Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,686 detections
Filters
Last updated
All Time
Detection languages
1,342
389
264
219
197
Contributors
620
506
358
209
102
Categories
20,456
11,839
5,876
5,155
4,865
2,686
Platforms
1,168
638
452
382
359
Products / Services
593
445
403
264
229
MITRE Techniques
1,884
787
525
521
510
CVEs
11
5
5
5
3
IDS Classtypes
189
133
34
10
7
IDS Protocols
243
58
33
22
12
Detects instances where a process not associated with standard SSH operations (e.g., ssh, scp, git) accesses SSH private key files, followed by an outbound network connection to a non-private IP address within a 5-minute window. This behavior is indicative of credential theft and subsequent exfiltration of sensitive SSH keys, often associated with infostealer malware.
Detects network connections to a specific suspicious IP address (94.156.181.89) or to domains associated with Cloudflare Tunnel (.trycloudflare.com). This could indicate command and control activity, data exfiltration, or other malicious network communication.
Detects outbound HTTP POST requests to file.io originating from a Go-based HTTP client, consistent with the GopherWhisper APT C2 or exfiltration activity.
Detects outbound HTTP POST requests containing keywords indicative of credential and data theft associated with VBV Stealer malware, specifically looking for fields related to passwords, cookies, or wallets in the request body.
Detects outbound HTTP POST requests to file.io originating from a Go-based HTTP client, consistent with the GopherWhisper APT C2 or exfiltration activity.
Detects outbound HTTP POST requests containing keywords indicative of credential and data theft associated with VBV Stealer malware, specifically looking for fields related to passwords, cookies, or wallets in the request body.
Correlates the execution of known data exfiltration utilities (rclone, mega-cmd, filezilla) passing configuration files or remote cloud repository targets dynamically.
Identifies AstarionRAT establishing HTTP POST connections to transmit the compressed archive containing the stolen browser and keylogger data. This rule correlates network HTTP POST requests with the creation of zip files by the same process, indicating potential data exfiltration.
This rule correlates rapid file modifications (potential encryption or mass deletion) with the execution of commands known to inhibit system recovery (e.g., deleting shadow copies or modifying boot recovery settings) and significant outbound network data transfers from the same host. This pattern is characteristic of ransomware deployment.
Detects outbound network connections to major Large Language Model (LLM) API endpoints (OpenAI, Google, Anthropic) initiated by processes not explicitly identified as standard web browsers or command-line utilities. This pattern may indicate automated data exfiltration ('prompt stealing' or unauthorized access to corporate data) using custom or malicious tools executing from suspicious directories like temp, appdata, or public folders.
Detects the use of screen capture utilities such as ffmpeg, grim, scrot, or xwd, which are often used by the MYRA RAT to capture live desktop sessions for exfiltration.
This rule detects suspicious activities related to AWS S3 buckets that could indicate a bucket hijacking attempt or unauthorized replication to an external account. Specifically, it looks for two scenarios: 1) an S3 bucket being deleted and then recreated by a different AWS account within a one-hour window, suggesting a namespace hijacking, or 2) an S3 bucket being deleted while a PutBucketReplication event references an external AWS account, indicating an attempt to exfiltrate data or maintain access through replication.
Detects network connections initiated by Windows Nearby Sharing processes (quick_share.exe, nearby_sharing.exe, or NearbyShare.exe) to non-standard ports, potentially indicating unauthorized file transfers or exfiltration over unusual network channels.
This rule detects the creation of a '_vault.zip' archive, which is characteristic of the VVS Stealer malware, followed by network activity to Discord from the same process within a 15-minute window. VVS Stealer uses these archives to store stolen browser data (passwords, cookies, history, autofill) before exfiltrating it, often via Discord webhooks.
Detects outbound web traffic directed towards common password management services (e.g., 1Password, LastPass, Bitwarden) originating from user agents associated with AI and LLM tools (e.g., OpenAI, Claude, Copilot). This combination of destinations and user agents is highly anomalous and may indicate potential credential exfiltration or interaction with automated agents acting on behalf of a user to access sensitive vault data.
Detects the use of curl.exe to upload files to the temp.sh service while simultaneously passing the resulting temp.sh URL within the User-Agent string to a C2 server. This specific exfiltration and beaconing TTP was observed in the Notepad++ supply chain attack.
This rule detects potential bulk data exfiltration by monitoring for outbound HTTP POST requests to non-standard ports where the Content-Length header indicates a transfer of over 10 megabytes. This behavior can be indicative of an attacker exfiltrating large amounts of sensitive data from the network to an external server.
Detects outbound HTTP POST requests where the Content-Length is at least 10MB and the Content-Type header indicates the transfer of archived data (zip or x-tar). This pattern is often associated with the staging and exfiltration of compressed sensitive data from an internal host to an external network destination.
Detects large HTTP POST requests (over 5MB) directed at external hosts that utilize multipart or chunked encoding, which are commonly used to obfuscate or stream large volumes of data during an exfiltration event.
Detects DNS query traffic where the subdomain label length exceeds 50 characters and contains patterns consistent with Base64 or Hexadecimal encoding. This behavior is indicative of potential data exfiltration or command-and-control communication performed over the DNS protocol by tunneling data within query labels.
This rule detects potential bulk data exfiltration by monitoring for outbound HTTP POST requests to non-standard ports where the Content-Length header indicates a transfer of over 10 megabytes. This behavior can be indicative of an attacker exfiltrating large amounts of sensitive data from the network to an external server.
Page 71 of 128