Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
640 detections
Filters
Last updated
All Time
Detection languages
302
82
80
57
53
Contributors
139
126
122
26
24
Categories
510
318
124
86
79
Platforms
309
155
127
112
91
Products / Services
164
119
84
80
76
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
8
2
1
1
1
IDS Classtypes
44
25
6
5
1
IDS Protocols
60
12
5
1
This rule detects HTTP PUT requests to onedrive.live.com with a body size greater than 5000 bytes. This behavior is indicative of data exfiltration to OneDrive cloud storage, aligning with MITRE ATT&CK technique T1567.
Detects co-occurrence of MicrosoftSystem64 binary execution and DNS queries to huggingface.co from the same host within a 5-minute window. MicrosoftSystem64 is a DPRK-attributed (FAMOUS CHOLLIMA / Contagious Interview) multi-platform RAT delivered via malicious npm packages that exfiltrates stolen credentials, screenshots, and wallet data to attacker-controlled HuggingFace datasets. SafeDep confirmed the exfiltration pipeline was actively operating with real victims as of May 28, 2026.
Detects DNS queries commonly associated with Local LLM (Large Language Model) frameworks or AI-related domains. This activity may indicate unauthorized AI usage or potential data exfiltration channels.
This rule detects the creation or modification of Exchange transport rules or inbox rules that forward or redirect emails to external domains. It specifically looks for operations like 'New-TransportRule', 'Set-TransportRule', 'New-InboxRule', 'Set-InboxRule', 'Set-Mailbox', 'UpdateInboxRules', and 'Set-TransportConfig' where the destination is an email address outside of the organization's verified domains. This activity can indicate data exfiltration or an attempt to maintain persistence and collect sensitive information.
Box SaaS Suspicious File Upload
Cortex XDR
Detects suspicious file uploads to Box indicating potential data staging, tool upload, or exfiltration via shared folders. This rule specifically looks for the 'UPLOAD' operation within Box SaaS audit logs and extracts various file and user-related details.
Box SaaS Suspicious File Download
Cortex XDR
Detects file downloads from Box which could indicate potential data exfiltration by insiders or compromised accounts. This rule specifically looks for 'DOWNLOAD' operations within Box SaaS audit logs.
KQL Query
High Email Volume to Personal Accounts
Cortex XDR
Detects potential data exfiltration or policy violation by identifying users sending a high volume of emails, large emails, or emails to many unique personal email addresses (e.g., Gmail, Yahoo, Outlook.com) from an Office 365 Exchange Online mailbox. This rule aggregates email activity by sender and flags if any of the defined thresholds are met: total sent data to personal addresses exceeds 25 MB, total messages sent to personal addresses exceeds 10, emails sent to more than 5 unique personal addresses, or any single message sent to a personal address exceeds 25 MB. This is designed to be ran as a scheduled correlation for a day time frame. Thresholds can also be configured to fit your environment. Each user will have a different line that contains all of the matching emails they sent to, the attachments, and subjects of the emails.
Detects suspicious sharing activity in Box, including the creation of open links, external collaboration invites, role escalation, and weakening of sharing policies. This rule identifies high-risk activities such as making files publicly visible without password protection, inviting external users with co-owner or editor roles, and changes that reduce security like removing expiration dates on shared links.
High Email Volume to Personal Accounts
Cortex XDR
Detects potential data exfiltration or policy violation by identifying users sending a high volume of emails, large emails, or emails to many unique personal email addresses (e.g., Gmail, Yahoo, Outlook.com) from an Office 365 Exchange Online mailbox. This rule aggregates email activity by sender and flags if any of the defined thresholds are met: total sent data to personal addresses exceeds 25 MB, total messages sent to personal addresses exceeds 10, emails sent to more than 5 unique personal addresses, or any single message sent to a personal address exceeds 25 MB. This is designed to be ran as a scheduled correlation for a day time frame. Thresholds can also be configured to fit your environment. Each user will have a different line that contains all of the matching emails they sent to, the attachments, and subjects of the emails.
This rule detects network connections from devices to a predefined list of domains commonly associated with data exfiltration services. Monitoring these connections can help identify attempts to transfer sensitive data out of the network.
Detects the creation or modification of Power Automate flows that connect to external services commonly used for data exfiltration or command and control, such as webhooks, Gmail, Dropbox, Google Drive, Slack, RSS feeds, custom connectors, or generic HTTP requests/webhooks. This could indicate an adversary attempting to establish persistence or exfiltrate data from the Power Platform environment.
Detects the execution of common browser executables in headless mode with command-line arguments indicative of data exfiltration, malicious rendering (dump-dom), or external requests (http/data:text/html;base64,). This activity, especially when initiated by non-standard parent processes, can be a sign of automated web scraping, vulnerability scanning, or other malicious automated browser activity.
This rule detects a multi-stage exfiltration technique observed on macOS systems, specifically targeting the AMOS malware. It correlates process execution events related to archiving (using 'ditto'), splitting files (using 'split'), and network connections involving 'curl' with specific headers or to known malicious infrastructure. The rule looks for a combination of these activities, indicating data staging and subsequent exfiltration in chunks.
This detection rule identifies network activity associated with the Torg Grabber infostealer. It specifically looks for connections to known command and control (C2) domains and specific URL paths used by the malware for authentication, data upload, or core functionality. The rule leverages network proxy, firewall, or Zeek HTTP logs to extract and analyze URLs. A match indicates a strong reason to investigate the affected host and user, check for expected access, and review nearby activity for further compromise.
This rule detects network connections and DNS resolution requests to known typosquatted domains used by the TeamPCP threat actor for command and control (C2) and data exfiltration. These domains are associated with a compromised Trivy scanner. Detection indicates successful execution of the compromised scanner and attempted exfiltration.
Detects outbound HTTP POST requests containing the specific custom header 'X-Filename: tpcp.tar.gz'. This custom header is used by the TeamPCP credential harvester to exfiltrate collected sensitive credentials (cloud, database, SSH, Kubernetes) to an attacker-controlled server following the compromise of the litellm PyPI package.
Detects outbound HTTP POST requests containing the specific custom header 'X-Filename: tpcp.tar.gz' used by the TeamPCP credential harvester for data exfiltration. This rule targets a highly specific Indicator of Compromise (IOC) associated with the TeamPCP threat.
This rule detects network connections and DNS resolution requests to known typosquatted domains used by the TeamPCP threat actor for command and control (C2) and data exfiltration. These domains are associated with a compromised Trivy scanner. Detection indicates successful execution of the compromised scanner and attempted exfiltration.
Detects the creation of a GitHub repository named `tpcp-docs`. This specific repository name is utilized as a fallback exfiltration channel by the TeamPCP threat actor. During the Trivy supply chain attack, the malware abused stolen GitHub tokens to create this public repository on the victim's account to host stolen data as release assets when the primary exfiltration method failed.
This rule detects outbound network connections to a predefined list of suspicious cloud storage and file-sharing services. These services are often used by adversaries for exfiltration of collected data, providing a covert channel due to their common use and potential for SSL/TLS encryption. The rule specifically looks for `RemoteUrl` containing any of the domains listed in `suspiciousexfildomains`.
Page 25 of 31