Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
640 detections
Filters
Last updated
All Time
Detection languages
302
82
80
57
53
Contributors
139
126
122
26
24
Categories
510
318
124
86
79
Platforms
309
155
127
112
91
Products / Services
164
119
84
80
76
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
8
2
1
1
1
IDS Classtypes
44
25
6
5
1
IDS Protocols
60
12
5
1
This rule detects a suspicious sequence of network connections indicative of information stealer activity, specifically targeting behaviors observed with malware like VVS Stealer. It identifies instances where a non-browser process, originating from common user-writable or temporary directories (AppData, Temp, Downloads, Users\Public), first connects to an external IP discovery service (ipify.org) and then subsequently communicates with Discord services (discord.com or discordapp.com) within a ten-minute window. This pattern suggests that malware is collecting the victim's public IP address before exfiltrating stolen data (e.g., account or browser information) to Discord infrastructure, often used as a command and control or data exfiltration channel by stealers.
Detects DNS lookups and network connections to known AI API endpoints (OpenAI, Anthropic, Google Generative Language) initiated by non-standard processes. This rule excludes common web browsers, productivity applications, and development tools to identify potentially unauthorized or suspicious interaction with AI services from internal processes.
Detects DNS lookups and network connections to known AI API endpoints (OpenAI, Anthropic, Google Generative Language) initiated by non-standard processes. This rule excludes common web browsers, productivity applications, and development tools to identify potentially unauthorized or suspicious interaction with AI services from internal processes.
Detects anomalous process execution patterns where a database process (postgres or postmaster) or a common system utility (nc, python, bash) is observed initiating unauthorized network connections to a known external C2 IP or accessing sensitive cryptographic files (e.g., server.key). This behavior is indicative of potential post-exploitation activity, specifically the exfiltration of credentials or sensitive data via database-level command execution (sys_eval) or direct file manipulation.
Detects a sequence of events where a Google Cloud Storage bucket is deleted by a user, followed by the creation or modification of a Pub/Sub subscription referencing a Cloud Storage destination. This pattern is indicative of 'Universal Bucket Hijacking', where an attacker attempts to hijack a data stream by recreating a deleted bucket or reconfiguring a service to redirect traffic to an attacker-controlled destination.
Detects potential malicious browser extension activity by correlating internal browser process network connections to suspicious infrastructure (e.g., adblock-for-youtube.com) with subsequent network traffic from the same process PID to third-party domains within 60 seconds of visiting sensitive high-value websites (e.g., login portals, banking). The rule also alerts on any direct network connection to identified malicious exfiltration infrastructure.
This rule detects programmatic file downloads from SharePoint and OneDrive using various automation tools and SDKs, rather than typical browser access. It specifically looks for `FileDownloaded`, `FileSyncDownloadedFull`, `FileAccessed`, or `FilePreviewed` operations within SharePoint or OneDrive audit logs where the user agent string indicates the use of PowerShell, PnP, Microsoft Graph SDK, Python, Node.js, or common command-line tools like curl or wget. This behavior can be indicative of data exfiltration.
Detects network connections attempting to exfiltrate data via Discord webhooks. This rule specifically looks for POST requests to the Discord API webhook endpoint.
This rule detects the execution of common scripting interpreters (PowerShell, WScript, CScript) that include command-line arguments referencing major cloud storage providers and file-hosting services. This behavior is frequently associated with data exfiltration or the staging of malicious payloads using legitimate web services.
This rule monitors for large outbound network data transfers (greater than 10MB) over standard web ports (80/443) initiated by processes typically associated with office productivity applications (e.g., WinWord, Excel, Outlook) or credential dumping tools (lsass.exe). It further correlates this activity with preceding network connections to common directory service ports (LDAP/Global Catalog) on the same host, indicating potential credential collection followed by data exfiltration.
Detects network connections to Filen.io cloud storage initiated by processes other than common web browsers. This behavior is often associated with the use of command-line tools or scripts for unauthorized file exfiltration or data staging.
This rule monitors for outbound network connections to 'graph.microsoft.com' initiated by processes that are either unsigned or not digitally signed by Microsoft. It further correlates these connections with proxy logs to identify processes utilizing non-standard or unexpected User-Agents. This behavior is indicative of potentially malicious activity attempting to masquerade as legitimate Microsoft services or using the Microsoft Graph API for command and control or data exfiltration.
This rule monitors for indicators of unauthorized Tor usage or anonymization activity, including non-standard Tor executable paths, suspicious library loads, the creation of Tor configuration files (torrc), non-browser processes communicating over known Tor ports, and DNS queries for .onion domains. It also specifically monitors for potential data exfiltration via the temp.sh file-sharing service from non-browser applications. The rule aggregates these suspicious signals over a 24-hour period to calculate a risk severity score based on the frequency and variety of indicators detected.
Detects outbound HTTP POST requests containing keywords indicative of credential and data theft associated with VBV Stealer malware, specifically looking for fields related to passwords, cookies, or wallets in the request body.
Detects outbound HTTP POST requests containing keywords indicative of credential and data theft associated with VBV Stealer malware, specifically looking for fields related to passwords, cookies, or wallets in the request body.
This rule correlates rapid file modifications (potential encryption or mass deletion) with the execution of commands known to inhibit system recovery (e.g., deleting shadow copies or modifying boot recovery settings) and significant outbound network data transfers from the same host. This pattern is characteristic of ransomware deployment.
Detects outbound network connections to major Large Language Model (LLM) API endpoints (OpenAI, Google, Anthropic) initiated by processes not explicitly identified as standard web browsers or command-line utilities. This pattern may indicate automated data exfiltration ('prompt stealing' or unauthorized access to corporate data) using custom or malicious tools executing from suspicious directories like temp, appdata, or public folders.
Detects outbound web traffic directed towards common password management services (e.g., 1Password, LastPass, Bitwarden) originating from user agents associated with AI and LLM tools (e.g., OpenAI, Claude, Copilot). This combination of destinations and user agents is highly anomalous and may indicate potential credential exfiltration or interaction with automated agents acting on behalf of a user to access sensitive vault data.
Detects outbound HTTP POST requests where the Content-Length header indicates a transfer size exceeding 10MB to external (non-HOME_NET) addresses. This pattern is indicative of potential data exfiltration via HTTP.
Detects potential data exfiltration attempts initiated by 'explorer.exe' over common third-party services or protocols such as Telegram, Discord webhooks, FTP, or SMTP. This rule specifically looks for network connections made by 'explorer.exe' to known exfiltration channels, which is unusual behavior for the Windows Explorer process.
Detects a sequence of activity where WinRAR is used to archive data, followed by the use of WinSCP to potentially exfiltrate that data, occurring on the same host within a 24-hour window.
Page 22 of 31