Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,686 detections
Filters
Last updated
All Time
Detection languages
1,342
389
264
219
197
Contributors
620
506
358
209
102
Categories
20,456
11,839
5,876
5,155
4,865
2,686
Platforms
1,168
638
452
382
359
Products / Services
593
445
403
264
229
MITRE Techniques
1,884
787
525
521
510
CVEs
11
5
5
5
3
IDS Classtypes
189
133
34
10
7
IDS Protocols
243
58
33
22
12
Detects outbound proxy requests to the Bing Search-by-Image endpoint where the imgurl parameter is used to perform a server-side request forgery (SSRF). Attackers use this to bypass security controls by forcing Microsoft services to fetch an external, malicious URL containing exfiltrated data within the path, as seen in the SearchLeak (CVE-2026-42824) exploit chain.
This rule detects outbound HTTP requests to Bing's 'searchbyimage' functionality that contain an image URL pointing to a domain outside of Microsoft or Bing. This behavior is associated with a potential data exfiltration technique (referenced as CVE-2026-42824) where internal information is encoded into an image URL and passed to an external, attacker-controlled, or third-party web service via the Bing search engine to bypass traditional network egress controls.
Detects the execution of 'aws sts get-caller-identity' combined with 'curl' operations utilizing stdin data piping, often associated with unauthorized identity enumeration and data exfiltration in cloud-native environments, particularly when initiated from developer tool contexts like Amazon Q/MCP configurations.
Detects a malicious Chrome extension exfiltrating keystrokes entered into the browser's Omnibox. The rule monitors for high-frequency GET requests (indicative of keystroke-by-keystroke transmission) from chrome.exe to a specific C2 domain (perplexity-ai.online), correlated with DNS resolution of that domain within the same session.
Detects potential data exfiltration by monitoring interpreter processes (Python, Node.js) that access sensitive local credential/configuration files and subsequently connect to known cloud storage or code repository APIs (Dropbox, GitHub, Google Cloud). The rule correlates file access events with network connection activity.
Detects network connections from internal endpoints to Filen.io cloud storage domains and subdomains. The rule specifically flags interactions involving common API endpoints for file operations (upload, download, directory listing) as 'Critical' risk, while generic traffic to the domain is classified as 'High' risk.
Detects suspicious modifications to GitHub Actions workflows, such as unauthorized file overwrites, commits by bot impersonation identities (e.g., dependabot, renovate), or the upload of sensitive artifacts like 'format-results.txt'. These activities are indicative of IronWorm-style attacks targeting CI/CD pipelines to exfiltrate secrets via build artifacts.
Detects suspicious behavior associated with ADNotificationManager.exe, including DLL side-loading of vcruntime140_1.dll, loading of DLLs from user-writable directories (potential DLL hijacking), and the spawning of Rclone.exe for potential data exfiltration via SFTP.
Detects BQTLock (BaqiyatLock) ransomware activities involving the exfiltration of stolen data, credentials, or infection reports. The rule identifies suspicious outbound network connections to known C2-enabling web services (Telegram Bot API and Discord webhooks) initiated by the BQT.exe or start.exe processes, which are typical indicators of this ransomware variant.
This rule detects high-volume or repeated outbound connections to Mega cloud storage domains (mega.nz, mega.co.nz, etc.) by processes that are not identified as standard web browsers. Such activity may indicate data exfiltration, automated file staging, or unauthorized use of cloud storage services.
Detects DNS queries to Gofile infrastructure originating from processes executing from typically transient directories (AppData or Temp). This behavior is characteristic of VILE ransomware, which stages compressed user files in these directories before exfiltrating them via Gofile as part of a double-extortion strategy.
Detects high-volume data access or exfiltration from Azure/Office 365 cloud environments via common scripting/automation user-agents. The rule monitors API requests to users, mail, drive, or files endpoints by non-standard clients (e.g., python, curl, Go) from previously unseen locations, calculating a risk score based on the number of endpoints accessed and the total data volume.
Detects the use of the rclone tool with data transfer commands (copy, move, sync, copyto, moveto) originating from a GoAnywhere server process or common interactive shell processes (cmd.exe, powershell.exe). This activity is highly suspicious and could indicate data exfiltration.
This query detects multiple TTPs associated with the Storm-2561 campaign that uses SEO poisoning to distribute fake VPN clients for credential theft. It looks for known file hashes, a specific code-signing certificate, malicious DLL side-loading and C2 communication patterns.
This rule detects devices making a high volume of successful network connections to GitHub's API endpoints (api.github.com or api.releases). A count of 5 or more successful connections within an hour from a single device is considered suspicious and could indicate data exfiltration, automated tooling, or unusual development activity.
This rule detects network connections to known cloud storage, file hosting, and webhook services (Discord, Pastebin, Dropbox, Telegram, AnonFiles) initiated by processes other than standard web browsers. Such behavior is often indicative of data exfiltration or C2 activity using legitimate web services to blend in with normal traffic.
Detects DNS queries to GitHub API domains originating from non-standard or potentially spoofed process names associated with various AI tools, which may indicate data exfiltration or unauthorized interaction with repositories.
Detects network connections initiated by Windows Nearby Sharing processes (quick_share.exe, nearby_sharing.exe, or NearbyShare.exe) to non-standard ports, potentially indicating unauthorized file transfers or exfiltration over unusual network channels.
Detects DNS queries to GitHub API domains originating from non-standard or potentially spoofed process names associated with various AI tools, which may indicate data exfiltration or unauthorized interaction with repositories.
Detects outbound web traffic directed towards common password management services (e.g., 1Password, LastPass, Bitwarden) originating from user agents associated with AI and LLM tools (e.g., OpenAI, Claude, Copilot). This combination of destinations and user agents is highly anomalous and may indicate potential credential exfiltration or interaction with automated agents acting on behalf of a user to access sensitive vault data.
Detects high-volume file writes or the use of common command-line copy utilities (xcopy, robocopy, copy) targeting removable drive paths (E-G:). This behavior is often indicative of data staging or exfiltration activities.
Page 53 of 128