Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,686 detections
Filters
Last updated
All Time
Detection languages
1,342
389
264
219
197
Contributors
620
506
358
209
102
Categories
20,456
11,839
5,876
5,155
4,865
2,686
Platforms
1,168
638
452
382
359
Products / Services
593
445
403
264
229
MITRE Techniques
1,884
787
525
521
510
CVEs
11
5
5
5
3
IDS Classtypes
189
133
34
10
7
IDS Protocols
243
58
33
22
12
Detects outbound network connections to 'filev2.getsession.org', a known Miasma payload hosting and exfiltration domain. This domain has been associated with Miasma malware for command and control and data exfiltration activities.
This rule detects potential session token leakage through network proxy responses. It specifically looks for network events where the action type is 'NetworkSignatureInspected', the remote port is 21 (commonly FTP), and the remote URL contains keywords indicative of session tokens such as 'session', 'cookie', 'JSESSIONID', 'PHPSESSID', or 'ASP.NET_SessionId'. This could indicate a vulnerability where session information is inadvertently exposed in proxy logs or network traffic.
This rule detects network connections where the remote URL contains keywords commonly associated with financial transactions or sensitive financial information, such as 'neft', 'rtgs', 'imps', 'gst', 'pan', and 'ifsc'. This could indicate data exfiltration, unauthorized access to financial systems, or other malicious activities targeting financial data.
Detects extraction of Azure Storage account keys (ListKeys) used to facilitate programmatic, static-auth data exfiltration.
Detects large data transfers occurring outside normal business hours
Targets mailbox export naming and immediate use of cloud transfer tools such as rclone, WinSCP, Dropbox, or OneDrive. The UDM rule retains principal and target context for correlation.
This rule detects suspicious bulk access and transfer behavior targeting sensitive files, which could indicate data exfiltration. It identifies scenarios where a single account accesses a large number of files, totaling a significant size, within a short timeframe. The rule specifically looks for common sensitive file types such as spreadsheets, documents, PDFs, SQL databases, and backup files. This pattern is often associated with ransomware groups performing data leak extortion without encryption.
Detects a non-Discord process preparing multipart attachment data from a local path for upload through a messaging API. This behavior is indicative of malware like EchoCreep exfiltrating data via messaging platforms.
SYSTEM-Context PST or OST Collection
Cortex XDR
This rule detects suspicious access to Outlook data files (.pst or .ost) by processes running in the SYSTEM context, excluding legitimate Outlook-related processes. It focuses on identifying non-standard applications or scripts attempting to collect mailbox data, potentially indicating data exfiltration or unauthorized access. The rule leverages causality fields for enhanced investigation.
Searches for outbound GET requests containing specific parameter structures used to label harvested metadata sources, indicative of data exfiltration via the Stitch-SDK.
Detects curl commands transmitting harvested GitHub tokens (ghp_ prefix) in the request body, representing the final exfiltration stage of gh-token-monitor.
Detects rclone remote configuration or config file creation when the binary is running from a portable user writable location, such as Downloads, Temp, AppData, Desktop, /tmp/, or /var/tmp/. This activity can indicate an attempt to exfiltrate data to cloud storage services.
Identifies network traffic to the attacker logging server endpoint ey.php initiated by the wrapper ._cache_GAME1.exe, which is associated with malicious Steam wallpapers.
Detects the threat actor clearing the staging archives securely via sdelete or forcefully via del /f /q immediately post-exfiltration. This rule correlates process execution of 'cmd.exe' or 'sdelete.exe' with specific command-line arguments targeting archive files (zip, rar, 7z) and a preceding network connection to a remote IP, indicating potential data exfiltration followed by anti-forensic cleanup.
Detects the creation of localized staging directories with suspicious names in public paths, used to temporarily hold compressed data before exfil. The rule specifically looks for folder creations under 'C:\Users\Public\' with names like 'Exfil', 'Data', 'Staging', or 'Dump'.
This rule detects when 'pythonw.exe' performs a high volume of distinct database file reads (5 or more) within a 3-minute window. This behavior is indicative of potential credential harvesting or data exfiltration by malicious Python scripts, as described in the referenced blog post about threat actors using AI hype in social engineering campaigns.
Detects patterns indicative of DPAPI key exfiltration, specifically looking for the strings 'Local State', 'CryptUnprotectData', '/Key', and 'access_token' within a file or process memory. This combination suggests an attempt to decrypt and exfiltrate credentials or tokens.
Detects rclone copy, sync, move, or copyto operations with options commonly used for unattended bulk transfer, indicating potential data exfiltration to cloud storage.
Detects exfiltration of sensitive data pushed to GitHub repositories
Detects bulk export of CRM customer data for collection and theft
Detects bulk download of AWS S3 objects indicating cloud data theft
Page 78 of 128