Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,686 detections
Filters
Last updated
All Time
Detection languages
1,342
389
264
219
197
Contributors
620
506
358
209
102
Categories
20,443
11,831
5,875
5,151
4,864
2,686
Platforms
1,168
638
452
382
359
Products / Services
593
445
403
264
229
MITRE Techniques
1,884
787
525
521
510
CVEs
11
5
5
5
3
IDS Classtypes
189
133
34
10
7
IDS Protocols
243
58
33
22
12
Detects network traffic consistent with XWorm malware using the Telegram API for Command and Control (C2) or data exfiltration. This rule specifically looks for HTTP requests to 'api.telegram.org' with URL patterns indicative of sending messages or files via the Telegram Bot API (e.g., /bot<token>/sendMessage, /bot<token>/sendDocument, /bot<token>/sendPhoto).
KQL Query
Mustang Panda conducted a phishing campaign against Myanmar entities using a compromised embassy email. The lure involved a PDF with an embedded URL that delivered a ZIP archive containing a trojanized executable and malicious DLL. The malware disguised itself as a PDF, sideloaded the DLL, established persistence, and executed further payloads. It performed system reconnaissance, data exfiltration via SFTP, and defense evasion.
This detection looks at emails being sent from a users company email address to their personal email through comparing the sender and recipient email addresses to see if they contain similar strings. Users who are close to leaving the company and working their notice period etc should be monitored more closely and an increased number of emails being sent to a personal email can indicate data exfiltration.
This analytic detects the configuration of TFTP services on Cisco IOS devices that could be used to exfiltrate sensitive configuration files. Threat actors like Static Tundra have been observed configuring TFTP servers to make device configuration files accessible for exfiltration after gaining initial access. The detection specifically looks for commands that expose critical configuration files such as startup-config, running-config, and other sensitive system information through TFTP. This activity is particularly concerning as it may represent an attempt to steal credentials, network topology information, and other sensitive data stored in device configurations.
Base64 Website Access
YARA-L
Detects a user accessing multiple websites commonly used for Base64 encoding and decoding within a short time frame. This activity could be a precursor to data exfiltration or an attempt to obfuscate malicious commands.
This detection identifies execution of the file synchronization utility "rclone" with network activity, as captured by Cisco Network Visibility Module flow data. It specifically looks for `rclone.exe` or `rclone` commands with arguments indicative of data transfer to cloud storage providers (e.g., `copy`, `remote:`, `mega:`, `ftp:`) and suspicious flags (`--transfers`, `--ignore-existing`, `--auto-confirm`). Rclone is a legitimate tool but is frequently abused by threat actors for data exfiltration or cloud abuse.
Detects outbound Network File System (NFS) connections originating from an internal network IP address to a public IP address. This activity is highly unusual for legitimate NFS usage and could indicate an attempt to download malware, exfiltrate data, or establish command and control, as observed with malware like RapperBot.
This rule detects suspicious bulk file downloads from SharePoint by correlating successful sign-in events with subsequent file download activities. It specifically looks for sign-ins that are not from registered devices, followed by multiple file downloads (at least 3) within a short time window (up to 10 minutes) from the same IP address. The rule flags scenarios where a user downloads a significant number of unique files (at least 2) or has a high download count (5 or more), or a combination of moderate downloads (3 or more) within a very short duration (1 minute). This pattern can indicate data exfiltration attempts.
Detects the execution of specific SOQL (Salesforce Object Query Language) queries associated with the UNC6395 data theft campaign. The actor used these queries to enumerate and exfiltrate data from sensitive Salesforce objects.
Detects data theft activity from Salesforce instances by the threat actor UNC6395, who leveraged compromised OAuth tokens associated with the Salesloft Drift third-party application. The detection is based on suspicious user agents and known malicious IP addresses used by the threat actor, specifically targeting the 'Drift' connected application.
Detects a sequence of commands on Cisco IOS devices used to capture network traffic, specifically targeting TACACS+ on TCP port 49, and then exfiltrate it. This technique, detailed in a CISA advisory on PRC state-sponsored actors, is used to harvest credentials from network traffic.
Detects the export of critical Registry keys (SAM, SECURITY, SYSTEM) to a file using regedit.exe. This activity is often associated with credential dumping or exfiltration of sensitive system information.
Detects outbound API calls to api.github.com for repository creation or file uploads matching patterns used in the s1ngularity supply chain attack.
Detects the use of curl.exe to exfiltrate data, particularly archived or disguised files, via HTTP POST requests or the '--upload-file' flag. This technique was observed being used by the 'Curly COMrades' threat actor to upload .rar archives to a compromised server.
This rule detects suspicious file write and network activity that may indicate data exfiltration from a Windows Server using common tools like curl, ftp, or powershell. It correlates file creation/modification events with outbound network connections made by known exfiltration tools within a 5-minute window. This is useful for identifying insider threats, compromised servers, and automated exfiltration scripts.
This rule detects the creation or modification of registry keys and values under "HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Personal". This activity can indicate unauthorized personal OneDrive usage within an organization, which could be leveraged for data exfiltration, establishing persistence through cloud sync, or user profile manipulation. It is particularly useful for identifying insider threats, compromised servers, or automated exfiltration scripts.
Detects the execution of legitimate file transfer or backup utilities like FileZilla (fzsftp.exe), Restic, or BackBlaze (b2.exe) that have been observed being abused by threat actors for data exfiltration.
This rule monitors for the mounting of USB drives on a specific device. It aims to detect unauthorized data exfiltration attempts, audit physical device access, investigate insider threats or policy violations, and track removable media usage for compliance purposes.
This rule detects outbound email activity, specifically focusing on emails sent outside the organization's domain that include attachments. It identifies the sender, recipient, file type, file name, and file size of these attachments.
This rule identifies suspicious email attachments based on their file type (e.g., executables, scripts) or if they exceed a defined size threshold. It aims to detect potential data exfiltration or the delivery of malicious files via email.
Page 111 of 128