Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,686 detections
Filters
Last updated
All Time
Detection languages
1,342
389
264
219
197
Contributors
620
506
358
209
102
Categories
20,456
11,839
5,876
5,155
4,865
2,686
Platforms
1,168
638
452
382
359
Products / Services
593
445
403
264
229
MITRE Techniques
1,884
787
525
521
510
CVEs
11
5
5
5
3
IDS Classtypes
189
133
34
10
7
IDS Protocols
243
58
33
22
12
Detects the creation of a specifically named exfiltration file ('edgeLog.txt') followed by an outbound network connection over port 443 originating from the same process storyline. This pattern is indicative of a process staging stolen data to disk and subsequently exfiltrating it over an encrypted channel to an external destination.
Detects unusually large outbound network data transfers (over 1TB) from a single process account within an hour. This could indicate data exfiltration, unauthorized bulk data synchronization, or other malicious activity where large volumes of data are being moved out of the environment.
Detects TeamPCP-associated behavior in CI/CD environments, specifically the encryption and staging of sensitive secrets using tools like OpenSSL, tar, and curl. The rule monitors for the execution of at least three distinct tools from a specified list within a short time window that interact with files in a /tmp/tmp. staging directory, indicative of preparation for data exfiltration.
Detects a potential SSRF-based exfiltration attempt by correlating DNS traffic. The rule identifies a browser session that accesses M365 Copilot (m365.cloud.microsoft) followed by a connection to Bing (bing.com), which is indicative of the exfiltration technique associated with CVE-2026-42824 involving the Bing 'searchbyimage' feature.
Detects network proxy requests from Go-based HTTP clients targeting Dropbox and gofile.io, which are common indicators of VILE ransomware communication or data exfiltration activities.
Detects potential data exfiltration (CVE-2026-42824) where an attacker leverages an SSRF vulnerability in Bing's search-by-image functionality to relay sensitive M365 Copilot data. The rule identifies outbound network requests to the image search endpoint containing a suspicious 'imgurl' parameter pointing to non-Microsoft infrastructure, initiated by common web browser processes.
This rule detects attempts to exploit Microsoft 365 Copilot through prompt injection, where attackers inject HTML/script elements into search queries. It specifically identifies when these queries attempt to force Copilot to interact with external URLs via Bing image search (SSRF), potentially exfiltrating sensitive data such as MFA codes, email content, or meeting details to an attacker-controlled external domain.
Detects an unusually large data transfer (greater than 5MB) from an internal MySQL server to an external network, which may indicate unauthorized database record exfiltration or data dumping.
Detects outbound network communication to an IP address (64.20.53.230) identified as a staging server associated with the JadePuffer activity. This activity involves potential data exfiltration following self-narrated deletion payloads.
Detects high-volume data access or exfiltration from Azure/Office 365 cloud environments via common scripting/automation user-agents. The rule monitors API requests to users, mail, drive, or files endpoints by non-standard clients (e.g., python, curl, Go) from previously unseen locations, calculating a risk score based on the number of endpoints accessed and the total data volume.
This rule detects potential brute force attacks against Microsoft Exchange Outlook Web App (OWA) by monitoring for a high volume of 401 Unauthorized status codes from non-internal IP addresses. It also correlates these authentication events with subsequent post-authentication actions, specifically identifying mailbox logins followed by mailbox searching or export requests, which may indicate account compromise and unauthorized data collection or exfiltration.
This rule detects suspicious network connections originating from internal IP addresses to common service ports (DNS, SMB, RDP, WinRM) on remote, non-internal IP addresses. It flags instances where a single process on a device makes 10 or more such connections within an hour, which could indicate reconnaissance, lateral movement, or data exfiltration attempts.
Detects AI agent processes (e.g., claude, node) executing environment enumeration commands (env, printenv) following suspected prompt injection, combined with subsequent network traffic associated with credential exfiltration patterns.
Detects HTTP POST requests directed at a specific suspicious endpoint (/service/save.php) on a known malicious host (83.138.53.110), consistent with the exfiltration behavior of the FortiBleed EKZ stealer malware. The rule identifies potential credential theft and exfiltration over standard web protocols.
Detects MCP (Model Context Protocol) server processes or developer tools spawned by IDE extensions performing environment variable enumeration to access cloud credentials (e.g., AWS, Azure, GCP, GitHub tokens) followed by anomalous outbound network connections, indicating potential exfiltration of sensitive developer environment secrets.
This rule detects an unusually high volume of object close operations (Event ID 4658) by a single user on a single computer within a one-hour window. This activity could indicate various malicious behaviors, including data collection for exfiltration, attempts to delete numerous files, or resource exhaustion attacks.
Detects potential data exfiltration activity to the file sharing service 'easyupload.io' by monitoring DNS queries, HTTP POST requests, and general network connections to the domain.
This rule detects unauthorized exfiltration of stolen browser and credential data by the Yuta/Glove Stealer malware (winupdate.exe). It identifies outbound HTTPS network connections from the specific indicator file path '%APPDATA%\.cache\winupdate.exe' to known C2 endpoints, including Discord webhooks, Telegram bot APIs, or connections utilizing the 'python-requests' user agent.
This rule detects network connections to specific IP addresses and ports (1259, 1269) via UDP, or the presence of a file with a specific SHA256 hash. This combination could indicate command and control (C2) communication or data exfiltration using a custom UDP protocol.
This rule detects suspicious large file transfers over the network, specifically looking for connections where more than 100MB (104857600 bytes) of data has been sent or received. It then aggregates these transfers by device and remote IP within one-hour bins and flags if five or more such large transfers occur within that hour. This behavior can be indicative of data exfiltration, often associated with ransomware attacks or other malicious data theft activities.
Detects high-volume outbound network connections (exceeding 10MB) originating from processes associated with AI-driven chatbot or productivity applications (e.g., ChatGPT, Perplexity). This rule identifies potential data exfiltration occurring over legitimate, expected software channels.
Page 49 of 128