Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
379 detections
Filters
Last updated
All Time
Detection languages
170
71
34
34
18
Contributors
89
76
55
21
16
Categories
283
178
76
67
52
Platforms
222
84
83
61
34
Products / Services
92
66
57
37
33
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
5
1
1
1
1
IDS Classtypes
23
6
3
1
1
IDS Protocols
13
11
4
3
2
Detects the use of the FTP STOR command to transfer files with sensitive extensions (.docx, .pdf, .xlsx, .zip, .7z) to external networks. This behavior is indicative of potential data exfiltration via an unencrypted alternative protocol.
Detects outbound HTTP POST requests where the Content-Length is at least 10MB and the Content-Type header indicates the transfer of archived data (zip or x-tar). This pattern is often associated with the staging and exfiltration of compressed sensitive data from an internal host to an external network destination.
This rule detects outbound FTP traffic containing the 'STOR' command, which is used in the FTP protocol to upload files to a remote server. This behavior is a common indicator of unauthorized data exfiltration.
Detects the WinSCP utility initiating an outbound network connection to port 22 (SFTP/SCP). This behavior is often associated with post-compromise activity where adversaries use legitimate file transfer tools to exfiltrate data to attacker-controlled infrastructure.
Hunting rule for tar archive creation of user home trees, common staging before scp/rsync exfiltration over SSH. Prioritize /tmp archives and remote copy in the same session.
Hunting rule for tar archive creation of user home trees, common staging before scp/rsync exfiltration over SSH. Prioritize /tmp archives and remote copy in the same session.
This rule detects potential data exfiltration attempts by monitoring for network connections to URLs containing suspicious substrings (bit, onion, .cc, .su) over common web and DNS ports (53, 80, 443, 8080). It flags high-frequency unique connection attempts from a single device, which may indicate command-and-control (C2) traffic or data exfiltration over covert channels.
This rule monitors for malicious Chrome extension activity involving the redirection of address bar inputs to an unauthorized domain (perplexity-ai.online). It identifies indicators of compromise across device network logs (connectivity to the malicious C2), file system events (presence of the identified malicious extension identifier), and generic device events (log entries containing the malicious extension ID or C2 URL). This pattern is indicative of a browser-based keystroke exfiltration attack.
Detects anomalous activity associated with information stealing malware, including unauthorized access to browser credential files (Login Data, Cookies), remote thread injection into browser processes, outbound connections to the Telegram API by non-browser processes, and rapid bulk access to multiple sensitive credential or crypto wallet files.
This rule detects potential web shell activity on Windows IIS servers by monitoring for suspicious process creation and file write events originating from the w3wp.exe worker process. Specifically, it flags when w3wp.exe spawns command shells (cmd, powershell), database management utilities (sqlcmd, osql), or network discovery/transfer tools (curl, wget, certutil, bitsadmin). It also detects the creation or modification of common web shell file extensions (.aspx, .ashx, .asmx) within web root directories.
Detects malicious browser extension activity related to the StegoAd infostealer. The rule identifies a dual-indicator pattern consisting of outbound network connections to 'mitarchive.info' combined with concurrent read access to browser-specific credential store files (Google Chrome, Microsoft Edge, Mozilla Firefox) on the same host.
This rule detects the use of native network utilities (wget.exe, curl.exe) executing with flags indicative of file uploads (HTTP PUT or POST) targeting archive files (zip, rar, 7z). This behavior is often associated with the direct exfiltration of staged data to attacker-controlled infrastructure.
Detects a sequence of events indicative of data exfiltration: an unknown process creates an image file in a temporary folder, followed by the creation of an archive file (ZIP/RAR) by the same or a related process within 10 minutes, and concludes with a successful outbound network connection to a non-private IP address from the same device.
This rule correlates multiple low-to-medium confidence signals across file, process, network, and registry events to detect potential ransomware activity. The rule identifies suspicious behaviors including mass file renames, creation of known ransom note file types in multiple directories, shadow copy deletion via system utilities, disabling of antivirus and security monitoring, large archive staging, unauthorized outbound network connections, and suspicious process injection. Alerts are generated based on the aggregation and frequency of these signals, indicating a high probability of ransomware-related malicious activity.
Tracks network connections from non-browser processes that transmit an abnormally large volume of outbound bytes, indicating active data exfiltration. This rule specifically excludes common browser processes (chrome.exe, msedge.exe, firefox.exe) and OneDrive (onedrive.exe) to reduce false positives. It aggregates outbound network activity over 10-minute intervals and flags any instance where the total outbound bytes exceed 100MB.
Detects outbound network connections to 'stitch-production.org' or connections by node/bun runtime processes to GitHub API or 'stitch-production.org', which may indicate command and control communication or data exfiltration.
This rule detects potential data staging and exfiltration behavior characterized by large volumes of outbound network data combined with high frequency file write operations across multiple file types. It monitors Sysmon Event IDs 3 (Network connection) and 11 (FileCreate) to identify indicators often associated with pre-encryption staging by ransomware or data theft campaigns.
This rule detects potential data staging and exfiltration behavior characterized by large volumes of outbound network data combined with high frequency file write operations across multiple file types. It monitors Sysmon Event IDs 3 (Network connection) and 11 (FileCreate) to identify indicators often associated with pre-encryption staging by ransomware or data theft campaigns.
Detects outbound proxy traffic originating from identified AI and automation agent user-agents (e.g., ChatGPT, Perplexity, Claude, etc.) attempting to access sensitive URI paths, such as credential files, SSH keys, configuration files, or cloud-hosted secrets. This may indicate an attempt to exfiltrate sensitive data to or through AI platforms.
Detects outbound HTTP POST requests where the Content-Length header indicates a data transfer of 5MB or greater. This pattern is indicative of potential unauthorized data exfiltration over the web protocol.
This rule detects the outbound transmission of email attachments via SMTP (ports 25 and 587) that contain archived file formats (zip, 7z, tar.gz, tgz). Attackers often compress collected data into archives to facilitate exfiltration and minimize the time required for data transfer.
Page 10 of 19