Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,686 detections
Filters
Last updated
All Time
Detection languages
1,342
389
264
219
197
Contributors
620
506
358
209
102
Categories
20,453
11,838
5,876
5,154
4,865
2,686
Platforms
1,168
638
452
382
359
Products / Services
593
445
403
264
229
MITRE Techniques
1,884
787
525
521
510
CVEs
11
5
5
5
3
IDS Classtypes
189
133
34
10
7
IDS Protocols
243
58
33
22
12
This rule detects when a single user downloads 50 or more files from OneDrive within a one-hour period. This could indicate data exfiltration or unauthorized bulk access to sensitive information.
This rule detects when a single process account creates 5 or more files containing 'database', 'db', or '.sql' in their filenames within a one-hour window. This could indicate an attempt to stage, exfiltrate, or manipulate database files.
Detects an unusually high number of file copy operations to 'public' or 'external' folders within a one-hour window, initiated by the same process account. This behavior could indicate data exfiltration or unauthorized data staging.
This rule detects when an account copies five or more files, each larger than 50MB, within a one-hour period. This activity could indicate data exfiltration or staging for exfiltration.
This rule detects when a single process account creates or copies 10 or more files to a removable media device (e.g., USB drive) within a one-hour window. This behavior can be indicative of data exfiltration attempts.
This rule detects an unusual spike in large file downloads from SharePoint by a single user within a one-hour window. It specifically looks for users downloading 5 or more files, each larger than 100MB, from SharePoint.
Detects when a single account initiates a high volume of Office file (Word, Excel, PowerPoint) copy or move operations within a one-hour window. This could indicate data exfiltration or staging activities.
This rule identifies accounts that create or modify 10 or more files, each larger than 200MB, within a one-hour period. This behavior can be indicative of data exfiltration, staging of large files, or other suspicious bulk file operations.
Detects the execution of the MinIO client (mc) with insecure connection parameters, indicating potential automated data exfiltration to S3-compatible storage by threats like BLUERABBIT. The rule specifically looks for the 'alias', 'set', and '--insecure' arguments in the process command line.
This rule detects outbound Server Message Block (SMB) communications from internal devices to external (non-private) IP addresses. It specifically looks for connections on ports 137, 138, 139, and 445. The rule then aggregates these events over 10-minute intervals and flags devices that have more than 5 such SMB connections to distinct external IPs, indicating potential data exfiltration or unauthorized external communication.
This rule detects suspicious network connections originating from internal IP addresses to common service ports (DNS, SMB, RDP, WinRM) on remote, non-internal IP addresses. It flags instances where a single process on a device makes 10 or more such connections within an hour, which could indicate reconnaissance, lateral movement, or data exfiltration attempts.
Detects the execution of WinSCP or Rclone binaries, which are heavily utilized by threat actors like UNC3753 as portable utilities to rapidly exfiltrate staged data.
This rule detects HTTP POST requests where the URI contains both 'wp-content' and 'uploads', indicating potential command and control (C2) communication from a compromised website, likely a WordPress site. The rule specifically looks for requests with a body size greater than 500 bytes, suggesting data exfiltration or command execution.
This rule detects attempts to exfiltrate clipboard data over HTTP using a POST request. It specifically looks for HTTP POST requests where the URI or content contains the string "clipboard" (case-insensitive). This behavior is indicative of malware or malicious scripts trying to steal sensitive information copied by the user.
This rule detects an unusual number of successful encryption-related operations performed by a single caller within a one-hour window in Azure Activity logs. This could indicate legitimate bulk administrative tasks or potentially malicious activity such as data encryption for impact (e.g., ransomware) or preparation for exfiltration by an attacker.
This rule detects potential data exfiltration to a GitLab repository. It specifically looks for HTTP POST requests to gitlab.com with the URI containing '/git-receive-pack' and a data size greater than 10KB. This pattern is indicative of a 'git push' operation, which could be used to exfiltrate data.
This rule detects potential data exfiltration attempts via a GitHub repository push. It specifically looks for HTTP POST requests to 'github.com' with the URI '/git-receive-pack' and a data size greater than 10000 bytes. This pattern is indicative of a 'git push' operation, which could be used to upload sensitive data to a public or controlled GitHub repository.
This rule detects potential data exfiltration of USB drive contents over SSH using SCP. It triggers when TCP traffic on port 22 (SSH) from the home network to the home network contains the string "/dev/sd" (case-insensitive) and the data size is greater than 65000 bytes. This combination suggests that a file from a Linux-like USB device (often mounted as /dev/sdX) is being transferred out via SCP.
This rule detects scheduled data transfers occurring at off-hours, characterized by a large data size (greater than 65000 bytes) in TCP traffic flowing from the home network to any destination. It uses a thresholding mechanism to alert if 100 such transfers are observed within a 300-second window from the same source.
Detects bulk access to internal information repositories for data collection
This rule detects potential data exfiltration over an alternate network medium by monitoring TCP traffic from the home network to any destination. It triggers an alert if the data size of an established connection exceeds 10000 bytes and if this occurs 20 times within a 60-second window from the same source IP address. This pattern suggests a large volume of data being transferred out of the network, which could indicate exfiltration.
Page 88 of 128