Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,686 detections
Filters
Last updated
All Time
Detection languages
1,342
389
264
219
197
Contributors
620
506
358
209
102
Categories
20,456
11,839
5,876
5,155
4,865
2,686
Platforms
1,168
638
452
382
359
Products / Services
593
445
403
264
229
MITRE Techniques
1,884
787
525
521
510
CVEs
11
5
5
5
3
IDS Classtypes
189
133
34
10
7
IDS Protocols
243
58
33
22
12
Detects browser connections to the Bing Search by Image endpoint, which can be exploited as an SSRF proxy to bypass Content Security Policies (CSP) and exfiltrate data, as seen in the SearchLeak attack.
Detects the creation or modification of an email compliance or forwarding rule containing the specific typo "Patroit". This indicator is associated with the UNC6508 threat actor's data exfiltration activities via silently BCC-forwarding sensitive emails.
Detects IDE processes creating ZIP archives in temporary directories, which can indicate exfiltration of cryptocurrency wallets. The rule specifically looks for 'Code.exe' (VS Code) or 'cursor.exe' creating '.zip' files in common temporary paths like 'AppData\Local\Temp' or '/tmp/'.
Detects a banking trojan (Banana RAT) attempting to intercept or replace PIX QR payment data from the clipboard, browser, or screen content. The rule looks for processes with names indicative of the RAT (banana, client, update, service) and command-line arguments related to PIX, QR codes, or clipboard manipulation.
Detects the execution of VILE ransomware by identifying specific dropped file artifacts (vile_icon.ico, vile_deadlines.json, vile_user_files.zip) and correlating these file events with outbound network connections made by the same process to remote non-private IP addresses, indicating the likely exfiltration of harvested system metadata.
Identifies Node.js initiating exfiltration connections to the C2 with parameters indicating disabled TLS certificate validation.
Detects anomalous network communication with a known C2 domain associated with the Miasma worm, or attempts by JavaScript runtime processes (node, bun) to access sensitive developer-related files (SSH keys, cloud credentials, browser data) without an authorized IDE parent process.
Detects the final curl command transmitting archived credentials to a remote C2 via a multipart form-data upload, specifically looking for curl commands that use '-X POST' and '-F file=@/tmp/.*.zip' to upload a zip file from the /tmp directory.
Detects curl POST requests sending JSON telemetry to attacker endpoints post-infection, specifically looking for patterns associated with the ClickFix campaign.
Detects the Silent Rotor malware transmitting collected system profile as a serialized JSON blob to the C2 domain cdn.kleymarket.ru. The detection specifically looks for network connections to this domain initiated by a process named 'Подтверждение заказа продукции ЦАИ.exe'.
Identifies network communication initiated by Microsoft Word (WINWORD.EXE) to Discord webhooks, which could indicate an attempt to exfiltrate stolen information, such as One-Time Passwords (OTPs), often associated with phishing campaigns.
Detects data exfiltration by identifying TCP network connections over Port 53 (DNS) originating from non-standard binaries, bypassing layer 7 firewall inspections.
Detects anomalous screen capture activity associated with StealC malware. It identifies when a non-UI process creates a JPEG file within the system temporary directory followed immediately by an outbound network connection from the same process, which is indicative of the malware capturing a screenshot and staging it for exfiltration.
This rule detects the execution of cloud transfer tools such as rclone, WinSCP, Dropbox, OneDrive, or curl.exe when their command line arguments indicate the transfer of mailbox-related files (PST, OST, or temporary files with 'ts_' prefix) and include keywords like 'copy', 'sync', 'put', 'upload', or 'transfer'. The rule focuses on the causality chain to identify the actor and processes involved in such activities, which could indicate data exfiltration.
Detects use of Discord webhooks for covert C2 or data exfiltration
This rule detects potential OAuth token abuse by correlating credential consent grants with subsequent unusual cloud access patterns from different geographic locations. It looks for activities like adding a service principal, adding OAuth2 permission grants, or consenting to an application, followed by access to specific cloud applications (Salesforce, Drift, Slack, Microsoft 365, Workday) from an IP address that does not match the IP address from which the consent was granted. The rule aggregates these events and triggers if there are at least 4 related events within a 6-hour window.
Correlates processes executing commands containing 'megalodon' with outbound network connections to a specific C2 IP address (216.126.225.129). This rule aims to detect data exfiltration or command and control communication associated with the Megalodon malware.
Identifies web server processes initiating network connections to the credential-stealing generate.2faplugin.org domain. This activity is indicative of a supply chain compromise targeting ShapedPlugin, where backdoored pro plugins are distributed via official channels, leading to data exfiltration.
Correlates the execution of the initial dropper script (setup.cjs) to the hardcoded C2 IPs, indicating potential compromise by the Mastra NPM malware.
This rule looks for sensitive-looking values appearing in a publicly visible Claude workflow summary on GitHub. Public summaries can be indexed and copied quickly. Revoke any exposed credentials and restrict summary visibility. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Detects an administrative forwarding, redirect, BCC, or content compliance rule change when Defender for Cloud Apps identifies attributes that are uncommon for the account. UNC6508 replayed harvested credentials to access an administrator account before creating its covert exfiltration rule. The anomaly requirement increases confidence while preserving coverage for infrastructure that is not recognised as a proxy.
Page 77 of 128