Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,686 detections
Filters
Last updated
All Time
Detection languages
1,342
389
264
219
197
Contributors
620
506
358
209
102
Categories
20,453
11,838
5,876
5,154
4,865
2,686
Platforms
1,168
638
452
382
359
Products / Services
593
445
403
264
229
MITRE Techniques
1,884
787
525
521
510
CVEs
11
5
5
5
3
IDS Classtypes
189
133
34
10
7
IDS Protocols
243
58
33
22
12
Detects users who have downloaded more than 50 files from cloud storage applications within a single hour, potentially indicating data exfiltration or mass data harvesting.
This rule monitors Netskope cloud application events to detect potential data exfiltration. It triggers if there is a significant volume anomaly (z-score >= 2) for any cloud application activity, or if a 'Share' or 'Upload' activity occurs that is only configured to 'Alert' rather than being blocked. This helps identify unusual spikes in data movement or sensitive operations that bypass formal enforcement controls.
Detects the use of curl.exe or curl to communicate with the malicious domain 'i.apee.my.id', initiated by a VS Code integrated terminal process. This behavior is indicative of malicious VS Code extensions exfiltrating data via a hidden terminal session.
This rule aggregates Zscaler Internet Access (ZIA) logs to identify users with Data Loss Prevention (DLP) violations. It calculates the frequency of incidents and flags high-activity users for potential data exfiltration analysis.
Detects high or critical severity Data Loss Prevention (DLP) alerts triggered by the Zscaler NSS platform. The rule identifies web traffic involving sensitive information categories such as Personally Identifiable Information (PII), financial data, or source code, which have been either allowed or blocked by Zscaler policy.
Detects high or critical severity Data Loss Prevention (DLP) alerts triggered by the Zscaler NSS platform. The rule identifies web traffic involving sensitive information categories such as Personally Identifiable Information (PII), financial data, or source code, which have been either allowed or blocked by Zscaler policy.
Detects a suspicious sequence of commands within GitHub Actions runner environments where 'printf' is piped into 'base64 -w0'. This pattern is commonly used by attackers to encode CI/CD secrets before exfiltrating them via network requests, specifically to bypass plaintext string matching and simple keyword-based detection.
Detects high-risk user behavior associated with unsanctioned or restricted Generative AI applications, specifically targeting large data uploads (potential data exfiltration) or repeated access following a coaching intervention.
Detects DLP events from Netskope where sensitive data (PII, PCI, Source Code, or Credentials) is being uploaded or shared, indicating potential data exfiltration.
Detects DLP policy violations flagged by Netskope when users upload, share, post, or send files within Slack or Microsoft Teams. This rule monitors for DLP profile matches which may indicate unauthorized exfiltration or exposure of sensitive data via collaboration tools.
Detects DLP policy violations flagged by Netskope when users upload, share, post, or send files within Slack or Microsoft Teams. This rule monitors for DLP profile matches which may indicate unauthorized exfiltration or exposure of sensitive data via collaboration tools.
This detection identifies sensitive data such as social security numbers, passwords, API keys, and credit card numbers being sent in prompts to AWS Bedrock Claude models. Exposure of sensitive data through AI prompts may indicate data loss, credential leakage, or insider threat activity.
This rule detects large file uploads (greater than 100MB) from endpoints to unmanaged or personal cloud storage services such as Google Drive, OneDrive, and Dropbox. This behavior may indicate unauthorized data exfiltration or the improper use of unapproved cloud storage platforms to move sensitive data outside of corporate control.
This rule detects potential data exfiltration or verification behavior by correlating a file write event in a temporary directory (/tmp/) with a subsequent 'cat' command execution reading that same file within a 10-minute window. This behavioral pattern is often associated with C2 agents staging data for retrieval.
Detects data exfiltration by the Kynx Stealer ChunkSender module which uses HTTP POST requests to a specific ingestion path.
This rule detects email communications where the subject line contains numerical patterns matching standard credit card number formats (13-16 digits, or spaced/hyphenated variations). The purpose is to identify potential unauthorized transmission of sensitive financial data (PII/payment information) via email.
Detects HTTP POST requests characteristic of the Kynx Stealer's ChunkSender module. The rule monitors for specific URI patterns used during the exfiltration phase, where stolen data categories like passwords, cookies, and system information are sent to a remote C2 panel.
This rule aggregates Zscaler Internet Access (ZIA) logs to identify users with Data Loss Prevention (DLP) violations. It calculates the frequency of incidents and flags high-activity users for potential data exfiltration analysis.
Detects sensitive files in cloud storage environments that have been shared publicly or with external entities, as identified by Netskope CASB (DLP) policies. This rule monitors for events where storage objects are assigned broad access permissions (e.g., 'public', 'anyone with link') in conjunction with DLP incident triggers.
Detects instances where sensitive or organizational data is uploaded to public text storage repositories like Pastebin or GitHub Gists through Netskope, which may indicate data exfiltration.
Detects sensitive files in cloud storage environments that have been shared publicly or with external entities, as identified by Netskope CASB (DLP) policies. This rule monitors for events where storage objects are assigned broad access permissions (e.g., 'public', 'anyone with link') in conjunction with DLP incident triggers.
Page 43 of 128