Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,686 detections
Filters
Last updated
All Time
Detection languages
1,342
389
264
219
197
Contributors
620
506
358
209
102
Categories
20,443
11,831
5,875
5,151
4,864
2,686
Platforms
1,168
638
452
382
359
Products / Services
593
445
403
264
229
MITRE Techniques
1,884
787
525
521
510
CVEs
11
5
5
5
3
IDS Classtypes
189
133
34
10
7
IDS Protocols
243
58
33
22
12
Detects high-volume, systematic querying of LLM inference endpoints, which may indicate unauthorized model extraction, distillation attempts, or targeted data exfiltration from an LLM.
Detects the granting of highly privileged OAuth or API scopes to AI-related applications (such as Copilot plugins, browser-automation agents, or AI connectors) immediately followed by high-volume data access activities (file reads or email transfers) performed by the same user account. This behavior is indicative of an attacker weaponizing a compromised identity to grant an external AI agent broad access to sensitive data for exfiltration or automated reconnaissance.
Detects anomalous process activity that reads sensitive developer secrets (such as Anthropic, OpenAI, Gemini, or Hugging Face API keys) from common configuration or environment files, followed by an outbound network connection to a non-private IP address. This behavior is consistent with credential harvesting and exfiltration tactics used in supply chain attacks to hijack AI services.
Detects high-volume, systematic querying of LLM inference endpoints, which may indicate unauthorized model extraction, distillation attempts, or targeted data exfiltration from an LLM.
Detects the granting of highly privileged OAuth or API scopes to AI-related applications (such as Copilot plugins, browser-automation agents, or AI connectors) immediately followed by high-volume data access activities (file reads or email transfers) performed by the same user account. This behavior is indicative of an attacker weaponizing a compromised identity to grant an external AI agent broad access to sensitive data for exfiltration or automated reconnaissance.
Detects anomalous process activity that reads sensitive developer secrets (such as Anthropic, OpenAI, Gemini, or Hugging Face API keys) from common configuration or environment files, followed by an outbound network connection to a non-private IP address. This behavior is consistent with credential harvesting and exfiltration tactics used in supply chain attacks to hijack AI services.
Detects anomalous large-volume file download or export activity from cloud repositories (SharePoint, OneDrive, or Salesforce) occurring shortly after a help-desk-mediated credential or MFA reset for the same user. This behavior is indicative of account takeover, specifically vishing-to-exfiltration patterns used by threat actors.
Detects outbound network traffic matching known SectopRAT C2 patterns. The rule monitors for established TCP connections to a specific malicious IP address with a payload size exceeding 300 bytes, consistent with the exfiltration of AES-encrypted JSON credential or wallet data. It includes threshold logic to limit alerts to once per source IP every 60 seconds.
Detects outbound network traffic matching known SectopRAT C2 patterns. The rule monitors for established TCP connections to a specific malicious IP address with a payload size exceeding 300 bytes, consistent with the exfiltration of AES-encrypted JSON credential or wallet data. It includes threshold logic to limit alerts to once per source IP every 60 seconds.
Detects outbound network traffic matching known SectopRAT C2 patterns. The rule monitors for established TCP connections to a specific malicious IP address with a payload size exceeding 300 bytes, consistent with the exfiltration of AES-encrypted JSON credential or wallet data. It includes threshold logic to limit alerts to once per source IP every 60 seconds.
Detects outbound network traffic matching known SectopRAT C2 patterns. The rule monitors for established TCP connections to a specific malicious IP address with a payload size exceeding 300 bytes, consistent with the exfiltration of AES-encrypted JSON credential or wallet data. It includes threshold logic to limit alerts to once per source IP every 60 seconds.
Detects the granting of highly privileged OAuth or API scopes to AI-related applications (such as Copilot plugins, browser-automation agents, or AI connectors) immediately followed by high-volume data access activities (file reads or email transfers) performed by the same user account. This behavior is indicative of an attacker weaponizing a compromised identity to grant an external AI agent broad access to sensitive data for exfiltration or automated reconnaissance.
Detects anomalous large-volume file download or export activity from cloud repositories (SharePoint, OneDrive, or Salesforce) occurring shortly after a help-desk-mediated credential or MFA reset for the same user. This behavior is indicative of account takeover, specifically vishing-to-exfiltration patterns used by threat actors.
Detects the execution of VelvetCake modular scripts by PowerShell, which involves downloading and executing scripts from %TEMP% via Invoke-Expression, and monitoring the C:\Users\Public directory for file staging and subsequent exfiltration. This rule captures the tactical loop of script execution, output file creation, and exfiltration preparation often observed in Operation Conflict Compass activity.
This rule detects anomalies in outbound network data transfer by comparing the current daily volume of data sent to external, non-private IP addresses against the historical average for those specific sources. It alerts when the daily volume exceeds 500MB and shows a significant spike (3x or more) compared to historical baseline data or when no historical data is available for a new source connection.
This rule detects unauthorized or suspicious processes (like Python scripts or random executables) accessing Telegram Desktop's local 'tdata' directory, which contains user session information, and simultaneously exhibiting network activity directed towards Telegram API domains. This behavior is highly indicative of infostealer activity, where a malicious process attempts to harvest local Telegram session data for exfiltration.
This rule detects potential exfiltration of sensitive files, specifically 'cert.pem' and 'private.key', via HTTP POST requests to the '/api/adbk/upload' endpoint. This pattern is characteristic of the RatHat malware attempting to exfiltrate device credentials to a Command and Control (C2) server.
Detects instances where a removed GitHub organization member performed bulk repository access (cloning or downloading) shortly before their removal, potentially indicating exploitation of retained access by a departed employee or an adversary using a valid account before deprovisioning. The rule identifies activity occurring more than 24 hours prior to removal involving multiple repositories or multiple access actions.
Detects outbound network traffic (TLS and DNS queries) directed towards AWS S3 endpoints, which may indicate the use of s5cmd or similar tools for unauthorized data exfiltration to cloud storage.
Detects the execution of the s5cmd utility using 'cp' or 'sync' commands directed towards S3 storage paths. This behavior is indicative of unauthorized data exfiltration to attacker-controlled cloud storage, a tactic identified in intrusions associated with the 'Ransom Busters' group.
Detects HTTP POST requests to the Telegram Bot API (/sendPhoto) containing patterns indicative of data exfiltration. The rule identifies suspicious message content, such as URLs leading to VK.com or reconnaissance data like Shodan host links and IP location query templates, suggesting the use of Telegram as a Command and Control (C2) channel for exfiltrating sensitive information.
Page 23 of 128