Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
379 detections
Filters
Last updated
All Time
Detection languages
170
71
34
34
18
Contributors
89
76
55
21
16
Categories
283
178
76
67
52
Platforms
222
84
83
61
34
Products / Services
92
66
57
37
33
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
5
1
1
1
1
IDS Classtypes
23
6
3
1
1
IDS Protocols
13
11
4
3
2
Detects instances where AI coding assistants or tools (e.g., Claude, Copilot, Gemini) invoke git.exe to clone or fetch repositories from non-standard (non-GitHub) hosts, followed by a checkout operation within a short timeframe. This behavior may indicate an attacker using automated tools to stage or exfiltrate sensitive code repositories to unauthorized infrastructure.
Detects network connections to known JeetBot infrastructure domains and IP addresses. The rule specifically identifies potential exfiltration of Twitch OAuth tokens via URL parameters or interaction with known token-collection proxy endpoints, which are associated with the JeetBot/Twitch Enhanced Viewer credential harvesting campaign.
Detects cloud data access or file download operations in Microsoft 365 (SharePoint, OneDrive, Exchange) performed by a user agent string associated with the python-httpx library. This pattern is often indicative of automated data exfiltration using custom scripts.
Detects network traffic directed towards Microsoft Graph API that utilizes the 'python-httpx' User-Agent. This combination is often associated with automated scripts, potentially used by adversaries (e.g., Storm-3121/Storm-3032) for automated data collection and exfiltration from Microsoft 365 environments.
Detects execution of processes associated with QuasarRAT or references to its configuration files, originating from or involving files and processes named 'UBPUpdater.exe' or 'UBPPatch.Psh'. Also identifies network connections via FTP or involving configuration files ('config.Ini') initiated by these specific processes, which may indicate malicious activity, command and control, or data exfiltration.
Detects network connections to command-and-control infrastructure associated with the JeetBot/Twitch Enhanced Viewer malicious browser extension. The rule triggers on connections to known malicious domains or IPs, as well as specific API endpoints on ambiguous domains that are used for exfiltrating Twitch OAuth tokens.
Detects network connections to command-and-control infrastructure associated with the JeetBot/Twitch Enhanced Viewer malicious browser extension. The rule triggers on connections to known malicious domains or IPs, as well as specific API endpoints on ambiguous domains that are used for exfiltrating Twitch OAuth tokens.
Detects network connections to known JeetBot infrastructure domains and IP addresses. The rule specifically identifies potential exfiltration of Twitch OAuth tokens via URL parameters or interaction with known token-collection proxy endpoints, which are associated with the JeetBot/Twitch Enhanced Viewer credential harvesting campaign.
Detects network connections to known JeetBot infrastructure domains and IP addresses. The rule specifically identifies potential exfiltration of Twitch OAuth tokens via URL parameters or interaction with known token-collection proxy endpoints, which are associated with the JeetBot/Twitch Enhanced Viewer credential harvesting campaign.
Detects instances where the outbound byte count to external (non-private) IP addresses for a source host significantly exceeds its historical hourly baseline. This detection is designed to identify potential data exfiltration stages occurring after system or network compromise.
Detects network connections to known JeetBot infrastructure domains and IP addresses. The rule specifically identifies potential exfiltration of Twitch OAuth tokens via URL parameters or interaction with known token-collection proxy endpoints, which are associated with the JeetBot/Twitch Enhanced Viewer credential harvesting campaign.
Detects instances where the outbound byte count to external (non-private) IP addresses for a source host significantly exceeds its historical hourly baseline. This detection is designed to identify potential data exfiltration stages occurring after system or network compromise.
Detects instances where a user or entity accessing a file (download, access, or preview) originates from an IP address identified as an anonymous proxy. This rule is designed to be used with a downstream aggregation tool to identify potentially unauthorized data exfiltration or access via anonymization services.
This rule detects high-volume file access, preview, or download activity from SaaS applications (SharePoint, OneDrive, Exchange Online) originating from IP addresses classified as anonymous proxies. The threshold is set to 1000 events within a 2-hour window, which is indicative of automated, high-speed data exfiltration rather than standard user behavior.
Detects instances where an Artifactory process or user accesses highly sensitive configuration files (system.yaml, join.key) or API endpoints containing configuration data, followed closely (within 15 minutes) by an outbound network connection to a non-standard or external destination. This pattern is indicative of a potential credential theft attempt targeting the Artifactory join key, which is used to authenticate Artifactory nodes in a cluster, followed by potential data exfiltration or C2 communication using these credentials.
Detects instances where the outbound byte count to external (non-private) IP addresses for a source host significantly exceeds its historical hourly baseline. This detection is designed to identify potential data exfiltration stages occurring after system or network compromise.
Detects instances where the outbound byte count to external (non-private) IP addresses for a source host significantly exceeds its historical hourly baseline. This detection is designed to identify potential data exfiltration stages occurring after system or network compromise.
Detects instances where the outbound byte count to external (non-private) IP addresses for a source host significantly exceeds its historical hourly baseline. This detection is designed to identify potential data exfiltration stages occurring after system or network compromise.
Detects network activity from infrastructure provisioner tools (Terraform, Coder) or shell processes attempting to connect to suspicious domains (e.g., coder-infra.com) that resemble legitimate infrastructure domains. This activity is indicative of credential theft, specifically targeting OIDC tokens, SSH keys, or authentication tokens during automated provisioning processes.
Detects instances where an Artifactory process or user accesses highly sensitive configuration files (system.yaml, join.key) or API endpoints containing configuration data, followed closely (within 15 minutes) by an outbound network connection to a non-standard or external destination. This pattern is indicative of a potential credential theft attempt targeting the Artifactory join key, which is used to authenticate Artifactory nodes in a cluster, followed by potential data exfiltration or C2 communication using these credentials.
Detects network connections to command-and-control infrastructure associated with the JeetBot/Twitch Enhanced Viewer malicious browser extension. The rule triggers on connections to known malicious domains or IPs, as well as specific API endpoints on ambiguous domains that are used for exfiltrating Twitch OAuth tokens.
Page 5 of 19