Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,686 detections
Filters
Last updated
All Time
Detection languages
1,342
389
264
219
197
Contributors
620
506
358
209
102
Categories
20,456
11,839
5,876
5,155
4,865
2,686
Platforms
1,168
638
452
382
359
Products / Services
593
445
403
264
229
MITRE Techniques
1,884
787
525
521
510
CVEs
11
5
5
5
3
IDS Classtypes
189
133
34
10
7
IDS Protocols
243
58
33
22
12
Detects Python processes spawned by development tools (VSCode, Cursor) or Node.js that are engaged in suspicious activities, specifically communicating with the Telegram Bot API or uploading large amounts of data, often accompanied by file staging (ZIP archive creation). This behavior is characteristic of the InvisibleFerret information stealer.
Detects the Yuta/Glove stealer malware (winupdate.exe) communicating with Discord webhooks or API endpoints. This behavior is indicative of data exfiltration or receipt of interactive RAT commands, such as shell, webcam, keylogger, and system tracing.
Detects network communication behavior indicative of Yuta or Glove Stealer malware, where suspicious processes (specifically 'winupdate.exe' in common staging directories or Python-based requests) exfiltrate data via HTTP POST requests to known attacker-controlled infrastructure platforms like Discord or Telegram.
This rule detects the execution of rclone.exe with command-line arguments indicative of data exfiltration to cloud storage providers (mega.nz, Dropbox, OneDrive) or via SFTP. This behavior is commonly associated with ransomware threat actors, such as those observed in the STAC4713 and STAC3725 campaigns (GOLD ENCOUNTER), who utilize rclone to stage and exfiltrate sensitive data prior to deploying ransomware.
This rule detects network connections to a specific Discord webhook URL and another suspicious domain (78smp.com/m/). This pattern is often associated with malware attempting to exfiltrate data or establish command and control (C2) via Discord webhooks, or other suspicious domains.
Detects outbound proxy traffic originating from identified AI and automation agent user-agents (e.g., ChatGPT, Perplexity, Claude, etc.) attempting to access sensitive URI paths, such as credential files, SSH keys, configuration files, or cloud-hosted secrets. This may indicate an attempt to exfiltrate sensitive data to or through AI platforms.
Detects potential DNS-based command and control (C2) or exfiltration behavior by monitoring for DGA-like domain patterns, high-volume DNS requests, and the use of command-line tools (nslookup.exe, dnscmd.exe) to perform TXT record lookups often associated with data exfiltration.
This rule detects HTTP POST requests containing a Content-Length header value indicating a body size exceeding 10MB. Large POST requests may indicate data exfiltration, large file uploads, or misuse of HTTP channels for data transfer to external destinations.
Detects DNS query traffic where the subdomain label length exceeds 50 characters and contains patterns consistent with Base64 or Hexadecimal encoding. This behavior is indicative of potential data exfiltration or command-and-control communication performed over the DNS protocol by tunneling data within query labels.
This rule detects large HTTP POST requests (greater than 10MB) originating from the internal network to external destinations, which may indicate bulk data exfiltration.
This rule identifies devices that send a large volume of data (over 100 MB) over HTTPS ports (443 or 8443) within a one-hour window. This activity could be indicative of data exfiltration, unauthorized large file transfers, or other suspicious network activity.
Detects a high volume of successful network connections to multiple unique cloud storage services (Dropbox, Box.com, OneDrive) from a single device and user account within an hour. This could indicate data exfiltration or unauthorized access to cloud storage.
This rule detects an unusual spike in 'Export' or 'Download' operations within Azure Activity logs by a single caller. It triggers when a user performs 5 or more such operations within an hour, which could indicate data exfiltration attempts or suspicious data access patterns.
This rule detects when a single user downloads 50 or more files from OneDrive within a one-hour period. This could indicate data exfiltration or unauthorized bulk access to sensitive information.
This rule detects when a single process account creates 5 or more files containing 'database', 'db', or '.sql' in their filenames within a one-hour window. This could indicate an attempt to stage, exfiltrate, or manipulate database files.
This rule detects an unusual spike in large file downloads from SharePoint by a single user within a one-hour window. It specifically looks for users downloading 5 or more files, each larger than 100MB, from SharePoint.
This rule detects unusually large network uploads from devices. It identifies successful network connections where individual transfers exceed 100MB and aggregates these transfers by account name and hour. The rule then flags any account that has uploaded a total of 1TB or more within a single hour. This pattern could indicate data exfiltration, unauthorized data synchronization, or other malicious activities involving significant data transfer volumes.
This rule detects an unusually high volume of file sharing events from a single user in OneDrive within a one-hour window. Specifically, it looks for five or more 'SharingSet' or 'AnonymousLinkCreated' operations by the same UserId within an hour, which could indicate data exfiltration or unauthorized sharing.
This rule detects network connections to a specific Discord webhook URL and another suspicious domain (78smp.com/m/). This pattern is often associated with malware attempting to exfiltrate data or establish command and control (C2) via Discord webhooks, or other suspicious domains.
Detects the exploitation or configuration manipulation of the Firefox browser.smartwindow.enabled feature, which can be abused by an attacker to exfiltrate sensitive browser data such as history, tab URLs, and secret query-string parameters to a remote endpoint. The rule monitors for network connections containing known exfiltration path signatures, connections to hardcoded PoC server addresses, or the modification of configuration settings related to the SmartWindow feature.
Detects unauthorized or suspicious processes reading sensitive credential files (AWS, .env, etc.) and subsequently initiating a successful network connection to an external destination within a 5-minute window. This behavior is a common indicator of credential exfiltration.
Page 52 of 128