Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,686 detections
Filters
Last updated
All Time
Detection languages
1,342
389
264
219
197
Contributors
620
506
358
209
102
Categories
20,456
11,839
5,876
5,155
4,865
2,686
Platforms
1,168
638
452
382
359
Products / Services
593
445
403
264
229
MITRE Techniques
1,884
787
525
521
510
CVEs
11
5
5
5
3
IDS Classtypes
189
133
34
10
7
IDS Protocols
243
58
33
22
12
This rule detects anomalous network connections originating from common communication applications (Teams, Slack, Discord, Skype) to non-standard ports (not 80, 443, 8080, 8443) and to IP addresses not typically associated with Microsoft or other major cloud providers (e.g., not starting with 13. or 51.). It specifically looks for a high volume of such connections (10 or more within an hour) from a single process on a device, which could indicate protocol tunneling or the use of these applications for command and control.
Hunts for the malware compressing the collected host and browser data into a temporary .zip file prior to network exfiltration. Specifically looks for file creation events of .zip files with a specific naming convention (8-15 alphanumeric characters) in common temporary directories, initiated by 'AutoIt3.exe'.
Identifies the hallmark behavior of AgentTesla (frequently delivered via tax lures) injecting into RegAsm and attempting SMTP/FTP exfiltration.
Identifies Storm-1175 utilizing the rclone utility (often renamed) with MEGA or Mega-CMD configurations to exfiltrate vast data troves before encryption.
Detects a persistent process creating similarly sized outbound transfers at regular intervals after staging local results, indicative of the Kazuar malware's exfiltration behavior. The rule identifies processes with significant outbound network traffic (bytes > 10000), aggregates this traffic over 15-minute intervals, and then looks for processes that exhibit consistent outbound activity with intervals between 10 and 20 minutes (600 to 1200 seconds).
This rule detects repeated access attempts (read or write) to files or directories commonly associated with software build artifacts (e.g., 'build', 'release', 'artifact', 'bin', 'dist'). It specifically looks for Security Event ID 4656, which indicates a handle to an object was requested, and filters out common system accounts to focus on user-initiated access. A high number of access attempts (5 or more) within an hour by a non-system user to these sensitive object names could indicate an attempt to compromise or exfiltrate software supply chain components.
This rule detects potential ransomware activity by identifying a combination of three distinct behaviors occurring on a single endpoint within a short window: high-volume file modifications (indicative of file encryption), deletion of system recovery resources (e.g., volume shadow copies, backup catalogs), and high-frequency network activity (indicative of data exfiltration). The rule uses cross-event correlation to reduce false positives by requiring all three signals to be present.
Detects references to 'evisa_cookies.txt' in process command lines, which is indicative of data exfiltration related to the Omani eVisa portal, as observed in specific threat actor activities.
Detects one-way C2 communication via data drops to cloud storage services
Detects curl.exe exfiltrating screenshots to .onion domains via proxy.
Detects the hollowed MsBuild.exe making POST requests to data-harvesting endpoints.
Detects PowerShell compressing stolen data prior to POST exfiltration. This rule specifically looks for the execution of 'powershell.exe' or 'pwsh.exe' with command-line arguments that include 'Compress-Archive', 'Invoke-WebRequest', and '-Method POST'. This combination indicates an attempt to compress data and then exfiltrate it via an HTTP POST request.
Detects suspicious file read or access events targeting cryptocurrency wallet files (e.g., wallet.dat, keystore, .metamask, Exodus wallet) and browser extension data stores (e.g., Chrome Local Extension Settings, MetaMask, BraveSoftware). The rule specifically excludes common browser processes to reduce false positives, indicating an attempt by an unauthorized process to enumerate or scrape sensitive cryptocurrency-related data.
This rule detects suspicious command-line activity that may indicate the leakage of API keys, specifically those resembling OpenAI API keys (starting with 'sk-', 'sk_live_', or 'sk_test_'). It looks for these patterns in conjunction with common data transfer utilities like curl, wget, powershell, or python, when executed by a process that is not a standard shell or explorer process. The rule triggers if two or more such events occur within an hour on the same computer.
This rule detects the creation of a new GitHub repository from a compromised endpoint, specifically looking for indicators of stolen credential exfiltration. The rule identifies GitHub application events where a repository is created and the raw event data contains keywords associated with credential dumping or specific campaign names like "Miasma" or "Spreading Blight". Automated exfiltration to GitHub is often fast and difficult to remediate, making prompt detection crucial. If triggered, it's recommended to revoke tokens used to create the repository and investigate the endpoint for compromise.
This rule detects processes making three or more successful outbound network connections within an hour to known code or text sharing sites like Pastebin, GitHub, or Gist. This activity can be indicative of data exfiltration, command and control (C2) communication, or staging of malicious code.
Udm Mail Raw Ip Https
YARA-L
This rule detects network connections made by processes commonly associated with mail collection, archiving, or data export (e.g., mail, archive, collector, export, rclone, winscp, curl executables). The detection specifically looks for these processes making HTTPS connections where the command line contains keywords related to email data files (.pst, .ost) or email processing (aspose.email, mailbox). The rule aims to identify potential exfiltration or collection of email data over HTTPS.
This rule detects the combination of a Node.js process reading a JavaScript file with a 24-character hexadecimal filename, immediately followed by outbound network communication to known command and control (C2) IP addresses associated with the 'easy-day-js' campaign. This behavior is indicative of the Mastra NPM supply chain compromise.
Correlates pythonw.exe network connections with HTTP POST characteristics (if Deep Packet Inspection data available) for data exfil. This rule specifically looks for network connections initiated by 'pythonw.exe' to known malicious domains ('brokeapt.com', 'pan.ssffaa19.xyz').
Correlates the dropping of 'install-persistent.php' within a 'woocommerce' folder with a subsequent network connection to the C2 IP '194.76.217.28' on custom port '2871' within a one-hour window. This activity is indicative of a supply chain compromise targeting ShapedPlugin, where backdoored pro plugins are distributed via official channels.
This rule detects the creation of the 'class-wc-subscription-diagnostics.php' backdoor file followed by a network connection to the command and control (C2) domain 'generate.2faplugin.org' within a 30-minute window on the same device. This correlation indicates a potential supply chain compromise targeting ShapedPlugin, where backdoored pro plugins are distributed via official channels, leading to 2FA exfiltration.
Page 79 of 128