Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,686 detections
Filters
Last updated
All Time
Detection languages
1,342
389
264
219
197
Contributors
620
506
358
209
102
Categories
20,456
11,839
5,876
5,155
4,865
2,686
Platforms
1,168
638
452
382
359
Products / Services
593
445
403
264
229
MITRE Techniques
1,884
787
525
521
510
CVEs
11
5
5
5
3
IDS Classtypes
189
133
34
10
7
IDS Protocols
243
58
33
22
12
Detects bulk scraping of LinkedIn company profiles for employee intelligence
Detects bulk download of AWS S3 objects indicating cloud data theft
This rule detects network traffic containing keywords commonly associated with Indian payment gateways and financial transactions (NEFT, RTGS, IMPS, GST, PAN, IFSC). This could indicate data exfiltration or suspicious activity involving financial information, potentially related to malware like Remcos RAT.
Detects unexpected processes requesting AWS IMDSv2 tokens from the link-local address 169.254.169.254. This activity can indicate an attempt to steal temporary cloud credentials from compromised EC2 instances, as seen with malware like Miasma.
Detects the archiving (tar or zip) of .git directories. This activity can indicate an adversary attempting to exfiltrate full source code history and internal intellectual property.
This rule detects network connections made by Python or Node.js processes to known webhook API endpoints for Telegram or Discord. This behavior is often associated with command and control (C2) communication, where attackers use legitimate messaging platforms to control compromised systems or exfiltrate data.
Detects Node.js executing inline base64 encoding specifically aimed at configuration files prior to exfiltration.
Detects DNS-based data exfiltration via high-volume TXT record queries
Detects upload of malicious payloads to file hosting services for staging
This rule detects devices making a high volume of DNS queries (50 or more within a 5-minute window) to domains that have 4 or more subdomains and are not common legitimate services like microsoft.com, google.com, or amazon.com. This pattern can be indicative of DNS beaconing, a technique used by adversaries for command and control (C2) communication or data exfiltration.
Detects copying of Outlook PST/OST files for email collection
Detects sustained large HTTP POST requests indicating data exfiltration
This rule detects an unusually high volume of file sharing events from a single user in OneDrive within a one-hour window. Specifically, it looks for five or more 'SharingSet' or 'AnonymousLinkCreated' operations by the same UserId within an hour, which could indicate data exfiltration or unauthorized sharing.
This rule detects an unusually high volume of SharePoint sharing invitation creations or sharing setting modifications by a single user within an hour. This could indicate an attacker attempting to exfiltrate data or broadly share sensitive information.
Detects the staging of Miasma exfiltration payloads, specifically JSON files matching the 'results-*.json' naming convention, and Git operations interacting with these files. Miasma is known to exfiltrate harvested credentials by creating public GitHub repositories and committing encrypted JSON files with this specific naming convention.
This rule detects attempts to overwrite the Master Boot Record (MBR) or disk structure using the 'dd' command via a remote SSH connection. Specifically, it looks for the string 'dd if=/dev/zero of=/dev/sda' within TCP traffic on port 22 (SSH). This command, if executed, would wipe the primary disk, leading to system destruction.
Detects audio capture and exfiltration via RTP media streams
Detects large HTTPS uploads used for data exfiltration over encrypted channels
This rule identifies when a single account creates three or more files containing 'backup', 'export', or 'dump' in their filenames within a one-hour period. This activity could be indicative of data staging for exfiltration or an attempt to back up sensitive information prior to a malicious action.
This rule detects a high volume of file creation or modification events on removable media (e.g., USB drives). A count of 10 or more file operations within a one-hour window by a single initiating process account on paths containing 'USB' or 'Removable' is considered suspicious and may indicate data exfiltration or staging.
Detects hard deletion of mailbox data to remove forensic email evidence
Page 82 of 128