Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,686 detections
Filters
Last updated
All Time
Detection languages
1,342
389
264
219
197
Contributors
620
506
358
209
102
Categories
20,456
11,839
5,876
5,155
4,865
2,686
Platforms
1,168
638
452
382
359
Products / Services
593
445
403
264
229
MITRE Techniques
1,884
787
525
521
510
CVEs
11
5
5
5
3
IDS Classtypes
189
133
34
10
7
IDS Protocols
243
58
33
22
12
Detects anomalous activity where a single user or service principal downloads more than 5 Microsoft Teams meeting recordings within a 1-hour window. This behavior potentially indicates an insider threat or compromised account performing bulk harvesting of sensitive meeting content.
Detects outbound FTP STOR (Store) commands directed to external networks. This indicates that a host inside the local network is attempting to upload data to an external server. The rule uses a threshold to filter out isolated commands, triggering when 3 or more STOR commands are detected within 120 seconds, which is characteristic of data exfiltration or staging behavior.
This rule detects potential DNS exfiltration attempts by identifying DNS queries containing high-entropy subdomains of 51 characters or more, encoded in Base64. Adversaries may use long, encoded subdomains to tunnel data out of a network through the DNS protocol, bypassing traditional security controls.
Detects anomalous ICMP Echo Request packets (Type 8) directed towards external networks that contain a payload size greater than 128 bytes. Such anomalies are often indicative of ICMP tunneling, which may be leveraged by adversaries for command and control (C2) communication or data exfiltration.
This rule detects anomalous DNS query activity that may indicate command and control (C2) or data exfiltration over the DNS protocol. It monitors for three specific indicators: excessive query volume to a single domain family within a short timeframe, the use of abnormally long DNS subdomain labels, and the transmission of TXT record queries from endpoints not acting as designated DNS servers.
This rule detects DNS queries containing an exceptionally long subdomain label (50 or more characters). Such patterns are often indicative of DNS tunneling techniques where data is encoded within the subdomain portion of a DNS query to bypass network security controls or establish command-and-control channels.
This rule detects a sequence of behaviors indicative of credential theft followed by data staging and exfiltration. It identifies processes accessing sensitive browser credentials or KeePass database files, followed by the creation of a ZIP archive within user profile directories, and concludes with an outbound HTTPS connection to a non-trusted, non-Microsoft external destination by the same process.
Identifies PowerShell execution using 'Invoke-RestMethod' or 'Invoke-WebRequest' to perform HTTP POST operations containing 'multipart/form-data'. This pattern is frequently used to exfiltrate staged data or archives from a compromised host to an external web server.
This rule detects suspicious network connections originating from internal IP addresses to common service ports (DNS, SMB, RDP, WinRM) on remote, non-internal IP addresses. It flags instances where a single process on a device makes 10 or more such connections within an hour, which could indicate reconnaissance, lateral movement, or data exfiltration attempts.
This rule detects devices making a high volume of successful network connections to GitHub's API endpoints (api.github.com or api.releases). A count of 5 or more successful connections within an hour from a single device is considered suspicious and could indicate data exfiltration, automated tooling, or unusual development activity.
This rule detects successful network connections to known paste sites like Pastebin or Gist. Adversaries often use these services to host malicious code, exfiltrate data, or for command and control (C2) communications. Monitoring such connections can help identify potential data exfiltration attempts or the download of malicious content.
Detects repeated 'git clone' or 'git fetch' commands executed on a system within a short timeframe. This activity could indicate an adversary attempting to exfiltrate data from a code repository or staging environment, or rapidly pull down multiple repositories.
This rule identifies when a single account creates three or more files containing 'backup', 'export', or 'dump' in their filenames within a one-hour period. This activity could be indicative of data staging for exfiltration or an attempt to back up sensitive information prior to a malicious action.
This rule detects an unusually high volume of SharePoint sharing invitation creations or sharing setting modifications by a single user within an hour. This could indicate an attacker attempting to exfiltrate data or broadly share sensitive information.
Detects when a single account initiates a high volume of Office file (Word, Excel, PowerPoint) copy or move operations within a one-hour window. This could indicate data exfiltration or staging activities.
Detects cloud disk snapshot creation potentially for data exfiltration
Detects high-volume, rapid outbound network requests from Opera or Opera GX browser processes, characteristic of CSS attribute-selector trigram enumeration used in XS-Leak attacks to exfiltrate sensitive information from loaded web pages.
Detects network activity associated with the EKZ Stealer malware, specifically an HTTP POST request used to exfiltrate base64-encoded credentials to a known malicious destination at 83.138.53.110/service/save.php.
This rule detects activities associated with the NotDoor malware used by APT28 for email-based exfiltration. It specifically monitors for the creation of staging files in temporary directories, the use of Outlook.exe to establish external SMTP connections on common mail ports, and the transmission of emails to known adversary-controlled addresses.
Detects suspicious OpenProcess calls initiated by common user applications (explorer.exe, winword.exe, outlook.exe) targeting svchost.exe, followed by an outbound network connection from the target svchost.exe to the file sharing service filen.io within a 30-minute window. This behavior is indicative of process injection used to facilitate network communication or data exfiltration under the guise of a system process.
Detects malicious activities associated with Akira ransomware affiliates, including Active Directory enumeration using AdFind, data staging via WinRAR, and exfiltration attempts utilizing tools like WinSCP, rclone, or MEGAcmd. The rule also monitors for the presence of campaign-specific malware binaries.
Page 56 of 128