Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,686 detections
Filters
Last updated
All Time
Detection languages
1,342
389
264
219
197
Contributors
620
506
358
209
102
Categories
20,453
11,838
5,876
5,154
4,865
2,686
Platforms
1,168
638
452
382
359
Products / Services
593
445
403
264
229
MITRE Techniques
1,884
787
525
521
510
CVEs
11
5
5
5
3
IDS Classtypes
189
133
34
10
7
IDS Protocols
243
58
33
22
12
Detects macOS infostealer malware using the curl utility to exfiltrate archived data (zip, tar, tgz, etc.) via multipart POST requests to specific known staging endpoints associated with the ClickFix campaign.
This rule detects suspicious activity originating from the Node.js runtime environment. It specifically monitors for 'node.exe' or 'node' processes accessing sensitive credential-related files (such as .npmrc, .netrc, .git-credentials, or id_rsa) followed closely (within 5 minutes) by network connections to public IP addresses. This behavior is indicative of an npm-based malware or malicious package attempting to harvest locally stored credentials and exfiltrate them to an external, potentially attacker-controlled server.
This one's the interesting bit they're using Ethereum RPC calls as a C2channel and dumping stolen secrets to attacker-owned public repos tagged "Shai-Hulud: Here We Go Again". Also flags Claude/VS Code config file writes dropped by the worm for lateral persistence across dev machines.
This rule detects potential data exfiltration via email by identifying mass near-identical background-image URLs in the body of an email. The rule looks for a high volume (8+) of distinct URLs that contain short parameters (indicative of encoded or smuggled data) within a single email. It further refines the detection by checking for the presence of specific CSS-like syntax often used in CSS-injection keylogging techniques to force the browser or email client to send background-image requests.
Suspicious Inbox Rule Creation
Cortex XDR
Detects creation of malicious Exchange Online inbox rules used for BEC and account-takeover persistence. Normalizes both client logging paths, OWA (New-InboxRule) and Outlook desktop (UpdateInboxRules + AddMailboxRule), and flags rules with hidden names (., ,, blank, 1 to 2 chars), external forwarding, or move/delete actions paired with payment (ach, wire, invoice) or security-notification (password, MFA, Microsoft) keywords, especially with stop-processing/exit-after-execution set.
This rule detects potential credential or sensitive file theft from VS Code extensions or configuration folders, followed closely by network exfiltration to the Telegram API. It specifically monitors file access to common paths (.ssh/id_rsa, .aws/credentials, .netrc, Local Storage, etc.) by VS Code processes, correlated with non-Telegram processes establishing network connections to api.telegram.org within a 10-minute window.
This rule detects potentially suspicious data exfiltration activities by identifying a pattern where a user authenticates or interacts with the Microsoft Purview service, followed closely (within 15 minutes) by a connection to an external domain that the organization has not established a historical communication pattern with in the last 30 days. This behavior may indicate an adversary is attempting to exfiltrate session tokens or sensitive data to an external server.
This rule detects potential mass email access or collection activities by an application (AppId). It monitors Microsoft 365 CloudAppEvents for actions like 'MailItemsAccessed', 'Send', or 'New-InboxRule' associated with an application. It triggers an alert when a single application interacts with 10 or more distinct mailboxes within a one-hour window, which is indicative of potential Business Email Compromise (BEC) or unauthorized mass data exfiltration via compromised OAuth applications.
This rule detects high-volume outbound network traffic from a Google Cloud Platform (GCP) source IP to external (non-private/non-internal) destinations. It establishes a baseline of daily outbound traffic per source IP over time and triggers an alert if the current daily outbound volume exceeds 500MB and shows a significant increase (more than 3x the established average) compared to previous days. This behavior is often indicative of unauthorized data exfiltration or abnormal network activity.
Detects instances where a single user account performs a large volume of file downloads (50 or more unique files) within a 30-minute window from Office 365 services. This behavior may indicate unauthorized data exfiltration or mass collection of sensitive information.
UNC6671 - Outbound connection to known automated SaaS data exfiltration IP, excluding maintained allowlist of legitimate backup/sync/CDN and sanctioned bulk-transfer destinations
This rule detects suspicious activity originating from the Node.js runtime environment. It specifically monitors for 'node.exe' or 'node' processes accessing sensitive credential-related files (such as .npmrc, .netrc, .git-credentials, or id_rsa) followed closely (within 5 minutes) by network connections to public IP addresses. This behavior is indicative of an npm-based malware or malicious package attempting to harvest locally stored credentials and exfiltrate them to an external, potentially attacker-controlled server.
This rule detects potential cloud data exfiltration by identifying anomalous device-code authentication sign-ins followed by high-velocity file or mailbox access. It specifically monitors Microsoft 365 sign-in logs for device-code authentication sessions involving either an application (AppId) or a geographic location not seen in the user's previous 14-day baseline. If such a sign-in is immediately followed (within a 2-hour window) by a rapid burst of activity in SharePoint, OneDrive, or Exchange—defined by at least 20 operations at a rate of 5 or more events per minute—the rule flags the sequence as suspicious. This pattern is characteristic of attackers using stolen device-code tokens to programmatically mass-download or exfiltrate sensitive cloud data.
Detects the execution of the rclone utility followed by successful outbound network connections occurring outside of standard business hours (8:00 PM to 6:00 AM). Rclone is a legitimate cloud storage synchronization tool frequently abused by adversaries for data exfiltration. This pattern identifies potential unauthorized data staging and egress to remote cloud storage services during times when activity is less likely to be monitored.
Detects anomalous, high-volume access, download, or synchronization activity in SharePoint or OneDrive within a one-hour window. The rule focuses on non-interactive user agents typically used by scripting libraries (e.g., Python requests, PowerShell, Go-http-client) and flags activity that exceeds an individual user's 21-day rolling baseline, suggesting potential automated data exfiltration or mass collection.
This rule detects potential data exfiltration by monitoring for anomalous user behavior across integrated SaaS applications. It flags accounts that perform high-frequency read, search, or view activities across three or more monitored SaaS platforms (Confluence, Jira, Slack, Google Workspace, Microsoft 365, or Bitbucket) within a 5-minute window, followed immediately by an upload or post activity to an external, non-integrated domain.
Detects network connections to known Generative AI API endpoints (OpenAI, Anthropic, Google, Mistral) from devices that have not exhibited such activity in the past 30 days. This rule excludes common browser processes and email/messaging clients to identify potentially anomalous or unapproved use of AI services.
This rule detects potential data exfiltration by monitoring for anomalous user behavior across integrated SaaS applications. It flags accounts that perform high-frequency read, search, or view activities across three or more monitored SaaS platforms (Confluence, Jira, Slack, Google Workspace, Microsoft 365, or Bitbucket) within a 5-minute window, followed immediately by an upload or post activity to an external, non-integrated domain.
This rule detects potentially suspicious data exfiltration activities by identifying a pattern where a user authenticates or interacts with the Microsoft Purview service, followed closely (within 15 minutes) by a connection to an external domain that the organization has not established a historical communication pattern with in the last 30 days. This behavior may indicate an adversary is attempting to exfiltrate session tokens or sensitive data to an external server.
This rule detects potential mass email access or collection activities by an application (AppId). It monitors Microsoft 365 CloudAppEvents for actions like 'MailItemsAccessed', 'Send', or 'New-InboxRule' associated with an application. It triggers an alert when a single application interacts with 10 or more distinct mailboxes within a one-hour window, which is indicative of potential Business Email Compromise (BEC) or unauthorized mass data exfiltration via compromised OAuth applications.
Possible O365 credential exfil via HTTP PUT to attacker-controlled S3 bucket
Page 45 of 128