Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
226 detections
Filters
Last updated
All Time
Detection languages
156
25
12
9
7
Contributors
51
37
26
19
14
Categories
189
46
44
31
26
Platforms
108
39
34
32
30
Products / Services
67
43
22
16
15
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
5
1
1
1
IDS Classtypes
4
3
1
1
IDS Protocols
7
1
1
This rule detects the creation of a 'logs.dat' file, which is often associated with Remcos RAT for data exfiltration, in common user-related directories (AppData, Temp, Users, Documents) with a file size greater than or equal to 100KB. This pattern suggests an attempt to stage or exfiltrate collected data.
Detects outbound email from an organizational mailbox to a common consumer email provider with multiple or large attachments. This could indicate data exfiltration or unauthorized transfer of sensitive information.
Detects network connections to the typosquatted domain 'perplexity-ai.online', associated with a malicious browser extension used for data exfiltration. Additionally, it detects the creation or modification of 'background.js' files within common web browser extension directories, which is a common persistence mechanism for malicious extensions.
This rule detects potential data exfiltration by identifying devices that make a high number of network connections (3 or more within an hour) to various remote IPs using common file transfer and email protocols (FTP, SFTP, SMB, SMTP) on their standard ports (21, 22, 445, 25, 587). This pattern can indicate an adversary attempting to exfiltrate collected data from a compromised system.
Detects WinSCP command-line use that performs scripted uploads, synchronisation, or non-interactive transfer, which could indicate data exfiltration or automated file transfers.
This rule detects the execution of cloud transfer tools such as rclone, WinSCP, Dropbox, OneDrive, or curl.exe when their command line arguments indicate the transfer of mailbox-related files (PST, OST, or temporary files with 'ts_' prefix) and include keywords like 'copy', 'sync', 'put', 'upload', or 'transfer'. The rule focuses on the causality chain to identify the actor and processes involved in such activities, which could indicate data exfiltration.
Detects large data transfers occurring outside normal business hours
Detects a non-Discord process preparing multipart attachment data from a local path for upload through a messaging API. This behavior is indicative of malware like EchoCreep exfiltrating data via messaging platforms.
Detects rclone copy, sync, move, or copyto operations with options commonly used for unattended bulk transfer, indicating potential data exfiltration to cloud storage.
Detects bulk export of CRM customer data for collection and theft
Detects the creation of temporary files containing harvested tokens in the /tmp/ directory. This activity is indicative of a script using these files as a staging ground before network exfiltration. The rule specifically looks for file creation events in '/tmp/' where the filename contains 'tokens' and the initiating process is a common shell or text processing utility.
Detects a sender transmitting many attachment-bearing messages or a large aggregate attachment volume to external recipients within thirty minutes. This could indicate data exfiltration or a compromised account being used to send spam or malware.
Detects bulk export of CRM customer data for collection and theft
Detects large data transfers occurring outside normal business hours
This rule detects an unusual spike in 'Export' or 'Download' operations within Azure Activity logs by a single caller. It triggers when a user performs 5 or more such operations within an hour, which could indicate data exfiltration attempts or suspicious data access patterns.
Detects bulk export of Confluence wiki content
Detects the creation or alteration of a SQL trigger that utilizes sp_invoke_external_rest_endpoint. Attackers can abuse database triggers to automatically exfiltrate newly added credentials or sensitive records in real-time.
Detects bulk file reading from network shares for data collection
This rule identifies when a single account creates three or more files containing 'backup', 'export', or 'dump' in their filenames within a one-hour period. This activity could be indicative of data staging for exfiltration or an attempt to back up sensitive information prior to a malicious action.
Detects bulk file reading from network shares for data collection
This rule detects when a single user downloads 100 or more files from SharePoint within a one-hour period. This activity could indicate data exfiltration or unauthorized bulk access to sensitive documents.
Page 5 of 11