Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
238 detections
Filters
Last updated
All Time
Detection languages
91
71
26
15
15
Contributors
60
46
29
23
11
Categories
147
108
96
56
50
Platforms
203
19
14
8
1
Products / Services
68
38
34
12
10
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
2
1
1
1
1
IDS Classtypes
5
1
1
IDS Protocols
3
2
2
Detects the sequential relationship of data staging using tools like WinRAR and subsequent exfiltration using tools like Rclone, WinSCP, or FileZilla on a single host within a 24-hour window.
Detects the execution of archiving utilities (7z, rar, tar, or Compress-Archive) targeting configuration directories of AI coding assistants such as Claude, Codex, Cursor, and Gemini.
Detects data staging and exfiltration preceding Play double extortion: WinRAR/RAR adding files to an archive (recursive or password-protected) followed within 4 hours by a WinSCP transfer from the same host and user.
Detects the use of ntdsutil.exe to create an Install From Media (IFM) backup of the Active Directory database (NTDS.dit) to a non-standard location, followed closely by the use of 7-Zip (7z.exe or 7za.exe) to archive that specific backup directory, which is a common indicator of credential dumping and exfiltration staging.
Detects a suspected ransomware double-extortion sequence: the bulk creation of password-protected archives using compression utilities (e.g., 7z, RAR), followed by significant outbound network connections to common cloud storage or anonymization endpoints, and concluding with mass file modifications indicative of encryption activity.
Detects the creation of password-protected archives using 7-Zip or WinRAR command-line utilities. Adversaries often use these tools to compress and encrypt data prior to exfiltration to bypass security controls and prevent inspection of contents.
Detects the use of data archival utilities (7zip, WinRAR) or command-line cloud synchronization tools (Rclone) to stage files in common temporary directories, immediately followed by network connections to known cloud storage endpoints. This pattern is characteristic of pre-encryption exfiltration activities often seen in ransomware campaigns.
Detects the execution of WinRAR utilities (WinRAR.exe, Rar.exe) with suspicious command-line arguments typically associated with data staging, archiving, or encryption. The rule filters out legitimate WinRAR installations and only triggers when the process is spawned by a script interpreter (e.g., PowerShell, CMD) or operates within sensitive file paths (e.g., Users, Shares, Finance, HR, Backup).
Detects the use of PowerShell to execute the 'Compress-Archive' cmdlet against a file named 'download.bin'. This behavior is commonly used by adversaries to compress staged data, potentially for exfiltration, or to manipulate artifacts downloaded from an external source.
Detects the use of PowerShell to execute the 'Compress-Archive' cmdlet against a file named 'download.bin'. This behavior is commonly used by adversaries to compress staged data, potentially for exfiltration, or to manipulate artifacts downloaded from an external source.
This rule detects the use of the 7-Zip utility (7z.exe) located in 'C:\Users\Public\Documents\' to archive files, specifically monitoring for the creation of an archive file named 'p.7z' within the same directory. This pattern of staging files and using an archive utility in public, writeable directories is a common behavior observed in adversary data exfiltration preparation.
This rule detects the use of the 7-Zip utility (7z.exe) located in 'C:\Users\Public\Documents\' to archive files, specifically monitoring for the creation of an archive file named 'p.7z' within the same directory. This pattern of staging files and using an archive utility in public, writeable directories is a common behavior observed in adversary data exfiltration preparation.
This rule detects the use of the 7-Zip utility (7z.exe) located in 'C:\Users\Public\Documents\' to archive files, specifically monitoring for the creation of an archive file named 'p.7z' within the same directory. This pattern of staging files and using an archive utility in public, writeable directories is a common behavior observed in adversary data exfiltration preparation.
This rule detects the use of the 7-Zip utility (7z.exe) located in 'C:\Users\Public\Documents\' to archive files, specifically monitoring for the creation of an archive file named 'p.7z' within the same directory. This pattern of staging files and using an archive utility in public, writeable directories is a common behavior observed in adversary data exfiltration preparation.
MacSync Stealer (formerly known as Mac.c) is a macOS information stealer offered as a Malware-as-a-Service (MaaS). On May 5, 2026, researchers identified a new C2 domain (jacksonvillemma[.]com) delivering the malware's Stage 2 loader. Notably, this new infrastructure was active just days after the operator's previous C2 domain was publicly exposed, highlighting the threat actor's agility in rotating their delivery architecture.
Detects unusually large 7-Zip/WinRAR archive creation from non-standard staging directories followed by outbound network activity, consistent with Gunra's data-staging step before double-extortion exfiltration.
Detects SilentDataCollector uploading AES-CBC encrypted, specifically-named archives (desktop_files, pass_V, wallet_V, filelist.zip.encrypted, documents<n>.zip) to the compromised WordPress C2.
Detects macOS infostealer malware using the curl utility to exfiltrate archived data (zip, tar, tgz, etc.) via multipart POST requests to specific known staging endpoints associated with the ClickFix campaign.
This rule detects activities associated with the SHub Stealer malware on macOS, specifically identifying the creation of staging directories in /tmp (named /tmp/shub_<id>/*), the presence of a 'FileGrabber' sub-directory, and unauthorized file access to common cryptocurrency wallet applications like Electrum, Exodus, Trezor Suite, Ledger Live, Sparrow, and Guarda. It filters out common administrative or installer tools to reduce noise.
Detects a PowerShell process executing with a hidden window style while using the Compress-Archive cmdlet to target the tokyocore_data directory or archive, a behavior consistent with TOKYOCORE ransomware data staging for exfiltration.
Detects instances where 7-Zip utility processes (7z.exe, 7zFM.exe, 7zG.exe) or DLLs act as the parent for suspicious child processes such as command interpreters (cmd.exe, powershell.exe) or other binaries running from temporary or download directories. This pattern is commonly associated with the execution of malicious payloads extracted or staged via 7-Zip archives.
Page 1 of 12