Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
532 detections
Filters
Last updated
All Time
Detection languages
207
185
44
24
19
Contributors
154
107
100
72
18
Categories
20,440
11,814
5,871
5,145
4,864
Platforms
291
209
74
56
23
Products / Services
194
142
120
110
21
MITRE Techniques
296
147
118
86
85
CVEs
5
3
1
1
1
IDS Classtypes
78
69
17
8
5
IDS Protocols
85
51
18
9
9
Detects anomalous ICMP Echo Request packets (Type 8) directed towards external networks that contain a payload size greater than 128 bytes. Such anomalies are often indicative of ICMP tunneling, which may be leveraged by adversaries for command and control (C2) communication or data exfiltration.
This rule detects anomalous DNS query activity that may indicate command and control (C2) or data exfiltration over the DNS protocol. It monitors for three specific indicators: excessive query volume to a single domain family within a short timeframe, the use of abnormally long DNS subdomain labels, and the transmission of TXT record queries from endpoints not acting as designated DNS servers.
This rule detects DNS queries containing an exceptionally long subdomain label (50 or more characters). Such patterns are often indicative of DNS tunneling techniques where data is encoded within the subdomain portion of a DNS query to bypass network security controls or establish command-and-control channels.
Detects anomalous ICMP Echo Request packets (type 8, code 0) that contain payloads exceeding 64 bytes. ICMP Echo requests with large, non-standard payloads are a classic indicator of ICMP tunneling, which can be used to bypass network firewalls and encapsulate non-ICMP traffic for command and control (C2) or data exfiltration. The rule includes a threshold to reduce noise by alerting only when multiple such packets are seen from the same source.
Detects DNS queries with exceptionally long request strings (30 characters or more), which is a common indicator of DNS tunneling or command and control (C2) communication. Adversaries often encode data within the subdomain portion of a DNS query to bypass network security controls.
Detects anomalous network activity originating from 'NearShareReceive.exe' (Windows Near Share) to public IP addresses on non-standard ports, potentially indicating unauthorized use of the Near Share feature for data staging or exfiltration.
This rule detects network connections or process command lines referencing 'easyupload.io' and 'limewire.com', as well as searches for 'eayupload'. These indicators are often associated with unauthorized file transfers or potentially malicious activity involving known file sharing platforms.
This rule monitors for two types of anomalous network behavior: first, it identifies connections to known domains from IP addresses not previously associated with those domains over a seven-day lookback period. Second, it identifies HTTP proxy responses (from Zscaler or Squid) where the content-length significantly deviates from the historical baseline for specific URLs. These patterns are potential indicators of C2 channel shifts or data exfiltration via web protocols.
Detects network connections to Zoho WorkDrive or Zoho Accounts from non-standard or suspicious processes. The rule identifies potential unauthorized data exfiltration or cloud access by flagging processes running from temporary or user-writable directories (e.g., AppData, ProgramData), processes known to be associated with specific threats, or processes exhibiting signs of binary sideloading based on their parent process ancestry.
Detects sensitive data posted to text sharing services
Detects exfiltration of data to Dropbox cloud storage
Detects the use of 'curl' with '-X PUT' and '--data-binary' options, which can indicate data exfiltration or staging activities. This combination is often used to upload raw data to a specified endpoint.
This rule monitors for high frequency network connections (more than 50 requests) initiated from internal endpoints to external (non-RFC1918) IP addresses over port 443. This pattern may indicate beaconing activity, command and control (C2) communication, or significant data exfiltration to an external host.
Detects HTTP PUT requests directed at Wasabi Cloud Storage domains that originate from an Rclone user agent. This pattern is commonly indicative of data exfiltration activities where an attacker uses the Rclone utility to synchronize or upload sensitive data to unauthorized cloud storage.
Detects malicious firmware pushed to network devices via TFTP
Detects data exfiltration through Discord webhook POST requests
Detects browser processes connecting to internal IP addresses followed by a connection to an external (non-whitelisted) destination within a 2-minute window. This behavior is indicative of potential data staging or exfiltration, where a web browser is used to access internal resources before transferring data to an external site.
This rule monitors DNS queries for potential exfiltration or C2 communication channels. It flags DNS queries that exceed 100 characters in length or contain labels with at least 30 alphanumeric characters, excluding activity from common web browsers.
Detects browser processes connecting to internal IP addresses followed by a connection to an external (non-whitelisted) destination within a 2-minute window. This behavior is indicative of potential data staging or exfiltration, where a web browser is used to access internal resources before transferring data to an external site.
Detects high-frequency access to sensitive web paths (e.g., /admin, /vault, /credentials) from common web browsers on a device. This activity may indicate malicious credential harvesting, administrative panel enumeration, or sensitive data exfiltration performed by an adversary or malicious browser extension.
Detects browser processes connecting to internal IP addresses followed by a connection to an external (non-whitelisted) destination within a 2-minute window. This behavior is indicative of potential data staging or exfiltration, where a web browser is used to access internal resources before transferring data to an external site.
Page 14 of 26