Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,686 detections
Filters
Last updated
All Time
Detection languages
1,342
389
264
219
197
Contributors
620
506
358
209
102
Categories
20,439
11,829
5,873
5,151
4,864
2,686
Platforms
1,168
638
452
382
359
Products / Services
593
445
403
264
229
MITRE Techniques
1,884
787
525
521
510
CVEs
11
5
5
5
3
IDS Classtypes
189
133
34
10
7
IDS Protocols
243
58
33
22
12
This rule detects unauthorized or anomalous outbound network connections from known AI agent runtime processes to LLM or API endpoints. It helps identify potential data exfiltration by monitoring for connections to destinations outside of an organization's approved allow-list for model providers, effectively catching scenarios where a compromised AI agent is prompted to relay sensitive data to an attacker-controlled endpoint.
Detects the suspicious combination of a file modification within Magento frontend or checkout JavaScript/template directories followed by an outbound network connection initiated by web server processes (e.g., Apache, Nginx, PHP). This pattern is consistent with the injection of a digital skimmer (e.g., Magecart style) and the subsequent exfiltration of stolen payment card data to an attacker-controlled endpoint.
Detects a suspicious sequence of events where a host performs multiple reconnaissance-style probes (health checks, documentation, or OpenAPI definitions) followed within 10 minutes by access to sensitive artifact-related URLs on the same remote host. This pattern is indicative of an attacker profiling a target server for metadata and then proceeding to exfiltrate files or sensitive artifacts.
Detects anomalous large-scale data export operations in Google BigQuery (via jobs.insert or jobs.query) performed by identities (service accounts, API keys) not previously observed in the environment. This activity is indicative of credential abuse where stolen third-party analytics or monitoring service tokens are utilized for illicit data exfiltration, a behavior consistent with tactics employed by threat actors such as ShinyHunters.
Detects an suspicious progression of activities originating from identified AI assistant/agent processes. The rule monitors for a chain of behaviors occurring within a 15-minute window: execution of an AI agent/tool, followed by host discovery (network/system enumeration), access to sensitive local credential files, archival of data, and outbound network communication to common file-sharing/exfiltration platforms.
Detects potential AI model extraction attacks where an adversary repeatedly queries a private model's inference API. By combining high-volume request counts with high input diversity, the rule identifies behavior indicative of an adversary constructing a labeled dataset to train a substitute, replicated model.
Detects a sequential pattern where a browser process (Chrome, Edge, or Safari) accesses an AI chat platform's conversation API, followed within 5 minutes by a network connection to a known unauthorized exfiltration destination (api.pbapi.xyz). This pattern suggests the potential use of a browser-based tool or extension (e.g., Poper Blocker or similar) to intercept and exfiltrate AI chat history.
Detects high-volume POST requests or traffic flagged by DLP mechanisms destined for known public generative AI platforms (e.g., OpenAI, Claude, Google Gemini). This rule identifies potential unauthorized transmission of sensitive or regulated data, such as PII or confidential information, to third-party AI services.
This rule detects potentially malicious bulk mailbox exfiltration operations (such as New-MailboxExportRequest, New-ComplianceSearch, or Search-Mailbox) performed by an account within 24 hours of experiencing a high or medium-risk sign-in event, suggesting post-compromise data harvesting.
This rule detects the suspicious archival of browser credential files (e.g., Login Data, Cookies, wallet.dat) or the transmission of data to common command-and-control (C2) services such as Telegram, Discord, or raw IP addresses using common system tools like PowerShell, curl, or certutil.
Detects an account performing a mass download or synchronization of files from SharePoint or OneDrive within a 30-minute window, occurring within two hours of a medium or high-risk Azure AD sign-in event. This pattern is indicative of potential account takeover and subsequent data exfiltration by an adversary using harvested credentials.
Detects instances where a file is downloaded or exfiltrated, followed by the deletion or alteration of its version history within a 7-day window. This behavior is consistent with post-theft activities aimed at obfuscating access logs or sanitizing stolen data by removing original versioning markers, often observed in insider threat or compromised account scenarios.
Detects potential account compromise by aggregating multiple high-fidelity indicators of adversary activity for a single user within a 72-hour window. The rule triggers when at least three distinct stages of an attack chain are identified, specifically: credential theft/infostealer activity, anomalous sign-in (token reuse/impossible travel), mailbox or OAuth configuration changes, and mass data exfiltration.
Detects HTTP POST requests to Telegram Bot API and Discord webhooks containing large, Base64-encoded strings within request bodies, which may indicate exfiltration of reconnaissance data or sensitive information.
Detects HTTP POST requests directed at common Large Language Model (LLM) chat completion and completion endpoints that are not associated with authorized OpenAI or Azure OpenAI services. This behavior may indicate an attempt to exfiltrate potentially sensitive corporate or proprietary data to third-party or unauthorized Shadow-AI platforms.
Detects network traffic to the Telegram Bot API where the request URI contains indicators of sensitive data exfiltration such as 'cookie', 'session', 'password', or 'credential'. This pattern is often associated with adversary-in-the-middle (AiTM) phishing kits (e.g., Evilginx2) exfiltrating stolen session tokens or credentials to an attacker-controlled Telegram bot.
Detects outbound network traffic from internal hosts to the domain 'skyleen.fr' over TLS/HTTPS, which is characteristic of credential exfiltration associated with the Sckit supply chain worm.
Detects a process reading credential store files (Login Data) from multiple Chromium-based browsers, immediately followed by an HTTP POST request to a specific exfiltration endpoint associated with the Psychedelic Stealer malware.
Detects anomalous network behavior where a source host initiates a high volume of DNS TXT record queries to an external domain within a short timeframe. Such patterns are indicative of data exfiltration or C2 communication tunneling through DNS protocol.
Detects unauthorized exfiltration of sensitive information, such as camera credentials or location data, directed to the Telegram Bot API as part of the 'Operation CameraSwarm' campaign.
Detects high-volume outbound network traffic (exceeding 50MB) directed towards known consumer-grade cloud storage and anonymous file-sharing services. This activity can indicate data exfiltration, as these services are frequently abused to bypass security controls while masking data movement within legitimate-appearing traffic.
Page 5 of 128