Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
532 detections
Filters
Last updated
All Time
Detection languages
207
185
44
24
19
Contributors
154
107
100
72
18
Categories
20,440
11,814
5,871
5,145
4,864
Platforms
291
209
74
56
23
Products / Services
194
142
120
110
21
MITRE Techniques
296
147
118
86
85
CVEs
5
3
1
1
1
IDS Classtypes
78
69
17
8
5
IDS Protocols
85
51
18
9
9
Detects large data transfers occurring outside normal business hours
This rule detects suspicious bulk access and transfer behavior targeting sensitive files, which could indicate data exfiltration. It identifies scenarios where a single account accesses a large number of files, totaling a significant size, within a short timeframe. The rule specifically looks for common sensitive file types such as spreadsheets, documents, PDFs, SQL databases, and backup files. This pattern is often associated with ransomware groups performing data leak extortion without encryption.
Detects exfiltration of sensitive data pushed to GitHub repositories
Detects bulk export of CRM customer data for collection and theft
Detects bulk download of AWS S3 objects indicating cloud data theft
Detects a persistent process creating similarly sized outbound transfers at regular intervals after staging local results, indicative of the Kazuar malware's exfiltration behavior. The rule identifies processes with significant outbound network traffic (bytes > 10000), aggregates this traffic over 15-minute intervals, and then looks for processes that exhibit consistent outbound activity with intervals between 10 and 20 minutes (600 to 1200 seconds).
This rule detects potential ransomware activity by identifying a combination of three distinct behaviors occurring on a single endpoint within a short window: high-volume file modifications (indicative of file encryption), deletion of system recovery resources (e.g., volume shadow copies, backup catalogs), and high-frequency network activity (indicative of data exfiltration). The rule uses cross-event correlation to reduce false positives by requiring all three signals to be present.
Detects one-way C2 communication via data drops to cloud storage services
Detects potential use of steganography to hide C2 commands in image files
Detects bulk export of CRM customer data for collection and theft
This rule identifies devices that send a large volume of data (over 100 MB) over HTTPS ports (443 or 8443) within a one-hour window. This activity could be indicative of data exfiltration, unauthorized large file transfers, or other suspicious network activity.
Detects large file transfers over FTP data channel for exfiltration
Detects exfiltration of sensitive data pushed to GitHub repositories
Detects large data transfers occurring outside normal business hours
This rule detects a high volume of HTTP requests to Salesforce API endpoints associated with bulk data queries. Specifically, it looks for 20 or more requests within a 60-second window from a single source IP to 'salesforce.com' with URI paths containing both '/services/data/' and '/query/'. This pattern suggests a potential bulk download of customer records or other data via the Salesforce API.
Detects bulk download of AWS S3 objects indicating cloud data theft
Detects PowerShell execution initiated by Remote Monitoring and Management (RMM) tools, specifically 'IDriveRemotePC.exe' or 'RemotePC.exe', when the PowerShell command line contains keywords indicative of downloading and executing remote content (e.g., 'DownloadString', 'IEX', 'Invoke-Expression', 'http', 'https', 'ftp'). This behavior is often associated with initial access or staging phases of an attack, such as ransomware deployment.
Detects sustained large HTTP POST requests indicating data exfiltration
Detects large HTTPS uploads used for data exfiltration over encrypted channels
This rule detects HTTP traffic where the client body contains a long string (100 or more characters) composed exclusively of uppercase letters and digits 2-7, potentially followed by padding characters. This pattern is indicative of custom alphabet base encoding, often used in Command and Control (C2) communications to obfuscate data.
This rule detects Bluetooth Object Exchange (OBEX) Protocol data transfer activity on TCP port 3232. The rule is configured to alert when five such data transfers are observed from the same source IP within a 60-second window, indicating potential exfiltration or unauthorized data movement over Bluetooth.
Page 19 of 26