Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
155 detections
Filters
Last updated
All Time
Detection languages
62
29
14
11
11
Contributors
44
29
13
10
9
Categories
82
75
74
44
38
Platforms
132
22
18
6
1
Products / Services
49
37
12
8
7
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
1
1
1
IDS Classtypes
3
2
2
IDS Protocols
3
2
1
1
Detects a sequence where a device runs a staging/archiving utility (such as WinRAR, 7-Zip, or a copy script) followed within 4 hours by a file transfer or synchronization tool (such as rclone or FileZilla), which is indicative of data staging prior to exfiltration.
Detects potential data staging and exfiltration where sensitive or investigation-related files are compressed using archive utilities or PowerShell, followed closely by upload activities to Backblaze B2 cloud storage via CLI tools, rclone, or direct API connections.
Detects a specific sequence of behavior associated with Gryxa data collection and exfiltration. A single process queries system state or logs (scheduled tasks, WMI, event logs), creates an archive file (.zip, .7z, .rar), and establishes an outbound public network connection shortly thereafter.
Detects the execution of archiving utilities (7z, rar, tar, or Compress-Archive) targeting configuration directories of AI coding assistants such as Claude, Codex, Cursor, and Gemini.
Detects unauthorized process activity that reads, copies, archives, or transmits the NetScaler ns.conf configuration file. This file contains highly sensitive information, including AAA/LDAP bind credentials and certificates. Adversaries may stage or exfiltrate this file following the exploitation of vulnerabilities (such as CVE-2026-88771 or CVE-2026-88772) on NetScaler appliances to facilitate further network compromise.
Detects the use of legitimate archival utilities (such as 7-Zip, WinRAR, tar) or scripting engines (PowerShell) to compress or package sensitive browser profile artifacts like 'Login Data', 'Cookies', or 'Local State'. This behavior is a common indicator of credential harvesting and data staging activity by infostealers prior to exfiltration.
This rule detects potential browser-based credential and session theft by monitoring for a process that accesses multiple sensitive web browser artifacts (cookies, local state, session storage) across several user profiles in a short timeframe. It correlates this activity with the subsequent creation of a compressed archive in a temporary directory followed by an outbound network connection, indicating a multi-stage exfiltration workflow.
This rule detects typical behavior associated with infostealers targeting browser data, specifically the creation of compressed archives (.zip, .rar) in temporary directories (Temp or AppData) and the subsequent exfiltration of data via known webhook services (e.g., Discord, Telegram, Pastebin) or direct IP connections. It filters out common signed backup and synchronization software to minimize noise.
Detects usage of the Rclone utility (or renamed binaries) to transfer data to various cloud storage backends (S3, Mega, pCloud, SFTP, WebDAV). The detection correlates this activity with the execution of common archival tools (7-Zip, WinRAR, TAR) within one hour prior to the data transfer, which is a common behavior of adversaries preparing data for exfiltration.
Detects a multi-stage exfiltration sequence consisting of: (1) bulk file archival/compression using common utilities, (2) suspicious OAuth grant or service principal authorization, and (3) abnormal network egress volume to common ports. This pattern suggests an adversary is preparing data, establishing or leveraging an identity/application for cloud access, and subsequently exfiltrating data.
Detects HTTP beaconing activity associated with the MacSync stealer malware on macOS platforms. The rule monitors for specific URI patterns ('curl', 'dynamic', 'gate') combined with macOS-specific User-Agent strings and potential credential exfiltration headers, indicating established communication with a Command and Control (C2) server.
This rule detects potential browser-based credential and session theft by monitoring for a process that accesses multiple sensitive web browser artifacts (cookies, local state, session storage) across several user profiles in a short timeframe. It correlates this activity with the subsequent creation of a compressed archive in a temporary directory followed by an outbound network connection, indicating a multi-stage exfiltration workflow.
Detects the use of common archiving utilities (7zip, WinRAR, Tar, or PowerShell Compress-Archive) to bundle sensitive Google Chrome user data, such as cookies, login data, or the entire user data profile directory. This behavior is indicative of an adversary attempting to stage sensitive information for exfiltration.
Detects a suspected infostealer activity chain involving the unauthorized access of credential and session cookie files, followed by the archival of these files into a temporary or staging directory, and concluding with an outbound network connection to an uncommon destination from the archiving process.
Detects the execution of command-line archiving utilities (e.g., 7z, rar, zip) to create potentially password-protected archives within common staging directories (Temp, Public, ProgramData), followed by an outbound network connection to an external destination. This behavior is consistent with data staging and subsequent exfiltration.
Detects a sequence of activity indicative of data exfiltration preparation. This rule identifies the creation of multiple large archive files (.zip, .rar, .7z) in temporary or staging directories on an endpoint, followed by a network connection transferring a significant volume of data to an external, non-private IP address within a 30-minute window.
Detects instances where AI developer tools or IDE assistants (e.g., Claude, Copilot, Cursor) execute data collection commands (such as directory traversal or archiving) followed by or concurrent with the bulk access of sensitive files (credentials, configuration files) or personal user data.
This rule detects potential browser-based credential and session theft by monitoring for a process that accesses multiple sensitive web browser artifacts (cookies, local state, session storage) across several user profiles in a short timeframe. It correlates this activity with the subsequent creation of a compressed archive in a temporary directory followed by an outbound network connection, indicating a multi-stage exfiltration workflow.
This rule detects potential browser-based credential and session theft by monitoring for a process that accesses multiple sensitive web browser artifacts (cookies, local state, session storage) across several user profiles in a short timeframe. It correlates this activity with the subsequent creation of a compressed archive in a temporary directory followed by an outbound network connection, indicating a multi-stage exfiltration workflow.
This rule detects potential browser-based credential and session theft by monitoring for a process that accesses multiple sensitive web browser artifacts (cookies, local state, session storage) across several user profiles in a short timeframe. It correlates this activity with the subsequent creation of a compressed archive in a temporary directory followed by an outbound network connection, indicating a multi-stage exfiltration workflow.
KQL Query from file: JivaChat Installer - Full Chain
Page 1 of 8