Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,686 detections
Filters
Last updated
All Time
Detection languages
1,342
389
264
219
197
Contributors
620
506
358
209
102
Categories
20,443
11,831
5,875
5,151
4,864
2,686
Platforms
1,168
638
452
382
359
Products / Services
593
445
403
264
229
MITRE Techniques
1,884
787
525
521
510
CVEs
11
5
5
5
3
IDS Classtypes
189
133
34
10
7
IDS Protocols
243
58
33
22
12
This rule detects anomalous, high-volume activity in Jira, such as mass ticket viewing, searching, exporting, or attachment downloading, which is often characteristic of unauthorized data exfiltration or reconnaissance. The detection triggers when an account exceeds thresholds of 200 issue-related actions or 8 attachment downloads within a 7-day period.
Detects anomalous, high-volume querying against machine learning inference endpoints. The rule identifies potential model extraction or data exfiltration attempts by flagging high counts of requests from a single user/API key, particularly during off-hours or with high variance in unique inputs, which may indicate automated efforts to reconstruct proprietary models or extract sensitive training data.
Detects anomalous, high-volume querying against machine learning inference endpoints. The rule identifies potential model extraction or data exfiltration attempts by flagging high counts of requests from a single user/API key, particularly during off-hours or with high variance in unique inputs, which may indicate automated efforts to reconstruct proprietary models or extract sensitive training data.
Detects potential data leakage from an LLM application where a user repeatedly prompts the model to divulge its internal system instructions, configuration, or sensitive information (e.g., API keys, PII) and the model subsequently outputs that sensitive data.
Detects an AI agent session that performs a data exfiltration action (e.g., sending an email, webhook, or file share) to an unauthorized or non-allowlisted destination shortly after the agent has ingested potentially untrusted external content. This behavior is indicative of an AI agent being manipulated to exfiltrate data after processing malicious or adversarial inputs.
Detects high-volume API requests to an AI inference service that explicitly request gradient, confidence vector, or raw logit information. Such patterns are indicative of model inversion or training data reconstruction attacks, where an adversary attempts to extract private training data by exploiting detailed output from the model.
This rule monitors the behavior of AI agent orchestrators to detect potentially malicious activities, specifically focusing on unauthorized tool usage, deep tool invocation chains, and potential data exfiltration. It triggers when an agent invokes a tool outside of its authorized scope, performs an excessively deep sequence of tool calls, or accesses sensitive data followed by an outbound connection to an external endpoint, which is consistent with the MITRE ATLAS AML.T0053 technique.
Detects potential sensitive data leakage from an AI model response (AIGatewayLogs_CL). The rule monitors AI responses for patterns indicative of PII (SSN, credit card numbers), secrets (API keys, tokens), or sensitive document markers. It correlates these signals with RAG (Retrieval-Augmented Generation) ingestion logs to identify data cross-tenant violations or improper access to confidential/restricted datasets.
Detects potential sensitive data leakage from an AI model response (AIGatewayLogs_CL). The rule monitors AI responses for patterns indicative of PII (SSN, credit card numbers), secrets (API keys, tokens), or sensitive document markers. It correlates these signals with RAG (Retrieval-Augmented Generation) ingestion logs to identify data cross-tenant violations or improper access to confidential/restricted datasets.
Detects potential sensitive data leakage from an AI model response (AIGatewayLogs_CL). The rule monitors AI responses for patterns indicative of PII (SSN, credit card numbers), secrets (API keys, tokens), or sensitive document markers. It correlates these signals with RAG (Retrieval-Augmented Generation) ingestion logs to identify data cross-tenant violations or improper access to confidential/restricted datasets.
Detects the use of command-line tools like s5cmd or aws-cli to synchronize or copy data to an Amazon S3 bucket. The rule identifies suspicious patterns by looking for specific transfer commands combined with recursive or high-concurrency flags that indicate mass data movement often associated with exfiltration.
Detects the execution of zsh with potentially suspicious command-line arguments (e.g., usage of curl, pipes, or osascript) occurring within a 15-minute window of network activity connecting to iCloud CalDAV servers. This behavior pattern may indicate unauthorized data access or exfiltration via legitimate cloud services.
Detects exfiltration of sensitive information, including Dahua camera credentials and internal identifiers, to the Telegram Bot API over HTTPS. These rules monitor for specific API endpoints (/sendPhoto) and common credential patterns (Login:, Password:, Model:) or indicators (Shodan links, VKontakte references) within HTTP POST requests directed toward api.telegram.org.
Detects PowerShell execution that combines screen capturing capabilities (System.Drawing.Bitmap, Windows.Forms) with network communication (System.Net.WebClient) directed towards known C2 domains (medianewsonline.com) using specific exfiltration parameters (OKey, Who).
Detects instances where a non-browser process initiates connections to commercial LLM provider APIs (DeepSeek, OpenRouter, Mistral) followed by a connection to Discord CDN/Webhook endpoints within a 15-minute window. This behavior is indicative of a process acting as an autonomous C2 agent that exfiltrates data after receiving instructions or processing information via an LLM.
Detects anomalous outbound HTTP POST requests containing sensitive file extensions or keywords (e.g., .docx, password, credentials) triggered by Python-based clients, followed by a potential exfiltration beacon response containing JSON file path data.
Detects anomalous large-scale data transfers to external endpoints that exhibit patterns characteristic of the ShinyHunters group's SaaS bulk export and data exfiltration methods. The rule identifies suspicious HTTP requests to Salesforce API endpoints (e.g., batch jobs, bulk queries) accompanied by unusually large content payloads, followed by subsequent encrypted communication to non-whitelisted external destinations.
Detects anomalous, high-frequency outbound HTTPS POST requests from the 'rnpkeys.exe' process, characteristic of the Sauron Loader exfiltrating screenshot chunks (Message Type 3) to a Command and Control (C2) server.
Detects outbound HTTP POST requests directed at the '/api/credentials' URI, a pattern associated with AMOS Stealer credential exfiltration. The rule includes a threshold to reduce noise by alerting only when multiple requests occur from a single source within a short timeframe.
Detects potential insider threats or departing employees by correlating abnormal bulk data downloads from cloud repositories (SharePoint/OneDrive/Box/etc.) with subsequent sensitive data access and exfiltration signals. It uses baseline behavioral profiling, requires a threshold of sensitive file interactions, and mandates high-confidence exfiltration indicators (removable media usage, suspicious external domains, or multiple combined destination events) to reduce noise. Archive/staging activity is used as an optional confidence booster.
Detects high-volume file download, access, or preview activity originating from known anonymous proxy services. This behavior is indicative of potential data exfiltration or unauthorized mass data collection from cloud storage applications.
Page 15 of 128