Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,686 detections
Filters
Last updated
All Time
Detection languages
1,342
389
264
219
197
Contributors
620
506
358
209
102
Categories
20,456
11,839
5,876
5,155
4,865
2,686
Platforms
1,168
638
452
382
359
Products / Services
593
445
403
264
229
MITRE Techniques
1,884
787
525
521
510
CVEs
11
5
5
5
3
IDS Classtypes
189
133
34
10
7
IDS Protocols
243
58
33
22
12
This rule detects attempts to exfiltrate data to Google Drive cloud storage. It specifically looks for HTTP POST requests to 'www.googleapis.com' with the URI containing '/upload/drive/' and a data size greater than 10000 bytes. This pattern is indicative of a file upload operation to Google Drive.
This rule detects large data transfers (over 65000 bytes) to a Server Message Block (SMB) share that contains the string "USBSTOR" in its content. This combination suggests data exfiltration to removable media, as "USBSTOR" is often associated with USB storage devices. The rule uses a threshold of 20 such transfers within 60 seconds from the same source IP to trigger an alert, indicating a sustained large data transfer activity.
This rule detects potential data exfiltration over Bluetooth Network Encapsulation Protocol (BNEP) by monitoring UDP traffic on port 3232. It triggers an alert if more than 5 such packets are observed from a single source within a 60-second window, indicating a possible attempt to transfer data out of the network via Bluetooth.
This rule detects potential data exfiltration attempts via Discord webhooks. It specifically looks for HTTP POST requests to discord.com/api/webhooks/ with a data size greater than 500 bytes. This could indicate an attacker sending sensitive information out of the network using Discord's API.
This rule detects potential data exfiltration or unauthorized copying of data from USB drives via an SSH SCP session. It specifically looks for TCP traffic on port 22 (SSH) within the home network, where the data flow is from the client to the server (upload). The rule triggers if the content of the SCP session includes both "/media/" and "/usb" (case-insensitive), indicating paths commonly associated with mounted USB devices on Linux systems, and the data size is greater than 1000 bytes. This suggests that contents from a USB drive are being copied off the system over SSH.
This rule detects when a client makes repeated HTTP requests to the SharePoint download.aspx page, specifically looking for the URI pattern "/_layouts/download.aspx". This behavior, when occurring frequently from a single source, could indicate an attempt to enumerate and potentially exfiltrate content from a SharePoint site. The rule uses a threshold of 20 requests within 60 seconds from the same source IP to trigger an alert, suggesting a bulk download or enumeration activity.
This rule detects potential bulk email collection activity over IMAP. It triggers when a client makes 30 or more IMAP 'FETCH' commands containing 'BODY[]' (indicating a request for the full email body) to a server on port 143 within a 60-second window. This behavior can be indicative of an attacker or malicious insider exfiltrating a large number of emails from an IMAP server.
This rule detects attempts to copy the running configuration from a network device via SSH. It specifically looks for the string "show running-config" within TCP traffic destined for port 22 (SSH) on the home network. This activity is often associated with reconnaissance or data exfiltration by attackers or malicious insiders.
This rule detects attempts to exfiltrate wireless network lists (SSIDs) over HTTP POST requests. It specifically looks for HTTP POST requests with a body size greater than 200 bytes that contain the string "SSID" (case-insensitive). This activity is indicative of a trojan attempting to steal network information.
This rule detects the exfiltration of peripheral device information over HTTP POST requests. It specifically looks for HTTP POST requests with a body size greater than 200 bytes that contain the string "DeviceID" (case-insensitive). This pattern is indicative of malware or malicious scripts attempting to send device identifiers or other system information to a remote server.
This rule detects potential data exfiltration over HTTP POST requests. It specifically looks for HTTP POST requests with a client body size greater than 500 bytes and containing the case-insensitive string "ESTABLISHED". This combination suggests that network connection data might be embedded and sent out via HTTP POST, which is a common technique for command and control or data exfiltration.
This rule detects attempts to copy Firefox profile data, specifically the 'places.sqlite' file, over SMB (Server Message Block) to a server. This activity is indicative of browser reconnaissance, where an attacker might be exfiltrating browsing history and bookmarks stored in the Firefox profile for further analysis or to gain intelligence about the victim.
This rule detects attempts to perform raw disk access via SSH, specifically looking for the 'dd if=/dev/sd' command within SSH traffic. This activity could indicate an attacker trying to bypass volume-based security controls or exfiltrate data directly from disk partitions.
This rule detects suspicious activity related to Microsoft Teams chat messages being scraped for credentials. Specifically, it looks for HTTP requests to 'graph.microsoft.com' with URIs containing '/chats/' and '/messages'. A threshold of 20 such requests within 60 seconds from a single source IP triggers the alert, indicating potential automated data exfiltration or credential harvesting from Teams chats.
This rule detects attempts to copy the Active Directory Certificate Services (ADCS) certificate database for offline forgery. Specifically, it looks for SMB traffic to a server on port 445 (SMB) containing the string "certnew.cer" (case-insensitive) in the content, indicating a file transfer of a newly issued certificate. This activity is often associated with credential access techniques, where an attacker might exfiltrate certificate data to forge credentials.
Detects bulk scraping of LinkedIn company profiles for employee intelligence
Detects repeated 'git clone' or 'git fetch' commands executed on a system within a short timeframe. This activity could indicate an adversary attempting to exfiltrate data from a code repository or staging environment, or rapidly pull down multiple repositories.
This rule detects a high volume of network connections (10 or more within an hour) from a single process to remote URLs containing 'artifact' or 'maven' on standard HTTP (port 80) or HTTPS (port 443) ports. This activity could indicate legitimate software development or build processes, but also potentially malicious activities such as supply chain compromise, data staging, or exfiltration of development-related artifacts.
This rule detects an unusually high number of web search queries (identified by 'search' or 'query' in the URI) originating from a single IP address within a one-hour window. A threshold of 100 or more queries triggers the alert. This behavior could indicate automated activity such as web scraping, reconnaissance, or a denial-of-service attempt against the search functionality.
Detects when a single user account creates 5 or more files within an hour that contain keywords like 'confidential', 'secret', or 'restricted' in their filenames. This behavior could indicate an attempt to stage sensitive data for exfiltration or unauthorized access to sensitive information.
This rule detects unusually large network uploads from devices. It identifies successful network connections where individual transfers exceed 100MB and aggregates these transfers by account name and hour. The rule then flags any account that has uploaded a total of 1TB or more within a single hour. This pattern could indicate data exfiltration, unauthorized data synchronization, or other malicious activities involving significant data transfer volumes.
Page 87 of 128