Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
198 detections
Filters
Last updated
All Time
Detection languages
130
15
14
12
9
Contributors
44
38
22
21
9
Categories
114
84
59
48
42
Platforms
134
38
26
21
15
Products / Services
79
27
26
10
10
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
IDS Classtypes
3
1
1
IDS Protocols
2
2
1
The rule `MAL_GOLANG_STEALER_QBIT` is designed to detect the Qbit Stealer malware by identifying specific branding strings, setup configurations, and error messages commonly found within its binaries. The rule looks for strings like "qBit Stealer", "TRIAL VERSION - 24 Hour Access", "Stolen Folder Name:", "Max File Size(MB):", "Targeted File Extensions:", "[+] Logged into Mega", "[+] Loaded configJs", "Failed to load configJs", "Failed to archive files", "Failed to upload files", and "Failed to get file info". It also specifies a file size range between 7MB and 9MB. The rule `HUNT_QBIT_STEALER_DEV` aims to detect other software potentially created by the same author (n1k714i) by looking for developer-related strings such as "qbit@hitler.rocks", "n1k7l4i", "N1k7", and "CrabCat".
The following analytic detects the creation of archived files in a temporary folder, which may contain collected data. This behavior is often associated with malicious activity, where attackers compress sensitive information before exfiltration. The detection focuses on monitoring specific directories, such as temp folders, for the presence of newly created archive files (e.g., .zip, .rar, .tar). By identifying this pattern, security teams can quickly respond to potential data collection and exfiltration attempts, minimizing the risk of data breaches and improving overall threat detection.
KQL Query
A Google Workspace user is attempting to download, print or email as an attachment a suspicious amount of files over a short time period. This can indicate an attacker trying to exfiltrate data.
This rule detects attempts by scripting language interpreters (Node.js, Python, PowerShell) to access sensitive browser credential files such as 'Login Data', 'Web Data', and 'Cookies' from Chrome and Brave browser user data directories. It also includes specific file paths that might be associated with known browser extensions or malware that target these files. This activity is indicative of credential dumping or information stealing.
Vidar is a sophisticated infostealer operating as Malware-as-a-Service (MaaS). Written in C++, it’s designed to harvest a wide range of sensitive data from infected systems and exfiltrate it to attacker controlled infrastructure.
🧬 Script Inception: PowerShell scripts nested within PowerShell scripts, layered with 2–3 rounds of Base64 encoding.
📦 RAR Payloads: Password protected RAR files downloaded via direct-to-IP HTTP requests over TCP port 80. Passwords are embedded in encoded scripts and passed via command line to a downloaded copy of "unrar.exe".
🧬 Script Inception: PowerShell scripts nested within PowerShell scripts, layered with 2–3 rounds of Base64 encoding.
📦 RAR Payloads: Password protected RAR files downloaded via direct-to-IP HTTP requests over TCP port 80. Passwords are embedded in encoded scripts and passed via command line to a downloaded copy of "unrar.exe".
This rule detects suspicious activity where scripting interpreters (node.exe, python.exe, pwsh.exe, powershell.exe) are observed accessing a large number of potentially sensitive files (e.g., .env, secret, wallet, keypair, credential, recovery files, or common document/data file types like .pdf, .docx, .csv, .json, .txt) and subsequently exfiltrating a significant amount of data over the network. It correlates file access events with network outbound traffic from the same process within a 10-minute window, flagging instances where more than 20 distinct sensitive files are accessed and over 500KB of data is sent out.
This rule detects suspicious activity where a file is first downloaded to the 'Downloads' folder and subsequently executed from the 'Public' folder on the same device within a 24-hour timeframe. This behavior can indicate an attempt to bypass security controls or stage malicious payloads in a commonly accessible location.
This query detects the creation of archive files (ZIP, 7z, RAR) in common temporary or publicly writable directories (C:\Users\Public\, C:\ProgramData\, C:\Windows\Temp, C:\PerfLogs). The files are written by processes commonly abused in attacks, such as powershell.exe, cmd.exe, 7z.exe, winrar.exe, or explorer.exe.
Hunting query to monitor downloads through popular browsers
KQL Query from file: Data Exfiltration via Microsoft Teams
KQL Query
KQL Query from file: Hunting Malicious Copilot Agent
KQL Query
KQL Query from file: The Hunt for Top 10 Self Hosted AI
KQL Query
KQL Query from file: Blob URI Unique Domain Count
This analytic identifies anomalously high outbound network activity from processes within Kubernetes containerized workloads. It compares recent network metrics (TCP/UDP bytes, new sockets, packets) over the last hour against the average metrics from the past 30 days. Significant deviations may indicate data exfiltration, process modification, or container compromise, potentially leading to unauthorized data transfer or further attacks within the containerized environment.
This query visualises the amount of total Malware detections of files located on SharePoint, OneDrive and Teams, summarizing by the locations they are stored
'This query looks for any mass download by a single user with possible file copy activity to a new USB drive. Malicious insiders may perform such activities that may cause harm to the organization.
This query could also reveal unintentional insider that had no intention of malicious activity but their actions may impact an organizations security posture.
Reference:https://docs.microsoft.com/defender-cloud-apps/policy-template-reference'
This query could also reveal unintentional insider that had no intention of malicious activity but their actions may impact an organizations security posture.
Reference:https://docs.microsoft.com/defender-cloud-apps/policy-template-reference'
Check all created files.
That does not have extension ps1, bat or cmd to avoid IT Pro scripts.
That are not copied to C:\ to detect all file share, external drive, data partition that are not allowed, etc.
This could help to detect malicious insider/user that has unencrypted data partition and that are using it to exfiltrate data even while removable devices & cloud storage is blocked.
That does not have extension ps1, bat or cmd to avoid IT Pro scripts.
That are not copied to C:\ to detect all file share, external drive, data partition that are not allowed, etc.
This could help to detect malicious insider/user that has unencrypted data partition and that are using it to exfiltrate data even while removable devices & cloud storage is blocked.
Page 8 of 10