Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
190 detections
Filters
Last updated
All Time
Detection languages
96
36
19
18
10
Contributors
35
34
27
18
13
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
58
49
42
22
22
Products / Services
38
30
19
17
13
MITRE Techniques
90
44
35
28
25
CVEs
6
2
2
1
1
IDS Classtypes
14
8
6
3
1
IDS Protocols
20
9
4
1
Detects a suspicious sequence of HTTP requests to an upload endpoint (/upload.php) characterized by alternating GET and POST requests across multiple session cookies, culminating in a large POST body within a short time window. This behavior often indicates web shell staging, file upload exploitation, or automated scanning and exploitation tools targeting web applications.
Detects the use of curl or wget commands targeting the Cloud Instance Metadata Service (IMDS) at 169.254.169.254 for credential theft, or performing file uploads and data exfiltration patterns.
The following analytic detects the use of the curl command with specific switches (-F, --form, --upload-file, -T, -d, --data, --data-raw, -I, --head) to upload AWS credentials or configuration files to a remote destination. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and process details. This activity is significant as it may indicate an attempt to exfiltrate sensitive AWS credentials, a technique known to be used by the TeamTNT group. If confirmed malicious, this could lead to unauthorized access and potential compromise of AWS resources.
Detects the initialization of an AWS CloudShell session followed by file transfer operations (PutFile or GetFile). This behavior may indicate an attacker using CloudShell to stage, exfiltrate, or move tools within the cloud environment, potentially bypassing endpoint detection by operating within the cloud service infrastructure.
Detects the use of cloud synchronization utilities such as rclone (including renamed binaries) or Mega command-line tools to interact with cloud storage services. The rule correlates this execution with preceding mass file enumeration or access activity on the same host, which is a common pattern in ransomware double-extortion scenarios.
Detects the creation or exposure of public repositories, releases, or gists under a personal GitHub account that utilize naming conventions associated with the 'PixelLeak' workaround. This technique allows adversaries to make previously private screenshots, recordings, or internal assets publicly accessible by hosting them in public personal repositories or releases.
Detects the creation of an ASPX file within a member file upload directory, followed immediately by the execution of 'cmd.exe' by the 'w3wp.exe' web server process. This behavior is indicative of a web shell being uploaded and used to execute arbitrary commands on the server.
Detects the creation or exposure of public repositories, releases, or gists under a personal GitHub account that utilize naming conventions associated with the 'PixelLeak' workaround. This technique allows adversaries to make previously private screenshots, recordings, or internal assets publicly accessible by hosting them in public personal repositories or releases.
This rule detects potential data exfiltration by correlating access to files labeled as sensitive (confidential, restricted, etc.) with a subsequent upload to a personal cloud storage provider or transmission via email to a personal domain within a two-hour window.
This rule detects potential data exfiltration by correlating access to files labeled as sensitive (confidential, restricted, etc.) with a subsequent upload to a personal cloud storage provider or transmission via email to a personal domain within a two-hour window.
This rule detects potential data exfiltration by monitoring corporate user activities involving consumer generative AI services (e.g., ChatGPT, Gemini, Claude). It identifies suspicious patterns such as large volume submissions, repeated chunked prompts, and the presence of sensitive content (e.g., PII markers, classification labels) or obfuscated payloads (base64/rot13) that suggest an attempt to bypass DLP or detection controls.
Detects unauthorized data staging activities using archival utilities followed by data exfiltration to known public cloud storage providers. The rule specifically excludes hosts experiencing mass file renaming activity, focusing on extortion-only scenarios where data is stolen without encryption.
Detects the initialization of an AWS CloudShell session followed by file transfer operations (PutFile or GetFile). This behavior may indicate an attacker using CloudShell to stage, exfiltrate, or move tools within the cloud environment, potentially bypassing endpoint detection by operating within the cloud service infrastructure.
Detects the creation or exposure of public repositories, releases, or gists under a personal GitHub account that utilize naming conventions associated with the 'PixelLeak' workaround. This technique allows adversaries to make previously private screenshots, recordings, or internal assets publicly accessible by hosting them in public personal repositories or releases.
Detects the creation or exposure of public repositories, releases, or gists under a personal GitHub account that utilize naming conventions associated with the 'PixelLeak' workaround. This technique allows adversaries to make previously private screenshots, recordings, or internal assets publicly accessible by hosting them in public personal repositories or releases.
Detects the creation or exposure of public repositories, releases, or gists under a personal GitHub account that utilize naming conventions associated with the 'PixelLeak' workaround. This technique allows adversaries to make previously private screenshots, recordings, or internal assets publicly accessible by hosting them in public personal repositories or releases.
Detects unauthorized or suspicious modifications to AI model artifacts, including fine-tuned weights and LoRA adapters. This rule identifies tampering attempts via unsigned uploads, bypassing CI/CD production deployment approvals, or mismatches in hash/checksum compared to known-good versions.
Detects unauthorized modifications or non-pipeline uploads to an ML model registry. The rule flags events where model artifacts lack valid signatures, fail checksum verification, or are uploaded/promoted by non-authorized identities or without required CI/CD provenance, indicating potential ML model backdooring or poisoning.
Detects npm package publish events that lack 'gitHead' provenance metadata. The absence of this field indicates that the package was likely published from a developer's local machine rather than through an authorized CI/CD pipeline, a technique used in supply chain attacks to bypass CI-gated controls.
Detects behavior associated with the TeamFiltration backdoor, where a user account downloads a file from OneDrive, modifies or replaces that file, and re-uploads it within a short timeframe (30 minutes). This pattern is consistent with the 'taint shared content' technique used to distribute malicious files through legitimate cloud storage.
Detects the use of command-line tools such as rclone, aws CLI, gsutil, and curl to upload files associated with machine learning models (e.g., weights, checkpoints, training datasets) to public cloud storage or AI model hosting platforms. This pattern may indicate the exfiltration of sensitive proprietary AI research or training data.
Page 1 of 10