Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
226 detections
Filters
Last updated
All Time
Detection languages
156
25
12
9
7
Contributors
51
37
26
19
14
Categories
189
46
44
31
26
Platforms
108
39
34
32
30
Products / Services
67
43
22
16
15
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
5
1
1
1
IDS Classtypes
4
3
1
1
IDS Protocols
7
1
1
This rule detects unusually large network uploads from devices. It identifies successful network connections where individual transfers exceed 100MB and aggregates these transfers by account name and hour. The rule then flags any account that has uploaded a total of 1TB or more within a single hour. This pattern could indicate data exfiltration, unauthorized data synchronization, or other malicious activities involving significant data transfer volumes.
Detects data exfiltration occurring over non-standard alternate network mediums
This rule detects an abnormal volume of large file downloads or exports from cloud applications, excluding SharePoint, OneDrive, and Teams. It identifies instances where a single account downloads or exports more than 3 files with an average size greater than 10 MB within an hour from a specific application and IP address. This behavior could indicate data exfiltration or unauthorized data access.
This rule detects when a single user downloads 100 or more files from SharePoint within a one-hour period. This activity could indicate data exfiltration or unauthorized bulk access to sensitive documents.
Detects bulk email collection via IMAP protocol for mass email harvesting
Detects automated sustained outbound data transfers indicative of automated exfiltration
Detects large internal data transfers used for staging before exfiltration
Detects unusually large outbound network data transfers (over 1TB) from a single process account within an hour. This could indicate data exfiltration, unauthorized bulk data synchronization, or other malicious activity where large volumes of data are being moved out of the environment.
Detects an unusually high number of file copy operations to 'public' or 'external' folders within a one-hour window, initiated by the same process account. This behavior could indicate data exfiltration or unauthorized data staging.
Detects unusually large outbound network data transfers (over 1TB) from a single process account within an hour. This could indicate data exfiltration, unauthorized bulk data synchronization, or other malicious activity where large volumes of data are being moved out of the environment.
This rule detects suspicious file export activity by monitoring for the creation of files with names containing keywords like 'export', 'dump', or 'extract'. It triggers an alert if five or more such files are created by the same account within a one-hour window, indicating potential data exfiltration or staging.
This rule detects outbound network connections to URLs associated with common file sharing services (e.g., Dropbox, Mega, Gofile) or temporary email providers (e.g., Temp-Mail). Such connections can indicate data exfiltration attempts, use of unsanctioned services, or communication with command and control infrastructure.
Detects repeated 'git clone' or 'git fetch' commands executed on a system within a short timeframe. This activity could indicate an adversary attempting to exfiltrate data from a code repository or staging environment, or rapidly pull down multiple repositories.
This rule detects unusually large network uploads from devices. It identifies successful network connections where individual transfers exceed 100MB and aggregates these transfers by account name and hour. The rule then flags any account that has uploaded a total of 1TB or more within a single hour. This pattern could indicate data exfiltration, unauthorized data synchronization, or other malicious activities involving significant data transfer volumes.
Detects an unusually high number of file copy operations to 'public' or 'external' folders within a one-hour window, initiated by the same process account. This behavior could indicate data exfiltration or unauthorized data staging.
This rule detects when an account copies five or more files, each larger than 50MB, within a one-hour period. This activity could indicate data exfiltration or staging for exfiltration.
Detects when a single account initiates a high volume of Office file (Word, Excel, PowerPoint) copy or move operations within a one-hour window. This could indicate data exfiltration or staging activities.
This rule identifies accounts that create or modify 10 or more files, each larger than 200MB, within a one-hour period. This behavior can be indicative of data exfiltration, staging of large files, or other suspicious bulk file operations.
Detects the execution of WinSCP or Rclone binaries, which are heavily utilized by threat actors like UNC3753 as portable utilities to rapidly exfiltrate staged data.
This rule detects devices exhibiting high volume outbound network traffic, specifically more than 10MB of data transferred across more than 100 sessions to a single remote IP address within a one-minute window. This behavior can be indicative of data exfiltration, unauthorized data transfer, or other suspicious network activity.
This rule detects suspicious large file transfers over the network, specifically looking for connections where more than 100MB (104857600 bytes) of data has been sent or received. It then aggregates these transfers by device and remote IP within one-hour bins and flags if five or more such large transfers occur within that hour. This behavior can be indicative of data exfiltration, often associated with ransomware attacks or other malicious data theft activities.
Page 6 of 11