Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
116 detections
Filters
Last updated
All Time
Detection languages
44
34
14
13
6
Contributors
20
18
18
12
10
Categories
78
30
28
27
19
Platforms
67
35
17
9
5
Products / Services
27
17
15
14
13
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
4
1
IDS Classtypes
8
4
1
IDS Protocols
5
4
2
1
1
Detects an unusual volume of externally directed mail from one sender. Mail is a
high-capacity exfiltration channel that is permitted by default, and a compromised
mailbox sending outward in bulk is both data loss and, where the content is phishing,
damage to the organisation's sending reputation.
Onboarding: MS-EXCHANGE is ingested via Syslog (Bloo extractor 142).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=email-gateway where sourcename='MS-EXCHANGE'
and action='EMAIL_SENT_EXTERNAL'
| duration 1h
| groupby sender
| select sender, count(*) as cnt
| having cnt > 100
high-capacity exfiltration channel that is permitted by default, and a compromised
mailbox sending outward in bulk is both data loss and, where the content is phishing,
damage to the organisation's sending reputation.
Onboarding: MS-EXCHANGE is ingested via Syslog (Bloo extractor 142).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=email-gateway where sourcename='MS-EXCHANGE'
and action='EMAIL_SENT_EXTERNAL'
| duration 1h
| groupby sender
| select sender, count(*) as cnt
| having cnt > 100
Detects potential DNS tunneling or Command and Control (C2) activity by analyzing DNS query patterns. The rule identifies anomalous behavior based on high query volume, excessive unique subdomain fanout to a single parent domain, and unusually long average query lengths. This combination is often indicative of data exfiltration or communication with a C2 server over the DNS protocol.
Detects potential DNS tunneling or command-and-control (C2) traffic by identifying abnormally long DNS query names, which often indicate encoded data channels, and suspicious usage of TXT or NULL DNS records, which are frequently used by tools like Cobalt Strike, dnscat2, and iodine for C2 communication.
Detects HTTP POST requests to Telegram Bot API and Discord webhooks containing large, Base64-encoded strings within request bodies, which may indicate exfiltration of reconnaissance data or sensitive information.
Detects DNS tunneling attempts by identifying DNS queries with abnormally long subdomains (greater than 50 characters) that exhibit a high request rate (20 or more queries within 60 seconds). This behavior is characteristic of C2 communication tools such as iodine or dnscat2, which encode data within DNS query labels to bypass traditional network security controls.
This rule detects potential DNS tunneling activity by analyzing DNS query logs for high entropy in subdomains, elevated volumes of TXT/NULL record types, and frequent NXDOMAIN responses. This pattern is characteristic of command-and-control (C2) or data exfiltration techniques using tools like dnscat2 or iodine, which encode data into DNS query labels.
This rule detects malicious activity associated with the Bazinga macOS backdoor, specifically focusing on the clearing of TCC privacy permissions, the staging of keychain and browser data using 'ditto', and the subsequent exfiltration of this data to a remote host via 'curl'.
This rule detects malicious activity associated with the Bazinga macOS backdoor, specifically focusing on the clearing of TCC privacy permissions, the staging of keychain and browser data using 'ditto', and the subsequent exfiltration of this data to a remote host via 'curl'.
The following analytic detects potential data exfiltration using plain HTTP POST requests. It leverages network traffic logs, specifically monitoring the `stream_http` data source for POST methods containing suspicious form data such as "wermgr.exe" or "svchost.exe". This activity is significant because it is commonly associated with malware like Trickbot, trojans, keyloggers, or APT adversaries, which use plain text HTTP POST requests to communicate with remote C2 servers. If confirmed malicious, this activity could lead to unauthorized data exfiltration, compromising sensitive information and potentially leading to further network infiltration.
This rule detects malicious activity associated with the Bazinga macOS backdoor, specifically focusing on the clearing of TCC privacy permissions, the staging of keychain and browser data using 'ditto', and the subsequent exfiltration of this data to a remote host via 'curl'.
Detects specific FTP commands (STOR, RETR, TYPE I) and passive mode responses directed to or originating from identified malicious IP addresses associated with the LucidRook threat actor. This rule monitors for potential file exfiltration, payload retrieval, and command-and-control communication over the FTP protocol.
This rule detects malicious activity associated with the Bazinga macOS backdoor, specifically focusing on the clearing of TCC privacy permissions, the staging of keychain and browser data using 'ditto', and the subsequent exfiltration of this data to a remote host via 'curl'.
Detects high-volume outbound network traffic (exceeding 100MB) generated by processes identifying as 'python-httpx' to non-internal IP addresses. This activity is often associated with automated data exfiltration using Python-based tools.
The following analytic detects excessive usage of the nslookup application, which may indicate potential DNS exfiltration attempts. It leverages Sysmon EventCode 1 to monitor process executions, specifically focusing on nslookup.exe. The detection identifies outliers by comparing the frequency of nslookup executions against a calculated threshold. This activity is significant as it can reveal attempts by malware or APT groups to exfiltrate data via DNS queries. If confirmed malicious, this behavior could allow attackers to stealthily transfer sensitive information out of the network, bypassing traditional data exfiltration defenses.
This rule identifies potential DNS tunneling or exfiltration attempts by monitoring for high volumes of DNS queries, a high count of distinct subdomains, or the usage of unusual DNS record types (TXT, NULL) within Zscaler Internet Access logs.
Detects the execution of the LimeWire P2P file-sharing application within 30 minutes of the creation of sensitive files, such as LSASS memory dumps, NTDS.dit, or SAM/SYSTEM/SECURITY registry hives, on the same host. This temporal correlation suggests the potential exfiltration of sensitive credential material via P2P file-sharing.
Detects outbound HTTP POST requests destined for 'webhook.site' containing the string 'secret' in the request body. This is a common pattern used by attackers to exfiltrate small amounts of sensitive data or credentials to a public web service for collection.
Detects outbound POST requests using the grpc-web+proto content type where the X-Request-Id header contains a base64-encoded JSON blob. This pattern is associated with exfiltrating sensitive data, such as mnemonic phrases or private keys, to a malicious endpoint masquerading as an Injective testnet gRPC-web node.
Detects outbound network traffic containing the specific string 'Secret: ' using raw TCP, often indicative of data exfiltration or unauthorized command-and-control communication via tunneling tools like netcat or ngrok.
Detects outbound network traffic containing the string 'Secret: ', which indicates potential sensitive data exfiltration. The rule specifically targets the use of netcat-like behavior directed toward external endpoints, which are commonly associated with tunneling services like ngrok used to bypass network egress restrictions.
Detects potential zero-click LLM prompt injection attacks against Microsoft 365 Copilot. The rule correlates Microsoft 365 Copilot activity involving external/untrusted URLs or domains with recent inbound email activity to the same user. This pattern is designed to identify scenarios where an attacker leverages an inbound email to trigger a Copilot interaction with malicious external content, potentially leading to unauthorized data access or exfiltration.
Page 1 of 6