Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
532 detections
Filters
Last updated
All Time
Detection languages
207
185
44
24
19
Contributors
154
107
100
72
18
Categories
20,440
11,814
5,871
5,145
4,864
Platforms
291
209
74
56
23
Products / Services
194
142
120
110
21
MITRE Techniques
296
147
118
86
85
CVEs
5
3
1
1
1
IDS Classtypes
78
69
17
8
5
IDS Protocols
85
51
18
9
9
This rule detects high volumes of network traffic originating from processes other than common web browsers (chrome, msedge, firefox) to specific edge computing and logging infrastructure (ingest.sentry.io, workers.dev, pages.dev). This behavior is indicative of non-browser processes, potentially malicious implants or scripts, using legitimate cloud-based edge services as command-and-control (C2) infrastructure or for data exfiltration.
This rule detects processes initiating network connections to standard POP3 (110, 995) and IMAP (143, 993) ports that are not identified as trusted, well-known mail clients. By filtering out connections from common email application paths and local IP ranges, it aims to identify potentially malicious processes, scripts, or non-standard tools attempting to perform email collection or exfiltration directly from mail servers.
This rule detects high volumes of network traffic originating from processes other than common web browsers (chrome, msedge, firefox) to specific edge computing and logging infrastructure (ingest.sentry.io, workers.dev, pages.dev). This behavior is indicative of non-browser processes, potentially malicious implants or scripts, using legitimate cloud-based edge services as command-and-control (C2) infrastructure or for data exfiltration.
This rule detects data synchronization activities between sanctioned enterprise applications and unsanctioned or personal cloud applications using Netskope logs. This pattern often indicates potential shadow IT usage or unauthorized data exfiltration from controlled environments to personal storage services.
This rule detects potential data exfiltration via email by identifying mass near-identical background-image URLs in the body of an email. The rule looks for a high volume (8+) of distinct URLs that contain short parameters (indicative of encoded or smuggled data) within a single email. It further refines the detection by checking for the presence of specific CSS-like syntax often used in CSS-injection keylogging techniques to force the browser or email client to send background-image requests.
This rule monitors GCP VPC Flow logs for potential command and control (C2) or data exfiltration activity by identifying internal-to-external network connections that exhibit high novelty. It calculates the percentage of new destination IP addresses contacted by internal source IPs within a single day. Alerts are triggered when a source IP initiates connections to at least 20 unique external destinations, where at least 20% of those destinations have never been contacted by that source in the previous day. This behavioral analysis is designed to detect reconnaissance, scanning, or large-scale data exfiltration patterns.
Detects macOS infostealer malware using the curl utility to exfiltrate archived data (zip, tar, tgz, etc.) via multipart POST requests to specific known staging endpoints associated with the ClickFix campaign.
This rule detects potential data exfiltration via email by identifying mass near-identical background-image URLs in the body of an email. The rule looks for a high volume (8+) of distinct URLs that contain short parameters (indicative of encoded or smuggled data) within a single email. It further refines the detection by checking for the presence of specific CSS-like syntax often used in CSS-injection keylogging techniques to force the browser or email client to send background-image requests.
This rule detects high-volume outbound network traffic from a Google Cloud Platform (GCP) source IP to external (non-private/non-internal) destinations. It establishes a baseline of daily outbound traffic per source IP over time and triggers an alert if the current daily outbound volume exceeds 500MB and shows a significant increase (more than 3x the established average) compared to previous days. This behavior is often indicative of unauthorized data exfiltration or abnormal network activity.
Detects a process that queries a public IP lookup service (ipify.org, ifconfig.me) and, within 30 seconds, initiates a second distinct network connection from the same causality/actor process chain that transfers data, consistent with environmental-keying techniques used by DOUBLECUP to fetch secondary-stage payloads keyed to the victim's public IP.
Detects high-volume DNS TXT/A queries to domains containing "microsoft" within a 1-hour window per host, indicative of DeviceManager RAT DNS tunneling activity disguised as Microsoft telemetry traffic.
This rule detects rapid, high-volume outbound network requests to a single remote host from common web browsers (msedge.exe, chrome.exe, outlook.exe, firefox.exe). It identifies suspicious behavior where a browser performs at least 10 requests to 10 distinct URLs in a 30-second window, which is indicative of potential per-keystroke exfiltration or automated data scraping.
This rule detects rapid, high-volume outbound network requests to a single remote host from common web browsers (msedge.exe, chrome.exe, outlook.exe, firefox.exe). It identifies suspicious behavior where a browser performs at least 10 requests to 10 distinct URLs in a 30-second window, which is indicative of potential per-keystroke exfiltration or automated data scraping.
Detects network communication associated with the TOKYOCORE malware C2 infrastructure. The rule monitors for specific API endpoints (/api/victim/(log|data|command|archive)) combined with known malicious User-Agent strings (RansomAgent or fsociety/1.0), as well as suspicious multipart form data uploads that may indicate data staging or exfiltration.
Anomalously large outbound transfers over the WebRTC DataChannel from a Chrome/Edge process launched with --headless and --remote-debugging-port flags (no visible window), indicating exfiltration rather than routine interactive or automation-only browser use.
Anomalously large outbound transfers over the WebRTC DataChannel from a Chrome/Edge process launched with --headless and --remote-debugging-port flags (no visible window), indicating exfiltration rather than routine interactive or automation-only browser use.
Detects the creation of specific RabbitMQ AMQP exchanges and bindings often associated with C2 communication patterns, such as the use of 'fanout' or 'topic' exchange types paired with common internal naming conventions or payload keywords.
Detects outbound TLS traffic directed toward ngrok.io infrastructure originating from Azure Container Instances. Ngrok is frequently used by adversaries to establish reverse proxies and tunnels to maintain persistent command-and-control access to compromised cloud-hosted containers.
Anomalously large outbound transfers over the WebRTC DataChannel from a Chrome/Edge process launched with --headless and --remote-debugging-port flags (no visible window), indicating exfiltration rather than routine interactive or automation-only browser use.
This rule detects network traffic originating from the internal network directed towards a hardcoded IP address associated with the CrashStealer malware. The rule flags outbound traffic to this specific destination, which is indicative of command and control communication or data exfiltration.
Detects outbound network traffic containing the specific string 'Secret: ' using raw TCP, often indicative of data exfiltration or unauthorized command-and-control communication via tunneling tools like netcat or ngrok.
Page 11 of 26