Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,686 detections
Filters
Last updated
All Time
Detection languages
1,342
389
264
219
197
Contributors
620
506
358
209
102
Categories
20,445
11,833
5,875
5,151
4,864
2,686
Platforms
1,168
638
452
382
359
Products / Services
593
445
403
264
229
MITRE Techniques
1,884
787
525
521
510
CVEs
11
5
5
5
3
IDS Classtypes
189
133
34
10
7
IDS Protocols
243
58
33
22
12
This rule detects attempts to copy the Chrome Login Data SQLite file over SMB. The rule specifically looks for SMB traffic (port 445) containing the strings "Login Data" and "AppData\Local\Google\Chrome" (case-insensitive). This activity is indicative of an attacker trying to exfiltrate sensitive browser data, specifically stored credentials.
Detects network connections over common exfiltration ports (80, 443, 53) to external IP addresses originating from executables running out of uncommon, temporary, or public directories. This behavior frequently indicates custom or unrecognized malware binaries conducting data exfiltration or establishing Command and Control (C2) communication.
Detects network connections over common exfiltration ports (80, 443, 53) to external IP addresses originating from executables running out of uncommon, temporary, or public directories. This behavior frequently indicates custom or unrecognized malware binaries conducting data exfiltration or establishing Command and Control (C2) communication.
This rule detects attempts to access sensitive configuration or backup files on an IIS web server. It looks for requests where the URI stem contains keywords like '.env', 'config', or 'backup', which are commonly associated with files that may contain sensitive information.
Detects repeated 'git clone' or 'git fetch' commands executed on a system within a short timeframe. This activity could indicate an adversary attempting to exfiltrate data from a code repository or staging environment, or rapidly pull down multiple repositories.
This rule detects potential credential exposure by identifying HTTP requests to IIS servers (W3CIISLog) that contain keywords like 'password' or 'token' in the URI query string, with a successful status code (200). This could indicate sensitive information being passed insecurely.
This rule detects when a single process account creates 5 or more files containing 'database', 'db', or '.sql' in their filenames within a one-hour window. This could indicate an attempt to stage, exfiltrate, or manipulate database files.
This rule detects an unusually high volume of SharePoint sharing invitation creations or sharing setting modifications by a single user within an hour. This could indicate an attacker attempting to exfiltrate data or broadly share sensitive information.
Detects when a single account initiates a high volume of Office file (Word, Excel, PowerPoint) copy or move operations within a one-hour window. This could indicate data exfiltration or staging activities.
This rule detects potential data exfiltration attempts over non-standard network ports. It identifies devices that establish more than 5 network sessions to external (non-private IP) destinations on ports other than common ones like 80 (HTTP), 443 (HTTPS), 21 (FTP), 22 (SSH), 25 (SMTP), 110 (POP3), 143 (IMAP), 993 (IMAPS), and 995 (POP3S) within a one-hour window. This behavior can indicate an adversary attempting to bypass network monitoring by using less common ports for data transfer.
Detects non-browser processes making DNS queries to the Telegram Bot API. This activity is indicative of malware using Telegram for Command and Control (C2) communications or data exfiltration, such as Amnesia RAT.
Detects the creation or modification of Power Automate flows that connect to external services commonly used for data exfiltration or command and control, such as webhooks, Gmail, Dropbox, Google Drive, Slack, RSS feeds, custom connectors, or generic HTTP requests/webhooks. This could indicate an adversary attempting to establish persistence or exfiltrate data from the Power Platform environment.
This rule detects potential domain fronting by identifying a mismatch between the Server Name Indication (SNI) field in the TLS handshake and the Host header, specifically when the SNI field contains domains commonly used for content delivery networks (CDNs) like cloudfront.net, azureedge.net, or fastly.net. This technique can be used to obfuscate the true destination of network traffic, often for malicious purposes such as bypassing censorship or exfiltrating data.
This rule detects potential session cookie theft and bulk cookie exfiltration by monitoring HTTP traffic for large cookie sizes (greater than 500 bytes) being sent from the internal network to external servers. A threshold of 20 such events within 60 seconds from a single source IP triggers the alert, indicating suspicious activity that could be related to an attacker exfiltrating stolen session cookies.
Detects unusually large HTTP POST requests which may indicate data exfiltration activity over web protocols. The rule specifically looks for HTTP POST methods and is designed for Suricata, a network intrusion detection system.
This rule detects potential keylogger data exfiltration over HTTP POST requests. It specifically looks for HTTP POST requests with a URI containing "keys" (case-insensitive) and a data size greater than 500 bytes. This combination suggests a large amount of data, possibly keystrokes, being sent to a server.
This rule detects a pattern of mass file deletion over SMB (Server Message Block) protocol. It triggers an alert if 100 or more SMB packets containing specific content (likely indicating file operations) are observed within a 10-second window, originating from the same source IP address and destined for port 445 (SMB). This behavior is often associated with ransomware or other malicious activities aiming to impact data availability.
This rule detects a high volume of DNS TXT queries originating from the home network to any destination on port 53. This behavior is indicative of potential DNS exfiltration, where data is encoded and transmitted via DNS TXT records. The rule triggers an alert if 30 or more TXT queries are observed from a single source within a 60-second window.
This rule detects potential data exfiltration to Google Drive by monitoring HTTP POST requests to 'www.googleapis.com' with a data size greater than 5000 bytes. This pattern is indicative of large data uploads to Google's API services, which could be used for exfiltration.
Detects suspicious attempts to dump serialized GitHub Actions secrets (JSON) into a text file named 'format-results.txt' for subsequent artifact exfiltration, a technique used by IronWorm. The rule looks for shell commands that use 'echo' to write to 'format-results.txt' and contain references to 'VARIABLE_STORE' or 'secrets', indicating an attempt to exfiltrate sensitive CI/CD environment variables.
Detects network connections over common exfiltration ports (80, 443, 53) to external IP addresses originating from executables running out of uncommon, temporary, or public directories. This behavior frequently indicates custom or unrecognized malware binaries conducting data exfiltration or establishing Command and Control (C2) communication.
Page 93 of 128