Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
667 detections
Filters
Last updated
All Time
Detection languages
304
127
82
42
35
Contributors
151
83
80
37
31
Categories
442
354
165
142
112
Platforms
398
212
86
70
20
Products / Services
184
122
103
93
65
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
5
3
3
1
1
IDS Classtypes
74
35
7
6
3
IDS Protocols
71
22
17
7
2
This rule detects suspicious activity where scripting interpreters (node.exe, python.exe, pwsh.exe, powershell.exe) are observed accessing a large number of potentially sensitive files (e.g., .env, secret, wallet, keypair, credential, recovery files, or common document/data file types like .pdf, .docx, .csv, .json, .txt) and subsequently exfiltrating a significant amount of data over the network. It correlates file access events with network outbound traffic from the same process within a 10-minute window, flagging instances where more than 20 distinct sensitive files are accessed and over 500KB of data is sent out.
Detects potential Raven Stealer activity by identifying known artifacts such as specific file paths, created filenames, command-line arguments, network connections, and file hashes.
Detects when a non-browser process initiates network communication with the Telegram API. This activity is suspicious as it could indicate the use of Telegram for covert command and control (C2) or data exfiltration by malware, bypassing typical browser-based interactions.
Detects the HazyBeacon backdoor, which leverages AWS Lambda URLs for C2 communication and uses custom tools for data exfiltration. The rule identifies known malicious file hashes, suspicious tool drops in C:\ProgramData, specific service creation commands for persistence, and network connections from the sideloaded host process (mscorsvw.exe) to AWS Lambda URLs.
Detects Odyssey Infostealer, a macOS malware known for stealing sensitive data and establishing persistence. This rule identifies specific strings related to its C2 communication, data theft, and persistence mechanisms.
Generic rule content from file: LOLBAS - Execution - Outbound Traffic to Suspicious TLD
KQL Query from file: NauthNRPC Detection
KQL Query
KQL Query
KQL Query
Detects network communication patterns associated with the SparkKitty mobile spyware, which exfiltrates sensitive data, including images, by connecting to known command and control servers or using specific API endpoints.
KQL Query
KQL Query from file: Sentinel - Threat Hunting DNS Tunneling
KQL Query from file: DefenderXDR - Threat Hunting DNS Tunneling
KQL Query from file: Entra User Account Compromised by C2
KQL Query from file: Threat Intelligence Data from Sentinel UEBA
KQL Query
KQL Query
KQL Query
KQL Query from file: Ottercookie Detection
KQL Query from file: Malware C2 Comms over Azure Blob Metadata
Page 28 of 32