Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,686 detections
Filters
Last updated
All Time
Detection languages
1,342
389
264
219
197
Contributors
620
506
358
209
102
Categories
20,453
11,838
5,876
5,154
4,865
2,686
Platforms
1,168
638
452
382
359
Products / Services
593
445
403
264
229
MITRE Techniques
1,884
787
525
521
510
CVEs
11
5
5
5
3
IDS Classtypes
189
133
34
10
7
IDS Protocols
243
58
33
22
12
Detects the ChainDrop/Shai-Hulud 2.0 "Run Copilot" secrets-laundering technique: a CI workflow step dumping toJSON(secrets) to a format-results.txt artifact, followed by GitHub Actions artifact-API downloads using scraped ghs_ runner tokens and git ref deletion used to cover tracks.
This rule identifies potential account compromise or session hijacking by correlating anomalous outbound email patterns with risky sign-in events. It monitors for users who send outbound emails to a threshold of previously unseen external recipients within a short window after authenticating under suspicious conditions, such as high-risk sign-in flags, atypical locations, or unfamiliar applications. This pattern is indicative of attackers using stolen session tokens or compromised credentials to perform mass outbound phishing, spamming, or data exfiltration from an internal mailbox.
Detects the execution of the LimeWire P2P file-sharing application within 30 minutes of the creation of sensitive files, such as LSASS memory dumps, NTDS.dit, or SAM/SYSTEM/SECURITY registry hives, on the same host. This temporal correlation suggests the potential exfiltration of sensitive credential material via P2P file-sharing.
Detects network connections to known Generative AI API endpoints (OpenAI, Anthropic, Google, Mistral) from devices that have not exhibited such activity in the past 30 days. This rule excludes common browser processes and email/messaging clients to identify potentially anomalous or unapproved use of AI services.
This rule detects high-volume file access or download operations in SharePoint or OneDrive, performed by non-browser user agents (e.g., Python, PowerShell, cURL, Go). An elevated volume of such actions within a short timeframe is indicative of automated, scripted interaction, which may represent malicious data exfiltration, automated content scraping, or potential account compromise.
Persistent multi-day exfil retry with per-package tracking ID beacon
This rule detects rapid, high-volume outbound network requests to a single remote host from common web browsers (msedge.exe, chrome.exe, outlook.exe, firefox.exe). It identifies suspicious behavior where a browser performs at least 10 requests to 10 distinct URLs in a 30-second window, which is indicative of potential per-keystroke exfiltration or automated data scraping.
This rule detects rapid, high-volume outbound network requests to a single remote host from common web browsers (msedge.exe, chrome.exe, outlook.exe, firefox.exe). It identifies suspicious behavior where a browser performs at least 10 requests to 10 distinct URLs in a 30-second window, which is indicative of potential per-keystroke exfiltration or automated data scraping.
Suspicious Inbox Rule Creation
Cortex XDR
Detects creation of malicious Exchange Online inbox rules used for BEC and account-takeover persistence. Normalizes both client logging paths, OWA (New-InboxRule) and Outlook desktop (UpdateInboxRules + AddMailboxRule), and flags rules with hidden names (., ,, blank, 1 to 2 chars), external forwarding, or move/delete actions paired with payment (ach, wire, invoice) or security-notification (password, MFA, Microsoft) keywords, especially with stop-processing/exit-after-execution set.
Detects anomalous, high-volume file access (creation, modification, or renaming) targeting sensitive extensions (e.g., .key, .pem, .pfx) within document directories by unsigned processes. It also detects similar high-volume file access behavior that occurs immediately following the mounting of a removable USB device, consistent with CornFlake RAT data exfiltration patterns.
Detects malicious browser extension background scripts exfiltrating browser data by identifying specific message patterns (type 0x14/20 and event 0xc8/200 containing keyword, url, and count fields) or activity associated with known malicious extension IDs and native messaging hosts.
Detects network communication associated with the TOKYOCORE malware C2 infrastructure. The rule monitors for specific API endpoints (/api/victim/(log|data|command|archive)) combined with known malicious User-Agent strings (RansomAgent or fsociety/1.0), as well as suspicious multipart form data uploads that may indicate data staging or exfiltration.
Detects outbound HTTPS traffic to api.telegram.org originating from non-standard or unsigned processes. This rule is designed to identify potential data exfiltration by malware (such as stealers or trojans) using the Telegram Bot API as a C2 or exfiltration channel. It relies on a companion rule to establish flowbits for legitimate client traffic.
Anomalously large outbound transfers over the WebRTC DataChannel from a Chrome/Edge process launched with --headless and --remote-debugging-port flags (no visible window), indicating exfiltration rather than routine interactive or automation-only browser use.
Detects the clipboard_start/clipboard_stop/clipboard_data C2 command schema used by ChonkyChicken for clipboard monitoring.
Detects the malicious GitHub Actions workflow that exfiltrates PyPI/Codecov CI secrets to the attacker's known webhook.site endpoint.
Detects network indicators related to the BlueNoroff ClickFix Kit, specifically targeting malicious TURN relay domains (edensun.xyz) used for WebRTC-based webcam exfiltration and Command and Control (C2) traffic involving Socket.IO signals that trigger malicious UI modals.
Detects anomalous activity in Microsoft 365 calendar events where potential C2 data is exfiltrated or synchronized. This is identified by the creation or modification of calendar events containing suspicious file names (e.g., File0.txt, File1.txt) or specific command-and-control markers within the event subject.
Detects the HTTP POST exfiltration pattern used by the mrmustard stealer to send harvested credentials/host data to its C2 endpoint at metrics.femboy.energy/v1/collect.
Anomalously large outbound transfers over the WebRTC DataChannel from a Chrome/Edge process launched with --headless and --remote-debugging-port flags (no visible window), indicating exfiltration rather than routine interactive or automation-only browser use.
Detects network connections originating from browser processes to domains associated with ModHeader-related C2 activity, specifically 'stanfordstudies.com' and 'extensions-hub.com'. This pattern is indicative of malicious browser extensions exfiltrating data or reaching out to command and control infrastructure.
Page 46 of 128