Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,686 detections
Filters
Last updated
All Time
Detection languages
1,342
389
264
219
197
Contributors
620
506
358
209
102
Categories
20,453
11,838
5,876
5,154
4,865
2,686
Platforms
1,168
638
452
382
359
Products / Services
593
445
403
264
229
MITRE Techniques
1,884
787
525
521
510
CVEs
11
5
5
5
3
IDS Classtypes
189
133
34
10
7
IDS Protocols
243
58
33
22
12
This rule detects potential DNS tunneling activity by looking for an unusually high volume of DNS queries of type TXT or NULL, or DNS queries with exceptionally long names (50 characters or more), originating from multiple distinct clients within a one-hour window. This pattern is often indicative of adversaries exfiltrating data or establishing command and control through DNS.
This rule detects suspicious network connections originating from internal IP addresses to common service ports (DNS, SMB, RDP, WinRM) on remote, non-internal IP addresses. It flags instances where a single process on a device makes 10 or more such connections within an hour, which could indicate reconnaissance, lateral movement, or data exfiltration attempts.
This rule detects suspicious large file transfers over the network, specifically looking for connections where more than 100MB (104857600 bytes) of data has been sent or received. It then aggregates these transfers by device and remote IP within one-hour bins and flags if five or more such large transfers occur within that hour. This behavior can be indicative of data exfiltration, often associated with ransomware attacks or other malicious data theft activities.
This rule detects a single process creating a large number of files with diverse file types within a short time frame (5 minutes). This behavior can be indicative of malicious activity such as ransomware encrypting files, data staging for exfiltration, or malware dropping multiple components.
This rule detects when an account copies five or more files, each larger than 50MB, within a one-hour period. This activity could indicate data exfiltration or staging for exfiltration.
This rule identifies accounts that create or modify 10 or more files, each larger than 200MB, within a one-hour period. This behavior can be indicative of data exfiltration, staging of large files, or other suspicious bulk file operations.
This rule detects suspicious file export activity by monitoring for the creation of files with names containing keywords like 'export', 'dump', or 'extract'. It triggers an alert if five or more such files are created by the same account within a one-hour window, indicating potential data exfiltration or staging.
This rule detects the delivery of a payload designed to bypass macOS Transparency, Consent, and Control (TCC) mechanisms via HTTP. Specifically, it looks for the string "kTCCServiceCamera" within HTTP response data, indicating an attempt to manipulate camera access permissions. This activity is often associated with privilege escalation techniques on macOS.
This rule detects attempts to upload files containing the 'MZ' magic bytes (indicating a Windows executable) to known file-sharing services such as transfer.sh, mega.nz, mediafire, or anonfiles. It specifically looks for HTTP POST requests with file data.
This rule detects potential mass email collection activity over IMAP (port 143). It triggers an alert if a client makes 20 or more 'FETCH BODY[]' requests within a 60-second window to an IMAP server. This behavior is indicative of an attacker or malicious script attempting to download a large number of email bodies, potentially for data exfiltration or analysis.
This rule detects HTTP POST requests to pastebin.com's API for pasting content, specifically targeting the '/api/api_paste.php' endpoint. It triggers if the size of the data being uploaded is greater than 1000 bytes, indicating a potential data exfiltration attempt to a public text storage site.
This rule detects potential data exfiltration to Dropbox cloud storage. It specifically looks for HTTP POST requests to 'api.dropboxapi.com' with a data size greater than 10000 bytes. This indicates a significant amount of data being uploaded to Dropbox, which could be a sign of unauthorized data transfer.
This rule detects potential sensitive data exfiltration to a web service. It triggers when an HTTP POST request is made from the home network to any destination, and the request body size is greater than 10,000 bytes. A threshold is applied, alerting if 10 such events occur from the same source IP within 60 seconds. This pattern suggests a large amount of data being uploaded, which could indicate exfiltration.
This rule detects bulk file copies to USB drives via SMB by looking for the string "USBSTOR" (case-insensitive) within SMB traffic on port 445. A threshold of 100 occurrences within 60 seconds from the same source IP triggers the alert, indicating a potential exfiltration attempt.
This rule detects HTTP POST requests from the home network to any external server where the request body size is greater than 10000 bytes. It uses a threshold to alert if 5 such events occur from the same source IP within an hour, indicating a potential cron-timed data upload or exfiltration attempt.
This rule detects attempts to set or modify an S3 bucket lifecycle policy for auto-deletion. It specifically looks for HTTP PUT requests to 's3.amazonaws.com' with a URI containing '?lifecycle'. This activity could indicate an attacker attempting to delete data after exfiltration or to destroy evidence.
This rule detects a high volume of file read operations from a network share that contains the string "USBSTOR" in its content, indicating potential access to removable media. It triggers an alert if more than 50 such events occur within a 30-second window from the same source IP address. This could signify an attempt to exfiltrate data from a removable device shared over the network.
This rule detects a high volume of HTTP requests to GitHub's archive endpoint for repository cloning, specifically looking for 10 or more requests within 60 seconds from a single source IP. This behavior could indicate an attempt to collect data from multiple GitHub repositories, potentially for reconnaissance or data exfiltration purposes. The rule targets HTTP traffic where the host is 'github.com' and the URI contains '/archive/'.
This rule detects a high volume of Real-time Transport Protocol (RTP) video stream traffic originating from the home network and destined for external servers. Specifically, it triggers an alert if more than 100 UDP packets with a data size greater than 1000 bytes are observed from a single source IP address within a 10-second window. This pattern could indicate unauthorized video streaming or data exfiltration.
This rule detects the upload of a potential screen recording file to a remote server over HTTP. It specifically looks for HTTP POST requests where the URI contains the string "video" (case-insensitive) and the file data contains the byte sequence "|00 00 00|" within the first 4 bytes, indicating a common video file header. Additionally, the file size must be greater than 500KB, which helps to filter out small, non-video files.
This rule detects the exfiltration of a webcam video stream over HTTP POST. It specifically looks for HTTP POST requests containing file data, where the data starts with the hexadecimal sequence '52 49 46 46' (which corresponds to 'RIFF', a common header for multimedia file formats like AVI and WAV) and has a size greater than 100,000 bytes. This combination suggests a large multimedia file, potentially a video, being uploaded.
Page 90 of 128