Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
379 detections
Filters
Last updated
All Time
Detection languages
170
71
34
34
18
Contributors
89
76
55
21
16
Categories
283
178
76
67
52
Platforms
222
84
83
61
34
Products / Services
92
66
57
37
33
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
5
1
1
1
1
IDS Classtypes
23
6
3
1
1
IDS Protocols
13
11
4
3
2
Well-known TAP software installation. Possible preparation for data exfiltration using tunneling techniques
Detects a suspicious output redirection to the local admins share, this technique is often found in malicious scripts or hacktool stagers
Well-known TAP software installation. Possible preparation for data exfiltration using tunnelling techniques
The analytic identifies potential DNS exfiltration using the nslookup application. It detects specific command-line parameters such as query type (TXT, A, AAAA) and retry options, which are commonly used by attackers to exfiltrate data. The detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process execution logs. This activity is significant as it may indicate an attempt to communicate with a Command and Control (C2) server or exfiltrate sensitive data. If confirmed malicious, this could lead to data breaches and unauthorized access to critical information.
The analytic identifies spikes in blocked outbound network connections originating from within an AWS environment. It uses VPC Flow Logs data from CloudWatch, specifically looking for 'blocked' actions from internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) to external destinations. A spike is determined by comparing the current number of blocked connections against a calculated baseline (average and standard deviation) over time. This detection is significant as it can indicate potential exfiltration attempts or misconfigurations leading to data leakage. If confirmed malicious, such activity could allow attackers to bypass network defenses, leading to unauthorized data transfer or communication with malicious external entities.
The following analytic identifies high inbound or outbound network I/O anomalies in Kubernetes containers. It leverages process metrics from an OTEL collector and Kubelet Stats Receiver, along with data from Splunk Observability Cloud. A lookup table with average and standard deviation values for network I/O is used to detect anomalies persisting over a 1-hour period. This activity is significant as it may indicate data exfiltration, command and control communication, or unauthorized data transfers. If confirmed malicious, it could lead to data breaches, service outages, financial losses, and reputational damage.
This analytic detects excessive usage of the nslookup application, which may indicate potential DNS exfiltration attempts. It monitors process executions, specifically focusing on nslookup.exe, and identifies outliers by comparing the frequency of nslookup executions against a calculated threshold. This activity is significant as it can reveal attempts by malware or APT groups to exfiltrate data via DNS queries. If confirmed malicious, this behavior could allow attackers to stealthily transfer sensitive information out of the network, bypassing traditional data exfiltration defenses.
This analytic detects when Microsoft Office 365 Data Loss Prevention (DLP) rules have been triggered. DLP rules are configured for security, regulatory, or business compliance reasons. Detections from this analytic should be thoroughly evaluated to determine the security relevance of the underlying DLP events. The accuracy of this analytic depends on the upstream DLP configuration.
The following analytic identifies when an O365 email account sends an excessive number of email attachments to external recipients within a short period (within 1 hour). This behavior may indicate a compromised account where the threat actor is attempting to exfiltrate data from the mailbox. Threat actors may attempt to transfer data through email as a simple means of exfiltration from the compromised mailbox. Some account owner legitimate behaviors can trigger this alert, however these actions may not be aligned with organizational expectations / best practice behaviors.
This analytic detects a Windows application establishing an SMTP connection from a non-common installation path. It leverages Sysmon EventCode 3 to identify processes not typically associated with email clients (e.g., Thunderbird, Outlook) making SMTP connections. This activity is significant as adversaries, including malware like AgentTesla, use such connections for Command and Control (C2) communication to exfiltrate stolen data. If confirmed malicious, this behavior could lead to unauthorized data exfiltration, including sensitive information like desktop screenshots, browser data, and system details, compromising the affected host.
Detects the installation of a well-known TAP driver service, specifically looking for the 'tap0901' service file name. This activity could indicate preparation for data exfiltration using tunneling techniques, as TAP drivers are often used by VPN software like OpenVPN to create virtual network interfaces.
Detects the execution of copy commands or utilities (robocopy, xcopy, cmd copy, PowerShell Copy-Item/Move-Item) targeting or originating from Windows Admin shares (e.g., C$) or the Sysvol folder. This activity can indicate lateral movement, data collection, or exfiltration by an adversary.
This rule detects the installation of a TAP (Tunnel Adapter) driver, specifically looking for 'tap0901' in the service's ImagePath. TAP drivers are commonly used by VPN software like OpenVPN to create virtual network interfaces, which can be leveraged for tunneling and data exfiltration. The detection aims to identify potential preparation for data exfiltration using tunneling techniques.
Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. This rule detects suspicious outbound SMTP connections by looking for connections to common SMTP ports (25, 587, 465, 2525) from processes that are not common mail client applications like Thunderbird or Outlook, or Microsoft Exchange Server processes.
Detects suspicious output redirection to the local administrative share (ADMIN$). This technique is often used by malicious scripts or hack tools to stage or exfiltrate data by writing it to a location accessible via the network, specifically targeting the ADMIN$ share on localhost or 127.0.0.1.
This rule detects the execution of the Invoke-DNSExfiltrator PowerShell cmdlet, which is used for exfiltrating data over a DNS request covert channel. The detection specifically looks for the presence of the cmdlet name along with common parameters such as '-i', '-d', '-p', '-doh', and '-t', indicating an attempt to use the DNSExfiltrator tool.
This rule detects the execution of 'tapinstall.exe', which is used to install TAP (Tunnel Adapter) drivers. While legitimate for VPN software like OpenVPN, Avast SecureLine VPN, and ProtonVPN, its execution outside of these known contexts could indicate an adversary preparing for data exfiltration using tunneling techniques. TAP drivers create virtual network interfaces, which can be leveraged to establish covert communication channels or bypass network segmentation.
Detects the installation of a well-known TAP driver service. This could be a sign of potential preparation for data exfiltration using tunnelling techniques.
Well-known TAP software installation. Possible preparation for data exfiltration using tunneling techniques
Well-known TAP software installation. Possible preparation for data exfiltration using tunnelling techniques
Detects a suspicious output redirection to the local admins share, this technique is often found in malicious scripts or hacktool stagers
Page 18 of 19