Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
532 detections
Filters
Last updated
All Time
Detection languages
207
185
44
24
19
Contributors
154
107
100
72
18
Categories
20,440
11,814
5,871
5,145
4,864
Platforms
291
209
74
56
23
Products / Services
194
142
120
110
21
MITRE Techniques
296
147
118
86
85
CVEs
5
3
1
1
1
IDS Classtypes
78
69
17
8
5
IDS Protocols
85
51
18
9
9
This rule detects the exfiltration of a GitHub Personal Access Token (PAT) over HTTP. It specifically looks for the string "ghp_" in the client body of HTTP traffic, which is a common prefix for GitHub PATs. The rule is designed to identify instances where a PAT might be sent from an internal network to an external server, indicating potential credential compromise or data exfiltration.
This rule detects potential video stream exfiltration over HTTP POST. It specifically looks for HTTP POST requests with a large payload size (greater than 100,000 bytes) and the byte sequence '|52 49 46 46|' at the beginning of the file data, which corresponds to the 'RIFF' header commonly found in multimedia file formats like AVI and WAV. This combination suggests an attempt to upload or exfiltrate video or audio data.
This rule detects potential data exfiltration to an AWS S3 bucket. It triggers on HTTP PUT requests to 's3.amazonaws.com' with a payload size greater than 10000 bytes. This could indicate an attacker uploading sensitive data from the internal network to an external S3 bucket they control.
This rule detects potential Secure File Transfer Protocol (SFTP) large file exfiltration attempts. It triggers an alert when a TCP connection on port 22 (SFTP) from the home network to any destination transfers a large amount of data (greater than 65000 bytes) to the server. A threshold of 20 such transfers within 60 seconds from the same source IP is set to reduce false positives. The rule specifically looks for the SFTP protocol magic bytes '|00 00 00|' within the first 4 bytes of the payload.
This rule detects large data exfiltration attempts over SMTP Submission (port 587). It triggers an alert if more than 50,000 bytes of data are sent from a single source IP address to a server via SMTP Submission, with a threshold of 5 such events within a 300-second window. This indicates a potential policy violation related to data exfiltration.
This rule detects large attachments being exfiltrated via SMTP. Specifically, it looks for SMTP traffic on port 25, flowing to the server, that contains the 'Content-Transfer-Encoding: base64' header and has a data size greater than 50,000 bytes. This combination suggests a large, base64-encoded file being sent as an email attachment, which could indicate data exfiltration.
This rule detects devices exhibiting high volume outbound network traffic, specifically more than 10MB of data transferred across more than 100 sessions to a single remote IP address within a one-minute window. This behavior can be indicative of data exfiltration, unauthorized data transfer, or other suspicious network activity.
This is targeted for YARA used in network sensors like Corelight versus scanning the disk.
Windows registry hive (regf format) observed in network file transfer - output of credential-dumping tooling regardless of filename or author. Triggers on SAM, SECURITY, or SYSTEM hives on the wire.
Windows registry hive (regf format) observed in network file transfer - output of credential-dumping tooling regardless of filename or author. Triggers on SAM, SECURITY, or SYSTEM hives on the wire.
Detects PowerShell processes executing 'Invoke-WebRequest' with command-line arguments containing 's3' and 'usoshared'. This combination could indicate an attempt to download or interact with S3 buckets, potentially for data exfiltration, staging, or retrieving malicious payloads, specifically referencing 'usoshared' which might be a specific bucket name or a keyword used by certain threat actors.
Detects unusual outbound network connections from ATM devices (identified by device names containing 'ATM', 'NCR', 'DIEBOLD', 'WINCOR'). The rule flags connections to public IP addresses, excluding common internal networks and standard web/DNS ports (80, 443, 53). Alerts are triggered if an ATM device shows a high number of connections, unique remote IPs, or significant data transfer, indicating potential compromise or unauthorized activity.
This rule detects potential exposure of Payment Card Industry (PCI) data, specifically Payment Account Numbers (PANs), within network traffic. It looks for keywords related to payment information (e.g., 'post', 'put', 'payment', 'card', 'ccnum', 'account number') in conjunction with sequences of 13 to 19 digits that resemble PANs. The rule attempts to filter out masked PANs (e.g., those containing '****' or 'xxxx'). This could indicate sensitive data being transmitted insecurely or logged inappropriately.
This rule identifies external domains sending a high number of unique links in Microsoft Teams messages over the last 7 days, excluding common trusted Microsoft domains. It aims to detect potential phishing attempts or unusual external communication patterns that might indicate malicious activity or data exfiltration.
This rule detects activity related to the DKnife gateway AitM (Adversary-in-the-Middle) threat, as detailed in Talos Intelligence reporting. It identifies specific binary names (dknife.bin, sslmm.bin, postapi.bin, rules.bin, sshapi.bin, inotify.bin, curlapi.bin) associated with the threat, either as process names or file names. Additionally, it looks for configuration artifacts (rules.conf, sslmm.cfg, url.cfg) used by the proxy/redirect logic, either as file names or within process command lines. Finally, the rule identifies exfiltration or tagging markers (dkimsi=, 460110672021628, PASSWORD) observed in logs or artifacts, which are indicative of DKnife's reporting mechanisms.
Detects the use of curl.exe to upload data to the temp.sh file-sharing service. This technique has been observed in post-compromise reconnaissance activities, including those following Notepad++ compromises.
Detects large volumes of outbound data transfers using the Cyberduck application to known cloud storage providers. The Qilin ransomware group has been observed using Cyberduck for data exfiltration.
Detects unique strings associated with the JSKit iOS exploitation framework in network traffic. This framework is used by multiple threat actors, including the commercial surveillance vendor Intellexa, to deliver spyware like Predator.
Cisco Stage Data
Sigma
Various protocols maybe used to put data on the device for exfil or infil
The analytic detects potential data exfiltration using PowerShell's Invoke-RestMethod. It leverages PowerShell Script Block Logging to identify scripts that attempt to upload files via HTTP POST requests. This activity is significant as it may indicate an attacker is exfiltrating sensitive data, such as desktop screenshots or files, to an external command and control (C2) server. If confirmed malicious, this could lead to data breaches, loss of sensitive information, and further compromise of the affected systems. Immediate investigation is recommended to determine the intent and scope of the activity.
The following analytic detects the high-frequency exfiltration of archive files via HTTP POST requests. It leverages HTTP stream logs to identify specific archive file headers within the request body. This activity is significant as it often indicates data exfiltration by APTs or trojan spyware after data collection. If confirmed malicious, this behavior could lead to the unauthorized transfer of sensitive data to an attacker’s command and control server, potentially resulting in severe data breaches and loss of confidential information.
The analytic detects a high volume of outbound web traffic, specifically over 1GB of data sent to a URL within a 2-minute window. It leverages web access logs to identify significant uploads by analyzing the sum of bytes out. This activity is significant as it may indicate potential data exfiltration by malware or malicious insiders. If confirmed as malicious, this behavior could lead to unauthorized data transfer, resulting in data breaches and loss of sensitive information. Immediate investigation is required to determine the legitimacy of the transfer and mitigate any potential threats.
The following analytic identifies potential data exfiltration using the PowerShell `net.webclient` command with the `UploadString` method. It leverages PowerShell Script Block Logging to detect instances where this command is executed. This activity is significant as it may indicate an attempt to upload sensitive data, such as desktop screenshots or files, to an external or internal URI, often associated with malware like Winter-Vivern. If confirmed malicious, this could lead to unauthorized data transfer, compromising sensitive information and potentially leading to further exploitation of the compromised host.
Page 24 of 26