Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
This hunting query detects potential data exfiltration by identifying users whose outbound data volume to cloud storage and messaging platforms: (OneDrive, Dropbox, Google Drive, SharePoint, Telegram) spikes dramatically compared to their own historical behavior.
It uses a per-user adaptive baseline approach rather than static thresholds, making it more resilient to normal variance in user upload habits while still flagging statistically abnormal spikes.
MITRE ATT&CK Mapping
Tactic: Exfiltration (TA0010)
Technique: T1567 – Exfiltration Over Web Service
Sub-technique T1567.002 – Exfiltration to Cloud Storage
Data Source
DeviceNetworkEvents (Microsoft Defender for Endpoint / Microsoft 365 Defender advanced hunting schema)
Logic Breakdown:
Baseline window (31 days, excluding the most recent day):
The query calculates each user's average daily upload volume (BytesSent) to a defined set of cloud storage/messaging destinations over the trailing 31 days, ending 1 day ago. This establishes a personal historical norm per user.
Global peer baseline fallback:
For users with little or no prior upload history (average below minBaselineFloor = 1 MB), the query substitutes a global average across all users (globalPeerBaseline) — or the 1 MB floor, whichever is higher — to avoid division-by-near-zero producing artificially inflated ratios for low-activity users.
Today's upload volume:
Sums BytesSent to the same destination patterns over the last 24 hours per user.
Ratio comparison:
Joins today's upload volume against each user's effective baseline and computes UploadRatio = TodayUpload / EffectiveBaseline.
Alert conditions (both must be true):
UploadRatio > 5 — today's upload is more than 5x the user's normal daily average.
TodayUpload > minUploadFloor (100 MB) — an absolute floor ensuring small, low-value increases (e.g., 1 KB → 6 KB) don't trigger noise alerts even if the ratio is high.
Output: Results sorted by UploadRatio descending, surfacing the most anomalous users firs
It uses a per-user adaptive baseline approach rather than static thresholds, making it more resilient to normal variance in user upload habits while still flagging statistically abnormal spikes.
MITRE ATT&CK Mapping
Tactic: Exfiltration (TA0010)
Technique: T1567 – Exfiltration Over Web Service
Sub-technique T1567.002 – Exfiltration to Cloud Storage
Data Source
DeviceNetworkEvents (Microsoft Defender for Endpoint / Microsoft 365 Defender advanced hunting schema)
Logic Breakdown:
Baseline window (31 days, excluding the most recent day):
The query calculates each user's average daily upload volume (BytesSent) to a defined set of cloud storage/messaging destinations over the trailing 31 days, ending 1 day ago. This establishes a personal historical norm per user.
Global peer baseline fallback:
For users with little or no prior upload history (average below minBaselineFloor = 1 MB), the query substitutes a global average across all users (globalPeerBaseline) — or the 1 MB floor, whichever is higher — to avoid division-by-near-zero producing artificially inflated ratios for low-activity users.
Today's upload volume:
Sums BytesSent to the same destination patterns over the last 24 hours per user.
Ratio comparison:
Joins today's upload volume against each user's effective baseline and computes UploadRatio = TodayUpload / EffectiveBaseline.
Alert conditions (both must be true):
UploadRatio > 5 — today's upload is more than 5x the user's normal daily average.
TodayUpload > minUploadFloor (100 MB) — an absolute floor ensuring small, low-value increases (e.g., 1 KB → 6 KB) don't trigger noise alerts even if the ratio is high.
Output: Results sorted by UploadRatio descending, surfacing the most anomalous users firs
Detect DNS tunnelling via long subdomain labels. The query is useful for identifying DNS queries with unusually long request strings (typically 40+ characters per label) and high volumes of repetitive requests used by attackers to exfiltrate data or run command-and-control (C2) channels.
This rule detects attempts to access cloud instance metadata services (specifically Google Cloud's metadata service) initiated by processes commonly associated with Adobe Campaign Classic (nlserver or w3wp.exe). Such requests are often indicative of Server-Side Request Forgery (SSRF) attempts, where an attacker leverages an application-level vulnerability to probe internal cloud infrastructure for sensitive data or credentials.
Detects outbound network traffic from internal hosts to domains and IP addresses identified as part of the LinX Coders infrastructure used for Mirage2FA adversary-in-the-middle (AiTM) phishing and credential harvesting campaigns.
Detects outbound network connections initiated by the Internet Information Services (IIS) worker process (w3wp.exe) to non-Microsoft IP addresses on suspicious or high-range ports. This behavior often indicates compromised web servers being used for command-and-control (C2) communication, reconnaissance, or data exfiltration.
Detects malicious heartbeat check-ins to a C2 server endpoint '/api/bot/heartbeat' by monitoring for unauthorized exfiltration of hardware identifiers (Host/Device/HW ID) or potential remote task execution via Base64-encoded instructions in the response body, characteristic of ClickFix-related infostealer campaigns targeting macOS users.
Detects network connections to the localhost IP 127.0.0.1 on TCP port 23075 initiated by non-browser and non-VPN processes, excluding standard system binaries and protected paths. This pattern is commonly associated with SOCKS proxies, tunnelers, or malicious local communication channels used for C2 redirection.
This rule detects potential credential or sensitive file theft from VS Code extensions or configuration folders, followed closely by network exfiltration to the Telegram API. It specifically monitors file access to common paths (.ssh/id_rsa, .aws/credentials, .netrc, Local Storage, etc.) by VS Code processes, correlated with non-Telegram processes establishing network connections to api.telegram.org within a 10-minute window.
Detects HTTP outbound traffic to domains using the .sbs TLD that follow a specific 'file' followed by dictionary words naming convention, associated with the ClickFix campaign. The rule specifically identifies staging requests matching a /curl/<hex-id> URI pattern used to deliver secondary payloads.
Detects outbound HTTP POST requests associated with the ChainDrop/Shai-Hulud malware family. The rule looks for 'eth_call' JSON-RPC method calls targeting a specific Ethereum smart contract address known to be used for EtherHiding C2 infrastructure, where malicious payloads or commands are embedded within blockchain interactions.
This rule monitors GCP VPC Flow logs for potential command and control (C2) or data exfiltration activity by identifying internal-to-external network connections that exhibit high novelty. It calculates the percentage of new destination IP addresses contacted by internal source IPs within a single day. Alerts are triggered when a source IP initiates connections to at least 20 unique external destinations, where at least 20% of those destinations have never been contacted by that source in the previous day. This behavioral analysis is designed to detect reconnaissance, scanning, or large-scale data exfiltration patterns.
Detects outbound network connections and DNS queries to a maintained list of known UNC6671 extortion-related domain names. The rule utilizes a temporal 'recency' window (aged IOCs) to filter out stale indicators, mitigating false positives caused by sinkholed or reassigned infrastructure.
This rule identifies non-Microsoft processes (based on file name, file company name, and process signer) that initiate network connections to known Microsoft authentication endpoints. This behavior is often indicative of an adversary-controlled process attempting to leverage cloud services or perform authentication-related activities outside of expected system or productivity software.
This rule detects suspicious activity originating from the Node.js runtime environment. It specifically monitors for 'node.exe' or 'node' processes accessing sensitive credential-related files (such as .npmrc, .netrc, .git-credentials, or id_rsa) followed closely (within 5 minutes) by network connections to public IP addresses. This behavior is indicative of an npm-based malware or malicious package attempting to harvest locally stored credentials and exfiltrate them to an external, potentially attacker-controlled server.
This rule detects suspicious outbound HTTP POST requests containing specific JSON fingerprint payloads associated with ClickFix campaigns. The fingerprint contains a mode set to 'php', typically delivered via hidden, auto-submitting forms on malicious domains to profile victims or deliver secondary payloads.
This rule detects outbound network traffic indicative of AI token jacking, where compromised API keys are utilized through unauthorized gray-market proxy platforms. It identifies requests originating from internal hosts using the specific, anomalous User-Agent string 'Go-http-client/2.0,gzip(gfe)' in conjunction with HTTP host headers associated with known AI 'transfer-station' services such as 'new-api' or 'one-api'. This signature is designed to distinguish malicious exploitation from benign Go-based service traffic, while explicitly excluding known internal service accounts to minimize false positives.
This one's the interesting bit they're using Ethereum RPC calls as a C2channel and dumping stolen secrets to attacker-owned public repos tagged "Shai-Hulud: Here We Go Again". Also flags Claude/VS Code config file writes dropped by the worm for lateral persistence across dev machines.
This rule detects network connections from common administrative processes (such as PowerShell, CMD, WScript, or Rundll32) to known dynamic DNS providers. This pattern is frequently indicative of malware beacons, command and control (C2) communication, or other unauthorized remote access tools utilizing dynamic DNS services to maintain connectivity to adversary infrastructure.
This rule detects potential credential or sensitive file theft from VS Code extensions or configuration folders, followed closely by network exfiltration to the Telegram API. It specifically monitors file access to common paths (.ssh/id_rsa, .aws/credentials, .netrc, Local Storage, etc.) by VS Code processes, correlated with non-Telegram processes establishing network connections to api.telegram.org within a 10-minute window.
This rule detects potentially suspicious data exfiltration activities by identifying a pattern where a user authenticates or interacts with the Microsoft Purview service, followed closely (within 15 minutes) by a connection to an external domain that the organization has not established a historical communication pattern with in the last 30 days. This behavior may indicate an adversary is attempting to exfiltrate session tokens or sensitive data to an external server.
Detects outbound network connections initiated by the Internet Information Services (IIS) worker process (w3wp.exe) to non-Microsoft IP addresses on suspicious or high-range ports. This behavior often indicates compromised web servers being used for command-and-control (C2) communication, reconnaissance, or data exfiltration.
Page 160 of 280