Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
532 detections
Filters
Last updated
All Time
Detection languages
207
185
44
24
19
Contributors
154
107
100
72
18
Categories
20,440
11,814
5,871
5,145
4,864
Platforms
291
209
74
56
23
Products / Services
194
142
120
110
21
MITRE Techniques
296
147
118
86
85
CVEs
5
3
1
1
1
IDS Classtypes
78
69
17
8
5
IDS Protocols
85
51
18
9
9
Detects high-volume outbound network traffic (exceeding 50MB) directed towards known consumer-grade cloud storage and anonymous file-sharing services. This activity can indicate data exfiltration, as these services are frequently abused to bypass security controls while masking data movement within legitimate-appearing traffic.
Detects high-frequency outbound HTTP/HTTPS connections to a single external destination characterized by consistent, small payload sizes. This pattern is indicative of automated command-and-control (C2) beaconing, commonly observed in frameworks like Cobalt Strike or Sliver.
This rule detects a single device making a high volume of connections to known machine learning model and dataset hosting repositories (e.g., Hugging Face, Kaggle, TensorFlow) within a short timeframe. Such activity may indicate bulk exfiltration of sensitive internal research data, proprietary models, or large datasets.
Detects a multi-stage exfiltration sequence consisting of: (1) bulk file archival/compression using common utilities, (2) suspicious OAuth grant or service principal authorization, and (3) abnormal network egress volume to common ports. This pattern suggests an adversary is preparing data, establishing or leveraging an identity/application for cloud access, and subsequently exfiltrating data.
This rule detects network traffic associated with Lumma Stealer information-stealing malware, specifically identifying HTTP POST requests that utilize the 'TeslaBrowser/5.5' user agent. This pattern is indicative of the malware exfiltrating stolen data to its Command and Control (C2) server.
This rule monitors outbound TLS traffic to detect communication between a potentially compromised internal host and the DeepSeek API. This behavior is associated with the 'CLOSEDQUORUM' malware family, which utilizes LLM-based voting mechanisms for command and control (C2) operations via third-party AI services.
This rule detects anomalous activity involving cloud-based shell services (AWS CloudShell, Azure Cloud Shell, GCP Cloud Shell). It triggers on two main conditions: (1) First-time usage of these shell environments by a principal within the detection window, and (2) The execution of commands associated with data staging, ingress tool transfer, or exfiltration (e.g., curl, wget, storage copy commands).
Detects inbound command-and-control traffic to the MOVEit Transfer application targeting the LEMURLOOT web shell, and subsequent detection of gzip-compressed database exfiltration.
Detects NeedyMantis' initial C2 beacon: an HTTP GET to /library/zip/ on port 443, anchored to the URI root, carrying a client-originated 'Set-Cookie:' header (clients normally send 'Cookie:', never 'Set-Cookie:' -- this direction reversal is the core anomaly and is near-impossible for legitimate traffic) alongside an explicit 'Upgrade: websocket' header. Matching the literal header text (not just header-name presence) and anchoring the URI removes generic WebSocket apps and any unrelated path containing '/library/zip/' as a substring.
Detects high-volume outbound data transfers (exceeding 100MB) directed towards common cloud storage providers, file sharing services, and AI model endpoints. This behavior is indicative of potential data exfiltration by an adversary using legitimate web services to bypass traditional network security controls.
This rule detects potential DNS tunneling activity by analyzing DNS query logs for high entropy in subdomains, elevated volumes of TXT/NULL record types, and frequent NXDOMAIN responses. This pattern is characteristic of command-and-control (C2) or data exfiltration techniques using tools like dnscat2 or iodine, which encode data into DNS query labels.
This rule detects potential command-and-control (C2) activity by correlating the creation of known Cobalt Strike or Sliver framework named pipes with subsequent repeated HTTP/S network beaconing from the same process or host. The rule identifies processes establishing suspicious named pipes, then looks for persistent network connections to standard web ports (80, 443) within a 30-minute window, flagging instances where significant beaconing count is observed.
This rule detects potential DNS tunneling activities often used for Command and Control (C2) communication. It monitors for high volumes of DNS requests involving records commonly abused for tunneling (TXT, NULL, CNAME) from a single host to a specific parent domain. It further identifies suspicious patterns characterized by long, high-entropy subdomain labels (>45 characters) and a high frequency of distinct labels, which are indicative of encoded C2 traffic.
Detects high-volume outbound network connections over port 443 with significant duration, which is indicative of staged data exfiltration activity. The rule identifies sustained transfers exceeding 50MB that last longer than 5 minutes, targeting non-local network destinations.
This rule detects potential cost harvesting or service abuse against AI gateway endpoints. It establishes a baseline of typical user activity over a 30-day period and flags anomalies where current request volume (in the last 1 hour or 24 hours) significantly exceeds the user's established P95 baseline. To reduce noise, it specifically identifies scenarios where these high-frequency requests are associated with low-complexity, short prompts, which are indicative of automated probing or resource-intensive scraping rather than legitimate high-utility usage.
Detects high-volume network activity from a single device/process to public IP addresses over common ports (80, 443) or UDP protocol. This behavior is indicative of potential command and control communication, automated data exfiltration, or a scanning attempt.
Detects a sequence of activity indicative of data exfiltration preparation. This rule identifies the creation of multiple large archive files (.zip, .rar, .7z) in temporary or staging directories on an endpoint, followed by a network connection transferring a significant volume of data to an external, non-private IP address within a 30-minute window.
Detects network communication associated with VelvetCake C2 infrastructure, including plaintext authentication, specific inventory request commands, and session termination commands over port 12345.
Detects two distinct behaviors indicative of potential credential theft or lateral movement: DCSync-style Active Directory replication requests identified via Event ID 4662 with specific replication GUIDs, and high-volume SMB traffic originating from Domain Controllers or DC-adjacent hosts, which may indicate unauthorized data access or credential dumping activities.
Detects NeedyMantis' initial C2 beacon: an HTTP GET to /library/zip/ on port 443, anchored to the URI root, carrying a client-originated 'Set-Cookie:' header (clients normally send 'Cookie:', never 'Set-Cookie:' -- this direction reversal is the core anomaly and is near-impossible for legitimate traffic) alongside an explicit 'Upgrade: websocket' header. Matching the literal header text (not just header-name presence) and anchoring the URI removes generic WebSocket apps and any unrelated path containing '/library/zip/' as a substring.
Detects NeedyMantis' initial C2 beacon: an HTTP GET to /library/zip/ on port 443, anchored to the URI root, carrying a client-originated 'Set-Cookie:' header (clients normally send 'Cookie:', never 'Set-Cookie:' -- this direction reversal is the core anomaly and is near-impossible for legitimate traffic) alongside an explicit 'Upgrade: websocket' header. Matching the literal header text (not just header-name presence) and anchoring the URI removes generic WebSocket apps and any unrelated path containing '/library/zip/' as a substring.
Page 2 of 26