Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
532 detections
Filters
Last updated
All Time
Detection languages
207
185
44
24
19
Contributors
154
107
100
72
18
Categories
20,440
11,814
5,871
5,145
4,864
Platforms
291
209
74
56
23
Products / Services
194
142
120
110
21
MITRE Techniques
296
147
118
86
85
CVEs
5
3
1
1
1
IDS Classtypes
78
69
17
8
5
IDS Protocols
85
51
18
9
9
This rule detects devices exhibiting high volume outbound network traffic, specifically more than 10MB of data transferred across more than 100 sessions to a single remote IP address within a one-minute window. This behavior can be indicative of data exfiltration, unauthorized data transfer, or other suspicious network activity.
This rule detects suspicious large file transfers over the network, specifically looking for connections where more than 100MB (104857600 bytes) of data has been sent or received. It then aggregates these transfers by device and remote IP within one-hour bins and flags if five or more such large transfers occur within that hour. This behavior can be indicative of data exfiltration, often associated with ransomware attacks or other malicious data theft activities.
This rule detects multiple TFTP (Trivial File Transfer Protocol) transfers to port 69 on the home network within a short timeframe. Specifically, it triggers an alert if three or more TFTP transfers from the same source IP address occur within a 30-second window. This activity can be indicative of a Pre-Boot Execution Environment (PXE) boot process, which often uses TFTP to transfer boot files, or potentially malicious activity involving file transfers via TFTP.
This rule detects when a batch script (.bat) is dropped onto a network share, specifically targeting the NETLOGON share, which is often used for logon scripts. This activity can be indicative of an attacker attempting to establish persistence or execute malicious code on systems that process logon scripts from this share. The rule triggers if three such events are observed from the same source within 60 seconds.
This rule detects potential data exfiltration to Dropbox cloud storage. It specifically looks for HTTP POST requests to 'api.dropboxapi.com' with a data size greater than 10000 bytes. This indicates a significant amount of data being uploaded to Dropbox, which could be a sign of unauthorized data transfer.
This rule detects potential sensitive data exfiltration to a web service. It triggers when an HTTP POST request is made from the home network to any destination, and the request body size is greater than 10,000 bytes. A threshold is applied, alerting if 10 such events occur from the same source IP within 60 seconds. This pattern suggests a large amount of data being uploaded, which could indicate exfiltration.
This rule detects potential data exfiltration of USB drive contents over SSH using SCP. It triggers when TCP traffic on port 22 (SSH) from the home network to the home network contains the string "/dev/sd" (case-insensitive) and the data size is greater than 65000 bytes. This combination suggests that a file from a Linux-like USB device (often mounted as /dev/sdX) is being transferred out via SCP.
This rule detects bulk file copies to USB drives via SMB by looking for the string "USBSTOR" (case-insensitive) within SMB traffic on port 445. A threshold of 100 occurrences within 60 seconds from the same source IP triggers the alert, indicating a potential exfiltration attempt.
This rule detects HTTP POST requests from the home network to any external server where the request body size is greater than 10000 bytes. It uses a threshold to alert if 5 such events occur from the same source IP within an hour, indicating a potential cron-timed data upload or exfiltration attempt.
This rule detects HTTP responses where the 'Content-Type' header is 'application/json' and the response body contains both 'balance' and '0.00' (case-insensitive). This combination, especially in the context of a 'trojan-activity' classification, suggests a potential Man-in-the-Middle (MitM) attack manipulating financial or account balance data within a JSON response to show a zero balance.
This rule detects the use of SFTP (Secure File Transfer Protocol) as a covert command and control (C2) data channel. It specifically looks for TCP traffic on port 22 (SFTP's default port) with a specific content pattern ('|00 00 00|') within the first 4 bytes of the payload, a payload size between 100 and 500 bytes, and a high frequency (20 times in 60 seconds) from a single source IP address. This pattern and frequency could indicate an attempt to exfiltrate data or maintain C2 communication disguised as legitimate SFTP traffic.
This rule detects a high volume of file read operations from a network share that contains the string "USBSTOR" in its content, indicating potential access to removable media. It triggers an alert if more than 50 such events occur within a 30-second window from the same source IP address. This could signify an attempt to exfiltrate data from a removable device shared over the network.
This rule detects a high volume of Real-time Transport Protocol (RTP) video stream traffic originating from the home network and destined for external servers. Specifically, it triggers an alert if more than 100 UDP packets with a data size greater than 1000 bytes are observed from a single source IP address within a 10-second window. This pattern could indicate unauthorized video streaming or data exfiltration.
This rule detects the exfiltration of a webcam video stream over HTTP POST. It specifically looks for HTTP POST requests containing file data, where the data starts with the hexadecimal sequence '52 49 46 46' (which corresponds to 'RIFF', a common header for multimedia file formats like AVI and WAV) and has a size greater than 100,000 bytes. This combination suggests a large multimedia file, potentially a video, being uploaded.
This rule detects when a file with the ".pst" extension (Outlook Personal Storage Table file) is copied locally via the Server Message Block (SMB) protocol. This could indicate data exfiltration or unauthorized access to sensitive email archives.
This rule detects the delivery of a payload that attempts to perform process hollowing using the Runpe technique. It specifically looks for the presence of the Windows API functions 'ZwUnmapViewOfSection' and 'WriteProcessMemory' within HTTP file data being sent to a client. These functions are commonly used in process hollowing to unmap a legitimate process's memory and write malicious code into it.
This rule detects the delivery of a payload containing the string "/proc/self/mem" over HTTP to a client. This string is often associated with process memory write injection techniques, particularly on Linux systems, where an attacker might attempt to write malicious code directly into a process's memory space by interacting with the /proc/self/mem pseudo-file. The rule specifically looks for this content within the file data of an HTTP response flowing to the client.
This rule detects large data uploads over HTTPS (port 443) from the home network to any external destination. Specifically, it triggers if the data size in a single TCP flow to the server exceeds 65,000 bytes. To prevent excessive alerts, it uses a threshold of 20 such events within 60 seconds, tracked by the source IP address. This behavior is indicative of potential data exfiltration.
This rule detects sustained outbound network traffic with a data size greater than 1000 bytes, originating from the home network. It triggers an alert if 200 such connections are observed from the same source IP address within a 300-second window. This behavior is indicative of automated exfiltration, where an attacker continuously sends data out of the network.
This rule detects when an executable file (.exe) is dropped into a Windows 'Start Menu\Programs\Startup' folder via Server Message Block (SMB). This is a common technique used by attackers to establish persistence on a compromised system, ensuring that their malicious code runs every time the user logs in or the system starts.
This rule detects suspicious large file transfers over the network, specifically looking for connections where more than 100MB (104857600 bytes) of data has been sent or received. It then aggregates these transfers by device and remote IP within one-hour bins and flags if five or more such large transfers occur within that hour. This behavior can be indicative of data exfiltration, often associated with ransomware attacks or other malicious data theft activities.
Page 22 of 26