Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
155 detections
Filters
Last updated
All Time
Detection languages
62
29
14
11
11
Contributors
44
29
13
10
9
Categories
82
75
74
44
38
Platforms
132
22
18
6
1
Products / Services
49
37
12
8
7
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
1
1
IDS Classtypes
3
2
2
IDS Protocols
3
2
1
1
Detects Node.js or Python processes exhibiting suspicious behavior consistent with information-stealing malware (such as BeaverTail or InvisibleFerret). The rule monitors for these processes accessing sensitive files, including browser credentials, cookies, browser extension wallet settings, cryptocurrency wallet files, and various identification document image types, followed by the execution of archiving utilities (e.g., zip, rar, 7z) to stage the collected data for exfiltration.
Detects instances where AI developer tools or IDE assistants (e.g., Claude, Copilot, Cursor) execute data collection commands (such as directory traversal or archiving) followed by or concurrent with the bulk access of sensitive files (credentials, configuration files) or personal user data.
Detects the creation of files in the Windows Temp directory that match specific naming patterns associated with UnixStealer, including tool executables, database files, stolen data archives, and debug logs. These artifacts are characteristic of the tool's staging and activity tracking behaviors.
KQL Query from file: JivaChat Installer - Full Chain
KQL Query from file: JivaChat Installer - Full Chain
Detects instances where AI developer tools or IDE assistants (e.g., Claude, Copilot, Cursor) execute data collection commands (such as directory traversal or archiving) followed by or concurrent with the bulk access of sensitive files (credentials, configuration files) or personal user data.
Detects instances where AI developer tools or IDE assistants (e.g., Claude, Copilot, Cursor) execute data collection commands (such as directory traversal or archiving) followed by or concurrent with the bulk access of sensitive files (credentials, configuration files) or personal user data.
Detects instances where AI developer tools or IDE assistants (e.g., Claude, Copilot, Cursor) execute data collection commands (such as directory traversal or archiving) followed by or concurrent with the bulk access of sensitive files (credentials, configuration files) or personal user data.
Detects the use of 7-zip (7z.exe) to interact with a specific file (drata.dat) using command-line arguments typical of an archival or extraction operation. This may indicate an adversary attempting to stage, compress, or exfiltrate sensitive data.
Detects anomalous, high-volume file access by a single process, followed by local file compression or archiving, and subsequent outbound data transfer to a non-internal IP address. This pattern is characteristic of automated agents (like those used in the GTG-1002/Anthropic AI-orchestrated campaigns) performing rapid data triage and staging for exfiltration.
Detects anomalous, high-volume file access by a single process, followed by local file compression or archiving, and subsequent outbound data transfer to a non-internal IP address. This pattern is characteristic of automated agents (like those used in the GTG-1002/Anthropic AI-orchestrated campaigns) performing rapid data triage and staging for exfiltration.
Detects bulk file creation of XML files associated with Dahua credential exports, likely generated by a Python script, which is indicative of credential harvesting or staging for exfiltration.
Detects the creation of a Volume Shadow Copy followed by an attempt to access or copy the Active Directory database file (ntds.dit) from the shadow copy. This pattern is commonly used by adversaries to perform offline credential dumping.
Detects the use of PowerShell to execute the 'Compress-Archive' cmdlet against a file named 'download.bin'. This behavior is commonly used by adversaries to compress staged data, potentially for exfiltration, or to manipulate artifacts downloaded from an external source.
Detects the creation of a Volume Shadow Copy followed by an attempt to access or copy the Active Directory database file (ntds.dit) from the shadow copy. This pattern is commonly used by adversaries to perform offline credential dumping.
Detects the creation of a Volume Shadow Copy followed by an attempt to access or copy the Active Directory database file (ntds.dit) from the shadow copy. This pattern is commonly used by adversaries to perform offline credential dumping.
Detects the use of PowerShell to execute the 'Compress-Archive' cmdlet against a file named 'download.bin'. This behavior is commonly used by adversaries to compress staged data, potentially for exfiltration, or to manipulate artifacts downloaded from an external source.
Detects network communication patterns associated with the RUSTYSHADE malware family, which leverages the GitHub REST API for command-and-control (C2) operations. The rule monitors for specific SNI indicators, GitHub API URL patterns for command retrieval, task/result file interactions, exfiltration of files (screenshots/webcam photos), and custom encrypted request body markers.
Detects the creation of compressed archive files (zip, rar, 7z, dat) followed by a significant network upload (exceeding 5MB) on the same host within a 30-minute window, which is indicative of staging and exfiltrating collected data.
This rule detects the use of the 7-Zip utility (7z.exe) located in 'C:\Users\Public\Documents\' to archive files, specifically monitoring for the creation of an archive file named 'p.7z' within the same directory. This pattern of staging files and using an archive utility in public, writeable directories is a common behavior observed in adversary data exfiltration preparation.
This rule detects the use of the 7-Zip utility (7z.exe) located in 'C:\Users\Public\Documents\' to archive files, specifically monitoring for the creation of an archive file named 'p.7z' within the same directory. This pattern of staging files and using an archive utility in public, writeable directories is a common behavior observed in adversary data exfiltration preparation.
Page 2 of 8