Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
238 detections
Filters
Last updated
All Time
Detection languages
91
71
26
15
15
Contributors
60
46
29
23
11
Categories
147
108
96
56
50
Platforms
203
19
14
8
1
Products / Services
68
38
34
12
10
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
2
1
1
1
1
IDS Classtypes
5
1
1
IDS Protocols
3
2
2
Detects PHP or web server processes launching archive and compression utilities. A compromised web application may use these tools to package REDCap files, database exports, credentials, or research data before exfiltration. This behaviour should be rare outside documented backup or deployment activity.
Detects the creation of large archive files (zip, rar, 7z, tar.gz) exceeding 50MB in common temporary or program data folders, specifically when these archives are created shortly after files from user document directories (Documents, Desktop, Downloads, Finance, HR, Accounting) were copied or read. This behavior is indicative of data staging by the MedusaLocker ransomware variant prior to encryption or exfiltration.
Detects use of custom encoding methods to archive data for exfiltration
Detects use of custom encoding methods to archive data for exfiltration
Detects the use of the Windows built-in 'tar' utility to extract files into the C:\Users\Public\AccountPictures directory. This behavior has been observed in APT37 NarwhalRAT campaigns during its setup phase, indicating potential ingress tool transfer or staging of malicious files.
This rule detects the execution of self-extracting archives (SFX) that are commonly used by malware to launch a visible decoy and a hidden executable from a temporary directory. It specifically looks for process launch events where the command line contains keywords associated with SFX archives (e.g., '7-zip', 'sfx', '-y', '-o') and the principal process's file path contains terms like '7z', 'sfx', 'setup', or 'installer'. The rule aims to identify the initial stage of an attack where an SFX archive is used to drop and execute malicious payloads.
Oversized Executable Created by Archiver
Cortex XDR
This rule detects the creation of an executable file with an unusually large size by common archiving utilities such as 7-Zip, WinRAR, tar, or PowerShell extraction. The rule focuses on the causality chain to identify the process responsible for creating the oversized executable, which can be indicative of malware packing or other suspicious activity.
This rule detects the creation of executable files (.exe) by common archive utilities such as 7-Zip, WinRAR, tar, or PowerShell. It specifically targets scenarios where these utilities are used to extract or create executables, which can be indicative of malware unpacking or staging. The rule focuses on the process responsible for the file creation and the type of file being created, aiming to identify potentially malicious activity involving compressed or archived executables.
Targets an unusually large executable produced by 7-Zip, WinRAR, tar, or PowerShell extraction. The UDM rule retains principal and target context for correlation.
This rule detects suspicious activity where a Python process initiates network communication to known command and control (C2) domains, immediately followed by accessing SQLite database files (e.g., 'places.sqlite' or 'Cookies'). This pattern is indicative of malware or adversary activity attempting to exfiltrate browser history or session cookies after establishing C2.
Detects creation of large archives used to stage data for exfiltration
Detects creation of archives for staging collected data before exfiltration
This rule detects the creation of a tar archive using the 'tar -czf' command, specifically when the archive is being created in the '/tmp/' directory over an SSH connection. This activity is indicative of data staging, where an attacker might be preparing data for exfiltration or further malicious use.
Detects the creation of zip archives matching the specific naming convention (Unix-[HOSTNAME]-[ID].zip) used by the UnixStealer malware family. Detecting these host artifacts enables early discovery before successful exfiltration.
This rule detects the string "zip -e" within TCP traffic on port 22 (SSH). This string is commonly used to create password-protected zip archives, and its presence in an SSH session could indicate an attempt to prepare data for exfiltration, especially if combined with SSH's secure tunneling capabilities. The rule specifically looks for traffic flowing from the client to the server.
This rule detects HTTP requests that contain both '7z' and '-p' in the URI, which could indicate the use of 7zip or WinRAR to archive data with a password, potentially for exfiltration. The rule specifically looks for these strings in the URI of an HTTP request flowing from the internal network to an external server.
Detects the execution of mshta.exe where the command line arguments reference a file with a .pdf extension. This technique is used by Gamaredon (GammaPhish) to execute disguised HTA payloads after WinRAR exploitation.
Detects the execution of 'cg.exe', a secondary compiled Python executable deployed by SilentRunLoader (associated with TA4922) to pack and steal Google Chrome browser data. The detection specifically looks for 'cg.exe' where the initiating process or command line contains 'python'.
Detects the execution of 7-Zip with specific command-line arguments (password protection, zip format, mx5 compression) used by NightSpire ransomware for data staging prior to exfiltration.
An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities
Detects execution of 7z in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.
Page 6 of 12