Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6 detections
Filters
Last updated
All Time
Detection languages
3
3
Contributors
4
1
1
Categories
3
2
2
2
1
Platforms
3
3
Products / Services
3
2
1
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
2
1
IDS Protocols
2
1
Detects network activity associated with the Rapuncel malware, including raw TCP exfiltration of files via POST requests to /upload, connections to known malicious C2 infrastructure, and repeated exfiltration retry patterns.
Detects in-memory archive creation using .NET compression libraries
Detects in-memory archive creation using .NET compression libraries
This rule detects the creation of in-memory archives using the .NET Compression Library by inspecting HTTP client-bound data for the presence of both "System.IO.Compression" and "ZipArchive" strings. This combination suggests that a .NET application is creating a ZIP archive in memory, which could be indicative of data staging or exfiltration activities.
This rule detects potential data exfiltration attempts where data is archived using scripting libraries. It specifically looks for HTTP traffic (flow:to_client,established) containing the strings "zipfile", "ZipFile(", and "write(" in the file data, indicating the use of a scripting library to create and write to a zip archive. This combination suggests that a client is receiving or downloading an archived file that was likely created programmatically for exfiltration.
Technique commonly used by Infostealers to compress data before its exfiltration
