Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,686 detections
Filters
Last updated
All Time
Detection languages
1,342
389
264
219
197
Contributors
620
506
358
209
102
Categories
20,456
11,839
5,876
5,155
4,865
2,686
Platforms
1,168
638
452
382
359
Products / Services
593
445
403
264
229
MITRE Techniques
1,884
787
525
521
510
CVEs
11
5
5
5
3
IDS Classtypes
189
133
34
10
7
IDS Protocols
243
58
33
22
12
Detects the Ghazwa spyware, attributed to APT36, querying sensitive Android system resources (CallLog and SMS Content Providers) from an application that is not a native dialer or messaging app. The rule further correlates this data access with subsequent outbound network activity, indicating potential data exfiltration.
Detects evidence of the 'smart_window' campaign, which exploits Firefox's SmartWindow feature to exfiltrate private browsing URLs. The rule identifies suspicious outbound network requests to attacker-controlled endpoints containing specific query parameters, the creation of known PoC artifact files, and the spawning of unexpected child processes by the Firefox browser.
Detects potential data exfiltration from Microsoft 365 Copilot sessions where the Bing 'Search by Image' functionality is abused as an SSRF proxy. The rule identifies network requests containing external URLs within the 'imgurl' parameter, occurring shortly after Copilot activity, suggesting that internal or sensitive data (such as emails, calendar items, or MFA context) is being transmitted to an unauthorized external endpoint.
Detects anomalous Firefox behavior consistent with CVE-2026-20253 exploitation, including unauthorized modification of Smart Window browser preferences (e.g., enabling the feature or redirecting the API endpoint) and suspicious child process creation following potential URL exfiltration events.
This rule detects successful configuration modifications to diagnostic settings or storage services where the destination resource is identified as being outside of the organization's trusted subscriptions or expected storage naming conventions. This activity may indicate an adversary attempting to exfiltrate logs or data to an attacker-controlled storage account.
Detects instances where 'node.exe' is observed copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories. This activity is indicative of data staging or exfiltration, specifically linked to the 'protocal.cjs' backdoor from the 'easy-day-js' supply chain attack.
Detects instances where a process, other than known benign applications, writes a screen capture image file (BMP, JPG, JPEG, or PNG) to a temporary directory, followed by a network connection to an external IP address within two minutes by the same process.
This rule detects the BQTlock ransomware behavior of capturing desktop screenshots using suspected malicious processes ('BQT.exe', 'start.exe') and attempting to exfiltrate the captured data via the Telegram API using 'sendPhoto' or 'sendDocument' commands.
This rule detects a suspicious volume of file copy activity (over 200 files) to a non-local drive (potentially a removable/USB device) occurring within 24 hours of an account being deleted or disabled on the same host. This pattern may indicate an insider threat or an adversary attempting to exfiltrate sensitive data shortly before or after losing authorized access to an account.
This rule detects a suspicious volume of file copy activity (over 200 files) to a non-local drive (potentially a removable/USB device) occurring within 24 hours of an account being deleted or disabled on the same host. This pattern may indicate an insider threat or an adversary attempting to exfiltrate sensitive data shortly before or after losing authorized access to an account.
Detects instances where node.js or npm processes access multiple sensitive configuration or credential files (such as .aws/credentials, .npmrc, .pypirc, .gitconfig, or docker configs) and subsequently perform DNS queries against known malicious or suspicious C2 domains.
This rule detects potential brute force attacks against Microsoft Exchange Outlook Web App (OWA) by monitoring for a high volume of 401 Unauthorized status codes from non-internal IP addresses. It also correlates these authentication events with subsequent post-authentication actions, specifically identifying mailbox logins followed by mailbox searching or export requests, which may indicate account compromise and unauthorized data collection or exfiltration.
This rule detects potential DNS exfiltration attempts by monitoring DNS query responses for specific keywords ('exfil', 'data', 'c2') in the remote DNS name. It flags devices that make 20 or more such suspicious DNS queries within an hour, indicating a high volume of potentially malicious DNS activity often associated with DNS tunneling or data exfiltration.
This rule detects network connections to known cloud storage, file hosting, and webhook services (Discord, Pastebin, Dropbox, Telegram, AnonFiles) initiated by processes other than standard web browsers. Such behavior is often indicative of data exfiltration or C2 activity using legitimate web services to blend in with normal traffic.
This rule detects common web application processes (such as nginx, python, node, etc.) accessing the /proc/[pid]/environ file, which contains environment variables that may include sensitive information like credentials or configuration secrets. The rule correlates this access with subsequent external network connections initiated by the same process, which is highly indicative of data exfiltration after sensitive information has been retrieved.
Detects anomalous network activity from browser renderer subprocesses (chrome.exe/msedge.exe) correlated with concurrent file system access to sensitive browser credential stores (Login Data/Cookies). The rule identifies high-frequency outbound connections following or occurring during access to these files, which is a common indicator of credential exfiltration performed by malicious browser extensions or injected scripts.
Detects high-frequency access to sensitive web paths (e.g., /admin, /vault, /credentials) from common web browsers on a device. This activity may indicate malicious credential harvesting, administrative panel enumeration, or sensitive data exfiltration performed by an adversary or malicious browser extension.
Detects execution and network activity associated with the NUKESPED (ThreatNeedle) backdoor component identified as 'zlrenu8.exe'. The rule monitors for outbound network connections to Fastly CDN infrastructure, which is frequently used by this actor for command-and-control or data exfiltration, as well as file operations within the 'ProgramData' directory indicative of staging activity.
Detects high-frequency access to sensitive web paths (e.g., /admin, /vault, /credentials) from common web browsers on a device. This activity may indicate malicious credential harvesting, administrative panel enumeration, or sensitive data exfiltration performed by an adversary or malicious browser extension.
Detects anomalous bulk configuration data collection from Cisco vManage via REST API endpoints typically used by UAT-8616. The rule identifies repeated HTTP GET requests to critical configuration, device, and system information endpoints on port 8443, which may indicate an attacker attempting to export SD-WAN configuration data following an exploitation event.
Detects the use of the rclone tool with data transfer commands (copy, move, sync, copyto, moveto) originating from a GoAnywhere server process or common interactive shell processes (cmd.exe, powershell.exe). This activity is highly suspicious and could indicate data exfiltration.
Page 55 of 128