a successful SSO administrative login followed by a system configuration download from the same user and source IP address within 5 minutes. This sequence is a strong indicator of compromise related to CVE-2025-59718 and CVE-2025-59719.
Visibility into how much data is being copied to USB devices in your environment? Here’s a KQL query that correlates USB mount events with file creation activity to identify potential data exfiltration.
👉 What this query does:
1. Detects when a USB drive is mounted
2. Correlates it with file creation events on removable media
3. Calculates the total data transferred per user
4. Highlights the Top 5 users by data volume
5. Visualizes the result as a pie chart for quick insights
🕵🏻♀️This is especially useful for:
1. Insider risk investigations
2. DLP and data exfiltration monitoring
3. Threat hunting scenarios
💡 Pro tip:
If you remove the last three lines (the summarize, top, and render piechart), the query becomes compatible with a Custom Detection Rule in Microsoft Defender.
🔑That means you can:
1. Trigger alerts automatically
2. Enable remediation actions (like isolating a device or initiating investigation)
👉 What this query does:
1. Detects when a USB drive is mounted
2. Correlates it with file creation events on removable media
3. Calculates the total data transferred per user
4. Highlights the Top 5 users by data volume
5. Visualizes the result as a pie chart for quick insights
🕵🏻♀️This is especially useful for:
1. Insider risk investigations
2. DLP and data exfiltration monitoring
3. Threat hunting scenarios
💡 Pro tip:
If you remove the last three lines (the summarize, top, and render piechart), the query becomes compatible with a Custom Detection Rule in Microsoft Defender.
🔑That means you can:
1. Trigger alerts automatically
2. Enable remediation actions (like isolating a device or initiating investigation)
This rule detects PowerShell processes that are initiated by a LOLBAS binary and subsequently establish an outbound network connection to a public IP address. It leverages an external LOLBAS JSON data source to identify suspicious parent processes. This behavior could indicate an adversary using a Living Off The Land Binary or Script (LOLBAS) to execute PowerShell for malicious purposes, such as command and control or data exfiltration.
This rule detects applications, other than common web browsers, that are making network connections to Google Analytics domains and also contain 'microsoft' in the remote URL. This could indicate an application collecting device information or other telemetry and exfiltrating it via Google Analytics, potentially for malicious purposes or unauthorized data collection.
Detects outbound network connections from common web server processes to the Telegram API domain (api.telegram.org). This behavior is indicative of the BlackForce phishing kit exfiltrating stolen credentials, as newer versions use a server-side component to relay data to a Telegram channel.
Detects network connections to Discord webhook URLs from non-standard processes. This technique is often used by malware, such as Phantom Stealer, to exfiltrate stolen data.
This rule detects the presence and activity of the ShadyPanda malware campaign, specifically focusing on malicious Chrome extensions and their associated command and control (C2) and data exfiltration domains. It identifies the creation of files with known malicious Chrome extension IDs (ending in '.crx') and network connections to hardcoded C2 and exfiltration domains linked to the ShadyPanda campaign.
This rule detects the presence and activity of the ShadyPanda malware campaign, specifically focusing on malicious Chrome extensions and their associated command and control (C2) and data exfiltration domains. It identifies the creation of files with known malicious Chrome extension IDs (ending in '.crx') and network connections to hardcoded C2 and exfiltration domains linked to the ShadyPanda campaign.
Page 106 of 128