Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,686 detections
Filters
Last updated
All Time
Detection languages
1,342
389
264
219
197
Contributors
620
506
358
209
102
Categories
20,456
11,839
5,876
5,155
4,865
2,686
Platforms
1,168
638
452
382
359
Products / Services
593
445
403
264
229
MITRE Techniques
1,884
787
525
521
510
CVEs
11
5
5
5
3
IDS Classtypes
189
133
34
10
7
IDS Protocols
243
58
33
22
12
Detects automated sustained outbound data transfers indicative of automated exfiltration
Detects bulk IMAP email collection from remote mail servers
Detects data exfiltration via generic web services or cloud platforms
Detects bulk harvesting of Teams messages for credentials or sensitive data
This rule detects potential air-gap bridging activity via removable media. Specifically, it looks for SMB traffic on port 445 containing the string "USBSTOR" (case-insensitive) and the file extension ".bin" (case-insensitive). This combination suggests a file transfer related to USB storage, possibly a firmware update or a malicious payload, being moved across a network segment, potentially bypassing an air-gapped system.
Detects HTTP POST requests directed to the specific URI path '/api/validate/keyboard-events', which is used by a North Korean-linked npm malware to exfiltrate keylogger data.
This rule detects attempts to sell or exchange VPN credentials by looking for the keywords "vpn" and "credentials" in the client body of HTTP traffic. This could indicate an attacker attempting to monetize stolen VPN access or an insider threat attempting to leak sensitive access information.
Recent reporting indicates the campaign targeted GitHub repositories by inserting malicious GitHub Actions / CI workflows designed to steal secrets and credentials.
5,561 repositories were affected in roughly six hours
Attackers pushed 5,718 malicious commits.
The objective was credential theft from CI/CD environments, including:
cloud credentials
SSH keys
access tokens
CI/CD secrets
The campaign reportedly used:
fake automation-style commit identities such as build-bot, ci-bot, or similar
malicious .github/workflows changes
workflow triggers that either:
executed automatically on push / pull request, or
remained dormant until manually triggered
Web reporting further states the payload collected environment variables, cloud metadata credentials, and repository runner secrets, then exfiltrated them to 216.126.225.129:8443.
5,561 repositories were affected in roughly six hours
Attackers pushed 5,718 malicious commits.
The objective was credential theft from CI/CD environments, including:
cloud credentials
SSH keys
access tokens
CI/CD secrets
The campaign reportedly used:
fake automation-style commit identities such as build-bot, ci-bot, or similar
malicious .github/workflows changes
workflow triggers that either:
executed automatically on push / pull request, or
remained dormant until manually triggered
Web reporting further states the payload collected environment variables, cloud metadata credentials, and repository runner secrets, then exfiltrated them to 216.126.225.129:8443.
This rule detects a high volume of network connections (10 or more within an hour) from a single process to remote URLs containing 'artifact' or 'maven' on standard HTTP (port 80) or HTTPS (port 443) ports. This activity could indicate legitimate software development or build processes, but also potentially malicious activities such as supply chain compromise, data staging, or exfiltration of development-related artifacts.
This rule detects attempts to access sensitive configuration or backup files on an IIS web server. It looks for requests where the URI stem contains keywords like '.env', 'config', or 'backup', which are commonly associated with files that may contain sensitive information.
This rule detects suspicious outbound network connections initiated by an IIS worker process (w3wp.exe) to non-standard ports. This behavior can indicate a web shell or other compromise establishing Command and Control (C2) communication, potentially for data exfiltration or further malicious activity. The rule specifically looks for successful connections where the remote port is not commonly used for web traffic (80 or 443).
Detects unusually large outbound network data transfers (over 1TB) from a single process account within an hour. This could indicate data exfiltration, unauthorized bulk data synchronization, or other malicious activity where large volumes of data are being moved out of the environment.
Detects an unusually high number of file copy operations to 'public' or 'external' folders within a one-hour window, initiated by the same process account. This behavior could indicate data exfiltration or unauthorized data staging.
This rule detects when a single process account creates or copies 10 or more files to a removable media device (e.g., USB drive) within a one-hour window. This behavior can be indicative of data exfiltration attempts.
This rule detects an unusual spike in large file downloads from SharePoint by a single user within a one-hour window. It specifically looks for users downloading 5 or more files, each larger than 100MB, from SharePoint.
This rule detects when a single process account initiates a high volume (10 or more) of file move operations to folders associated with cloud storage services (e.g., 'cloud', 'dropbox', 'drive') within a one-hour window. This behavior could indicate data exfiltration or staging for exfiltration.
This rule detects when a single user downloads 50 or more files from OneDrive within a one-hour period. This could indicate data exfiltration or unauthorized bulk access to sensitive information.
This rule detects suspicious file export activity by monitoring for the creation of files with names containing keywords like 'export', 'dump', or 'extract'. It triggers an alert if five or more such files are created by the same account within a one-hour window, indicating potential data exfiltration or staging.
This rule detects large encrypted data uploads (over 65KB) on TCP port 8443, which is an alternate port often used for TLS/HTTPS traffic. The rule triggers if 10 such uploads occur from the same source within 60 seconds, indicating a potential policy violation or data exfiltration attempt.
This rule detects potential data exfiltration over TLS to non-standard endpoints. It triggers when a large amount of data (greater than 65000 bytes) is sent from the home network to any destination IP on port 443 (HTTPS). A threshold is applied, triggering an alert if this occurs 20 times within 60 seconds from the same source IP, indicating a high volume of outbound encrypted traffic.
This rule detects potential data exfiltration attempts via Slack incoming webhooks. It triggers when an HTTP POST request is made to 'hooks.slack.com' with a URI containing '/services/' and a data size greater than 500 bytes. This pattern is indicative of an application or script sending data to a Slack channel using a webhook.
Page 85 of 128