Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10 detections
Filters
Last updated
All Time
Detection languages
3
3
2
1
1
Contributors
4
2
1
1
1
Categories
6
4
3
2
2
Platforms
4
3
2
1
1
Products / Services
3
2
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
3
IDS Protocols
1
1
1
Detects high-volume data transfers (exceeding 100MB) from internal sources to known external cloud storage and file-sharing platforms. This behavior is consistent with data staging and exfiltration patterns, often used by threat actors to move collected data to attacker-controlled storage infrastructure.
Detects data staged on remote network shares prior to exfiltration
Detects the execution of WinSCP or Rclone binaries, which are frequently used by threat actors like UNC3753 to exfiltrate staged data. This rule specifically looks for process creation events where the image name is 'winscp.exe' or 'rclone.exe'.
This rule detects large data transfers (over 65KB) to a remote host via SSH SCP (port 22) within the home network. It uses a thresholding mechanism to alert if 30 such transfers occur within a 60-second window from the same source.
This rule detects potential data staging activity on a remote SMB share. It specifically looks for traffic to port 445 (SMB) containing 'ADMIN$' (case-insensitive) with a data size greater than 65000 bytes. A threshold of 20 such events within 60 seconds from the same source IP will trigger an alert, indicating a high volume of data being transferred to an administrative share, which could precede exfiltration.
This rule detects attempts to stage large amounts of data (over 65KB) to common cloud storage services (Amazon S3, Azure Blob Storage, Google Cloud Storage) via HTTP PUT requests. This activity is indicative of data being prepared for exfiltration.
This rule detects instances where a SharePoint or OneDrive file/folder is shared with a guest user whose email address is identified as a threat intelligence indicator. This could indicate an attempt to exfiltrate data to a known malicious entity or an account compromise being used for data staging.
Jupyter, otherwise known as SolarMarker, is a malware family and cluster of components known for its info-stealing and backdoor capabilities that mainly proliferates through search engine optimization manipulation and malicious advertising in order to successfully encourage users to download malicious templates and documents. This malware has been popular since 2020 and currently is still active as of 2021.
This rule identifies when a Google Workspace user transfers the ownership of a file within Google Drive. This activity is logged as a 'CREATE_DATA_TRANSFER_REQUEST' event in the Google Workspace admin logs, specifically categorized under 'USER_SETTINGS'. This could indicate an attempt to move sensitive data to a different account, potentially for exfiltration or to obscure ownership.
Identifies when a Google Workspace user transfers the ownership of a file.