Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,686 detections
Filters
Last updated
All Time
Detection languages
1,342
389
264
219
197
Contributors
620
506
358
209
102
Categories
20,443
11,831
5,875
5,151
4,864
2,686
Platforms
1,168
638
452
382
359
Products / Services
593
445
403
264
229
MITRE Techniques
1,884
787
525
521
510
CVEs
11
5
5
5
3
IDS Classtypes
189
133
34
10
7
IDS Protocols
243
58
33
22
12
Detects the execution of the Restic backup tool, which can be used for data exfiltration. Threat actors may leverage Restic to back up and exfiltrate sensitive data to remote storage locations, including cloud services. If not legitimately used in the enterprise environment, its presence may indicate malicious activity.
Detects the execution of the 'curl.exe' process with specific flags that indicate an attempt to upload or exfiltrate data. This includes flags like '--form', '--upload-file', '--data', and variations of '--data-' (e.g., '--data-ascii', '--data-binary', '--data-raw', '--data-urlencode'), as well as shorthand flags like '-F', '-T', and '-d'. The rule filters out connections to localhost to reduce false positives.
Detects potential data exfiltration activity associated with the 'Shai-Hulud' NPM package attack. This rule specifically looks for the execution of 'curl' with command-line arguments indicating data being sent ('-d') to a known malicious webhook.site URL.
The rule `MAL_GOLANG_STEALER_QBIT` is designed to detect the Qbit Stealer malware by identifying specific branding strings, setup configurations, and error messages commonly found within its binaries. The rule looks for strings like "qBit Stealer", "TRIAL VERSION - 24 Hour Access", "Stolen Folder Name:", "Max File Size(MB):", "Targeted File Extensions:", "[+] Logged into Mega", "[+] Loaded configJs", "Failed to load configJs", "Failed to archive files", "Failed to upload files", and "Failed to get file info". It also specifies a file size range between 7MB and 9MB. The rule `HUNT_QBIT_STEALER_DEV` aims to detect other software potentially created by the same author (n1k714i) by looking for developer-related strings such as "qbit@hitler.rocks", "n1k7l4i", "N1k7", and "CrabCat".
Detects GitHub activity associated with the 'Shai-Hulud' NPM supply chain attack. The attack involves malicious NPM packages that use stolen GitHub tokens to create a new branch, inject a malicious workflow file to exfiltrate secrets, and make private repositories public.
Detects the execution of WinSCP with the "-command" and "open" flags to establish an FTP or SFTP connection. This technique has been observed in use by the Akira ransomware group for data exfiltration.
The following analytic identifies suspicious PowerShell execution using Script Block Logging (EventCode 4104). It leverages specific patterns and keywords within the ScriptBlockText field to detect potentially malicious activities. This detection is significant for SOC analysts as PowerShell is commonly used by attackers for various malicious purposes, including code execution, privilege escalation, and persistence. If confirmed malicious, this activity could allow attackers to execute arbitrary commands, exfiltrate data, or maintain long-term access to the compromised system, posing a severe threat to the organization's security.
The following KQL query focuses on detecting cases where files are created, modified, or otherwise accessed via RDP from another computer. Its main objective is to verify whether, during an RDP session, the connection has mapped a local disk or other redirected device — allowing us to easily identify potential cases of data exfiltration through RDP file transfer
Hunts for multi-stage attacker behavior involving executables dropped to user directories, co-located DLL loads, and outbound network connections to Azure cloud domains used as command-and-control infrastructure. This query surfaces advanced adversary tradecraft where payload delivery, code execution, and cloud-based C2 are tightly correlated.
The analytic detects potential data exfiltration using PowerShell's Invoke-RestMethod. It leverages PowerShell Script Block Logging to identify scripts that attempt to upload files via HTTP POST requests. This activity is significant as it may indicate an attacker is exfiltrating sensitive data, such as desktop screenshots or files, to an external command and control (C2) server. If confirmed malicious, this could lead to data breaches, loss of sensitive information, and further compromise of the affected systems. Immediate investigation is recommended to determine the intent and scope of the activity.
Detects when full data export is attempted.
Detects when full data export is attempted an unauthorized user.
This analytic detects suspicious data transfer activities involving the use of the `split` syscall with the `-b` option, which specifies the size of each output file. This technique can be used by attackers to evade detection by breaking large files into smaller parts, bypassing size-based security controls, and facilitating covert exfiltration of sensitive data. By monitoring for unusual or unauthorized use of the `split` syscall with a specified block size, this analytic helps identify potential data exfiltration attempts.
The following analytic detects a high frequency of file copying or moving within network shares, which may indicate potential data sabotage or exfiltration attempts. It leverages Windows Security Event Logs (EventCode 5145) to monitor access to specific file types and network shares. This activity is significant as it can reveal insider threats attempting to transfer classified or internal files, potentially leading to data breaches or evidence tampering. If confirmed malicious, this behavior could result in unauthorized data access, data loss, or compromised sensitive information.
The following analytic detects the usage of `rclone.exe` with specific command-line arguments indicative of file transfer activities. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and process details. This activity is significant as `rclone.exe` is often used by adversaries for data exfiltration, especially during ransomware attacks. If confirmed malicious, this behavior could lead to unauthorized data transfer, resulting in data breaches and potential loss of sensitive information. Immediate isolation of the affected endpoint and further investigation are recommended.
The following analytic detects the high-frequency exfiltration of archive files via HTTP POST requests. It leverages HTTP stream logs to identify specific archive file headers within the request body. This activity is significant as it often indicates data exfiltration by APTs or trojan spyware after data collection. If confirmed malicious, this behavior could lead to the unauthorized transfer of sensitive data to an attacker’s command and control server, potentially resulting in severe data breaches and loss of confidential information.
The analytic detects a high volume of outbound web traffic, specifically over 1GB of data sent to a URL within a 2-minute window. It leverages web access logs to identify significant uploads by analyzing the sum of bytes out. This activity is significant as it may indicate potential data exfiltration by malware or malicious insiders. If confirmed as malicious, this behavior could lead to unauthorized data transfer, resulting in data breaches and loss of sensitive information. Immediate investigation is required to determine the legitimacy of the transfer and mitigate any potential threats.
The following analytic detects the creation of an AWS DataSync task, which could indicate potential data exfiltration. It leverages AWS CloudTrail logs to identify the `CreateTask` event from the DataSync service. This activity is significant because attackers can misuse DataSync to transfer sensitive data from a private AWS location to a public one, leading to data compromise. If confirmed malicious, this could result in unauthorized access to sensitive information, causing severe data breaches and compliance violations.
The following analytic detects suspicious usage of BitLockerToGo.exe, which has been observed being abused by Lumma stealer malware. The malware leverages this legitimate Windows utility to manipulate registry keys, search for cryptocurrency wallets and credentials, and exfiltrate sensitive data. This activity is significant because BitLockerToGo.exe provides functionality for viewing, copying, and writing files as well as modifying registry branches - capabilities that the Lumma stealer exploits for malicious purposes. If confirmed malicious, this could indicate an active data theft campaign targeting cryptocurrency wallets, browser credentials, and password manager archives. The detection focuses on identifying BitLockerToGo.exe execution patterns that deviate from normal system behavior.
Detects a process accessing multiple sensitive files in WhatsApp or Google Chrome data folders, a technique used by Mysterious Elephant APT's exfiltration tools (Uplo, Stom, ChromeStealer).
This analytic detects the presence of "api.telegram.org" in the command line of a process. This activity is significant because the Telegram API has been used as an exfiltration mechanism or as a Command and Control (C2) channel by adversaries. If confirmed malicious, this could indicate an attacker or malware is exfiltrating data or receiving additional C2 instructions, potentially leading to further compromise and persistence within the network. The rule leverages process execution logs from Endpoint Detection and Response (EDR) agents.
Page 109 of 128