Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,686 detections
Filters
Last updated
All Time
Detection languages
1,342
389
264
219
197
Contributors
620
506
358
209
102
Categories
20,453
11,838
5,876
5,154
4,865
2,686
Platforms
1,168
638
452
382
359
Products / Services
593
445
403
264
229
MITRE Techniques
1,884
787
525
521
510
CVEs
11
5
5
5
3
IDS Classtypes
189
133
34
10
7
IDS Protocols
243
58
33
22
12
This rule detects large data uploads over HTTPS (port 443) from the home network to any external destination. Specifically, it triggers if the data size in a single TCP flow to the server exceeds 65,000 bytes. To prevent excessive alerts, it uses a threshold of 20 such events within 60 seconds, tracked by the source IP address. This behavior is indicative of potential data exfiltration.
This rule detects bulk Server Message Block (SMB) file read activity from a network share. It specifically looks for TCP traffic on port 445 (SMB) from any source within the home network to any destination within the home network, indicating established connections. The rule triggers if it observes 100 or more SMB packets (identified by the content "|FF|SMB") within a 60-second window from a single source IP address. This behavior could be indicative of data collection or exfiltration from network shares.
This rule detects sustained outbound network traffic with a data size greater than 1000 bytes, originating from the home network. It triggers an alert if 200 such connections are observed from the same source IP address within a 300-second window. This behavior is indicative of automated exfiltration, where an attacker continuously sends data out of the network.
Detects the execution of cg.exe, a secondary Python executable dropped by SilentRunLoader specifically to pack and steal Chrome browser data. This activity is associated with TA4922.
This rule detects suspicious large file transfers over the network, specifically looking for connections where more than 100MB (104857600 bytes) of data has been sent or received. It then aggregates these transfers by device and remote IP within one-hour bins and flags if five or more such large transfers occur within that hour. This behavior can be indicative of data exfiltration, often associated with ransomware attacks or other malicious data theft activities.
This rule detects large HTTP PUT requests (over 50KB) directed towards common cloud storage services (Amazon S3, Azure Blob Storage, Google Cloud Storage). This activity could indicate data exfiltration to an external cloud account.
This rule detects HTTP PUT requests to s3.amazonaws.com that include the 'x-amz-copy-source' header and have a data size greater than 1000 bytes. This combination of indicators suggests an attempt to copy data from one S3 bucket to another, potentially indicating data exfiltration to an attacker-controlled AWS account.
This rule detects potential VXLAN traffic duplication for exfiltration purposes. It specifically looks for TCP traffic on port 4789 (the default VXLAN port) directed towards the home network. A threshold of 10 connections from the same source within 30 seconds triggers the alert, indicating a high volume of VXLAN traffic that could be indicative of data exfiltration.
This rule detects attempts to exfiltrate sensitive data by posting it to common text sharing services. It specifically looks for HTTP POST requests with a body size greater than 1000 bytes directed towards domains associated with services like paste.ee, hastebin, ghostbin, and privatebin.
This rule detects a high volume of HTTP requests to the Confluence REST API endpoint '/rest/api/content'. This pattern of access could indicate an attempt to bulk download content from Confluence spaces, potentially for data exfiltration or reconnaissance purposes. The threshold is set to trigger if 30 such requests are observed from a single source IP within a 60-second window.
This rule detects a high volume of HTTP requests to a Confluence Wiki instance that include both '/wiki/' and 'export' in the URI. Specifically, it triggers if 10 such requests are observed from the same source IP within a 60-second window. This behavior could indicate an attempt to bulk export pages from a Confluence Wiki, potentially for data exfiltration.
This rule detects bulk data access from an internal information repository. It triggers when a single source IP address performs 50 or more HTTP GET requests within a 30-second window to any destination. This behavior could indicate an attempt to exfiltrate or rapidly collect large amounts of data from internal web-based resources.
This rule detects attempts to create or modify email forwarding rules in Office 365 via the Microsoft Graph API. Specifically, it looks for HTTP POST requests to the '/mailFolders/inbox/messageRules' endpoint on 'graph.microsoft.com'. This activity can indicate an attacker setting up an inbox rule to forward emails to an external address for data exfiltration or to maintain persistence.
This rule detects potential email harvesting attempts via Exchange Web Services (EWS). It specifically looks for HTTP requests to the '/EWS/Exchange.asmx' endpoint containing 'FindItem' in the client body, indicating an attempt to enumerate or search for items (like emails) within mailboxes. A threshold is applied to prevent excessive alerts from legitimate, but frequent, EWS activity.
This rule detects attempts to stage large amounts of data (over 65KB) to common cloud storage services (Amazon S3, Azure Blob Storage, Google Cloud Storage) via HTTP PUT requests. This activity is indicative of data being prepared for exfiltration.
This rule detects HTTP POST requests that contain data resembling a ZIP archive (indicated by 'PK' header) and have a size greater than 50,000 bytes. This pattern is often associated with data exfiltration where collected data is archived before being sent out of the network.
This rule detects a high volume of HTTP GET requests to Azure Blob Storage, specifically targeting '.blob.core.windows.net' domains. A threshold of 50 requests within 60 seconds from a single source IP address triggers the alert, indicating a potential bulk data download activity. This could be indicative of data exfiltration or unauthorized access to cloud storage.
This rule detects a high volume of HTTP GET requests to AWS S3 buckets from a single source IP address within a short timeframe. Specifically, it triggers if more than 50 GET requests are observed within 60 seconds to hosts matching 's3.amazonaws.com' or '.s3.' patterns. This behavior can indicate an attempt to exfiltrate data or perform bulk collection from an S3 bucket.
This rule detects JavaScript code being delivered to a client that attempts to capture form field data, specifically looking for 'document.querySelector', 'password', and 'fetch(' within HTTP response data. This behavior is indicative of an attempt to exfiltrate credentials from a login page.
This rule detects attempts to copy SSL private key files over SMB. It specifically looks for network traffic on port 445 (SMB) containing the strings ".key" and "private" (case-insensitive) in the data being sent to the server. This activity could indicate an attacker attempting to exfiltrate sensitive cryptographic material.
This rule detects HTTP requests that attempt to access the '.aws/credentials' file, which typically contains AWS access keys and secret keys. This indicates an attempt to discover or exfiltrate sensitive AWS credentials from a web server, potentially exposing cloud resources.
Page 92 of 128