Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,686 detections
Filters
Last updated
All Time
Detection languages
1,342
389
264
219
197
Contributors
620
506
358
209
102
Categories
20,456
11,839
5,876
5,155
4,865
2,686
Platforms
1,168
638
452
382
359
Products / Services
593
445
403
264
229
MITRE Techniques
1,884
787
525
521
510
CVEs
11
5
5
5
3
IDS Classtypes
189
133
34
10
7
IDS Protocols
243
58
33
22
12
Detects the use of the FTP STOR command to transfer files with sensitive extensions (.docx, .pdf, .xlsx, .zip, .7z) to external networks. This behavior is indicative of potential data exfiltration via an unencrypted alternative protocol.
Detects repeated use of the FTP 'STOR' command to transmit data to an external host within a short timeframe. The STOR command is used in the File Transfer Protocol (FTP) to upload a file to the server. An unusual frequency of this command toward external destinations may indicate data exfiltration.
Detects data transfer to potentially attacker-controlled cloud accounts
This rule detects potentially malicious DNS traffic where queries contain exceptionally long, encoded, or randomized subdomains. Attackers often use these patterns to exfiltrate data from a target network, bypassing traditional security controls by encapsulating information within DNS requests (DNS tunneling). The detection looks for DNS queries exceeding 100 bytes in length with specific character patterns indicative of Base64 or similar encoding.
Detects suspicious patterns of LLM API usage by monitoring outbound traffic to major LLM providers (OpenAI, Anthropic, Google, DeepSeek, Mistral, Cohere). The rule identifies potential API key theft ('LLMjacking') by flagging high request volumes from single keys, usage of the same key across multiple distinct source IP addresses, and direct outbound traffic bypassing established proxy/gateway configurations.
Detects HTTP traffic patterns consistent with data exfiltration to major cloud storage providers (AWS S3, Azure Blob Storage, Google Cloud Storage) using common command-line interface tools like rclone, aws-cli, and AzCopy.
Detects potential DNS-based command and control (C2) or exfiltration behavior by monitoring for DGA-like domain patterns, high-volume DNS requests, and the use of command-line tools (nslookup.exe, dnscmd.exe) to perform TXT record lookups often associated with data exfiltration.
Detects potential exploitation of Firefox SmartWindow (CVE-2026-20253) involving token exfiltration via specific URL patterns, unauthorized configuration preference tampering (e.g., smartwindow.enabled, smartwindow.apiKey), or modifications to browser configuration files (prefs.js, user.js) by the Firefox process.
This rule detects users uploading a high volume of files (50 or more within an hour) to SharePoint or OneDrive. This activity could indicate data exfiltration or unauthorized mass data transfer.
This rule detects when an account copies five or more files, each larger than 50MB, within a one-hour period. This activity could indicate data exfiltration or staging for exfiltration.
This rule detects when a single process account creates or copies 10 or more files to a removable media device (e.g., USB drive) within a one-hour window. This behavior can be indicative of data exfiltration attempts.
This rule detects potential credential theft from web browsers (Edge/Chrome) by monitoring access to the 'Login Data' SQLite database file. It correlates file access events with subsequent outbound HTTPS connections to non-Microsoft and non-Google domains initiated by the same browser process within a 10-minute window, which is indicative of exfiltration of stolen browser credentials.
Detects indicators associated with the 'smart_window' campaign targeting Firefox, which attempts to exfiltrate browser history and page content via unauthorized registry modifications, malicious file artifacts, and specific network communication patterns to localhost or external URLs.
Detects anomalous, high-volume data transfers to Telegram API endpoints (api.telegram.org, specific IP ranges), which is indicative of data exfiltration by malware such as KuinaExtractor. The rule monitors for cumulative outbound traffic exceeding 500MB within a 1-hour session window per process.
This rule detects executions of 'winscp.exe' that are spawned by suspicious parent processes commonly associated with web servers or command interpreters (e.g., w3wp.exe, httpd.exe, powershell.exe). It also flags instances where WinSCP is invoked with command-line arguments indicative of automated scripts, custom configuration files, or remote transfer protocols (SFTP/SCP/FTP), which may indicate data staging or exfiltration activities.
Detects network connections attempting to access Kubernetes API endpoints related to secrets. This could indicate an adversary trying to enumerate or exfiltrate sensitive credentials from a Kubernetes cluster.
Detects upload of executable files to file sharing services for staging
Detects the use of PowerShell to perform system reconnaissance commands and exfiltrate the collected data using HTTP POST requests (curl or Invoke-WebRequest). This behavior is often associated with post-compromise activity and is flagged with higher severity when initiated from an IIS worker process or when using encoded PowerShell arguments.
Detects Python processes spawned from development tools (Node.js, VS Code, Cursor) that perform suspicious file access to browser credential stores (e.g., Login Data, cookies.sqlite) and subsequently initiate significant outbound network POST requests, characteristic of browser-based credential harvesting and exfiltration.
Identifies network connections to known ShinyHunters IP addresses or domains associated with the recent Oracle PeopleSoft exploitation campaign. This rule monitors both endpoint network events and perimeter firewall/proxy logs for outbound communication to the specified malicious infrastructure.
Detects network connections to Google Cloud services (calendar.google.com, googleapis.com) over port 443 originating from processes other than known web browsers or standard Google background applications. This behavior may indicate unauthorized tools, custom scripts, or malware using Google services for command and control or data exfiltration.
Page 54 of 128