Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
189 detections
Filters
Last updated
All Time
Detection languages
95
36
19
18
10
Contributors
35
34
27
18
13
Categories
20,417
11,806
5,870
5,145
4,864
Platforms
58
49
41
22
22
Products / Services
38
30
18
17
13
MITRE Techniques
90
44
34
28
25
CVEs
6
2
2
1
1
IDS Classtypes
14
8
6
3
1
IDS Protocols
20
9
4
1
Detects high-frequency S3 object upload activity (PutObject/CompleteMultipartUpload) originating from the Rclone tool, a common indicator of potential data exfiltration to cloud storage.
Detects high-frequency S3 object upload activity (PutObject/CompleteMultipartUpload) originating from the Rclone tool, a common indicator of potential data exfiltration to cloud storage.
Detects upload requests targeting executable or server-side script file extensions.
Detects HTTP upload requests directed to common web directory paths that contain suspicious file extensions, specifically archive formats (e.g., zip, rar, tar) or macro-enabled Office documents (e.g., docm, xlsm). This behavior is often associated with the delivery of malware payloads.
This rule detects large file uploads (greater than 100MB) from endpoints to unmanaged or personal cloud storage services such as Google Drive, OneDrive, and Dropbox. This behavior may indicate unauthorized data exfiltration or the improper use of unapproved cloud storage platforms to move sensitive data outside of corporate control.
This rule monitors Netskope cloud application events to detect potential data exfiltration. It triggers if there is a significant volume anomaly (z-score >= 2) for any cloud application activity, or if a 'Share' or 'Upload' activity occurs that is only configured to 'Alert' rather than being blocked. This helps identify unusual spikes in data movement or sensitive operations that bypass formal enforcement controls.
Detects DLP events from Netskope where sensitive data (PII, PCI, Source Code, or Credentials) is being uploaded or shared, indicating potential data exfiltration.
Detects DLP policy violations flagged by Netskope when users upload, share, post, or send files within Slack or Microsoft Teams. This rule monitors for DLP profile matches which may indicate unauthorized exfiltration or exposure of sensitive data via collaboration tools.
Detects DLP policy violations flagged by Netskope when users upload, share, post, or send files within Slack or Microsoft Teams. This rule monitors for DLP profile matches which may indicate unauthorized exfiltration or exposure of sensitive data via collaboration tools.
Detects instances where sensitive or organizational data is uploaded to public text storage repositories like Pastebin or GitHub Gists through Netskope, which may indicate data exfiltration.
This rule detects large file uploads (greater than 100MB) from endpoints to unmanaged or personal cloud storage services such as Google Drive, OneDrive, and Dropbox. This behavior may indicate unauthorized data exfiltration or the improper use of unapproved cloud storage platforms to move sensitive data outside of corporate control.
Detects instances where Netskope Advanced Threat Protection (ATP) identifies a malicious file during a user-initiated upload or download operation.
Detects DLP events from Netskope where sensitive data (PII, PCI, Source Code, or Credentials) is being uploaded or shared, indicating potential data exfiltration.
Detects instances where Netskope Advanced Threat Protection (ATP) identifies a malicious file during a user-initiated upload or download operation.
Detects instances where sensitive or organizational data is uploaded to public text storage repositories like Pastebin or GitHub Gists through Netskope, which may indicate data exfiltration.
Detects potentially unauthorized or suspicious file activities such as bulk downloads, external file sharing, or CASB policy violations monitored by Zscaler ZIA, which may indicate data exfiltration or policy non-compliance.
Detects potentially unauthorized or suspicious file activities such as bulk downloads, external file sharing, or CASB policy violations monitored by Zscaler ZIA, which may indicate data exfiltration or policy non-compliance.
Detects macOS infostealer malware using the curl utility to exfiltrate archived data (zip, tar, tgz, etc.) via multipart POST requests to specific known staging endpoints associated with the ClickFix campaign.
Detects anomalous activity in Microsoft 365 calendar events where potential C2 data is exfiltrated or synchronized. This is identified by the creation or modification of calendar events containing suspicious file names (e.g., File0.txt, File1.txt) or specific command-and-control markers within the event subject.
Detects the unauthorized PyPI release of mrmustard 0.7.4 uploaded during the known malicious publish window following the maintainer account compromise.
Detects anomalous activity in Microsoft 365 calendar events where potential C2 data is exfiltrated or synchronized. This is identified by the creation or modification of calendar events containing suspicious file names (e.g., File0.txt, File1.txt) or specific command-and-control markers within the event subject.
Page 4 of 9