Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
665 detections
Filters
Last updated
All Time
Detection languages
373
88
48
47
44
Contributors
204
125
117
40
22
Categories
20,443
11,831
5,872
5,155
4,866
665
Platforms
537
92
79
36
23
Products / Services
261
179
42
26
21
MITRE Techniques
437
183
166
132
119
CVEs
3
2
1
1
1
IDS Classtypes
8
6
1
IDS Protocols
7
6
2
Detects process creation of data exfiltration tools (Rclone, MEGAsync, WinSCP) and archive utilities (7z, rar) used with staging and compression arguments, which represents a common pre-ransomware data staging and exfiltration pattern.
Detects PowerShell execution spawning 7zr.exe to extract password-protected 7z archives using overwrite and password switches within a specified timeframe, or referencing specific malicious IOC file names and domains.
Detects a sequence where a device runs a staging/archiving utility (such as WinRAR, 7-Zip, or a copy script) followed within 4 hours by a file transfer or synchronization tool (such as rclone or FileZilla), which is indicative of data staging prior to exfiltration.
Detects endpoint network connections made to known staging IP addresses often associated with data exfiltration or staging activities.
Detects Gryxa staging behavior where files are written across 2 or more distinct toolkit directories (such as WinRTCS, WER .wucache, and Diagnosis .etlcache) within a 1-hour window on a single device.
Detects ProFTPD FTP server commands where an adversary uses SITE CPFR (Copy From) to reference a sensitive file path (such as /etc/passwd or SSH keys) followed by SITE CPTO (Copy To) on the same host within a 10-minute window, which indicates potential staging or unauthorized copying of sensitive system files via FTP.
Detects a burst of uploads to Box from a single account. Where mass download suggests
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
Detects a burst of uploads to Box from a single account. Where mass download suggests
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
Detects a burst of uploads to Box from a single account. Where mass download suggests
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
Detects a burst of uploads to Box from a single account. Where mass download suggests
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
Detects a burst of uploads to Box from a single account. Where mass download suggests
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
Detects a burst of uploads to Box from a single account. Where mass download suggests
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
Detects a burst of uploads to Box from a single account. Where mass download suggests
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
Detects a burst of uploads to Box from a single account. Where mass download suggests
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
Detects Gryxa staging behavior where files are written across 2 or more distinct toolkit directories (such as WinRTCS, WER .wucache, and Diagnosis .etlcache) within a 1-hour window on a single device.
Detects a burst of uploads to Box from a single account. Where mass download suggests
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
theft from the platform, a mass upload suggests the platform is being used as the
staging point — data collected elsewhere in the estate being moved into cloud storage
the attacker controls or can reach from outside.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='UPLOADED'
| duration 1h
| groupby user, srcip
| select user, srcip, count(*) as cnt
| having cnt > 40
Detects payload staging activity associated with threat actor UAC-0099, correlating the creation or modification of executable/DLL files in disguised LocalAppData directories with decoy images or library configuration files within a one-hour window.
Detects payload staging activity associated with threat actor UAC-0099, correlating the creation or modification of executable/DLL files in disguised LocalAppData directories with decoy images or library configuration files within a one-hour window.
Detects payload staging activity associated with threat actor UAC-0099, correlating the creation or modification of executable/DLL files in disguised LocalAppData directories with decoy images or library configuration files within a one-hour window.
Detects payload staging activity associated with threat actor UAC-0099, correlating the creation or modification of executable/DLL files in disguised LocalAppData directories with decoy images or library configuration files within a one-hour window.
Detects payload staging activity associated with threat actor UAC-0099, correlating the creation or modification of executable/DLL files in disguised LocalAppData directories with decoy images or library configuration files within a one-hour window.
Page 1 of 32