Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
640 detections
Filters
Last updated
All Time
Detection languages
302
82
80
57
53
Contributors
139
126
122
26
24
Categories
510
318
124
86
79
Platforms
309
155
127
112
91
Products / Services
164
119
84
80
76
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
8
2
1
1
1
IDS Classtypes
44
25
6
5
1
IDS Protocols
60
12
5
1
This rule identifies emails sent from an internal employee email address to external personal email domains where the recipient's local part of the email address contains tokens from the sender's display name for more than 0 words matching. It also analyses attachments for sensitive keywords (e.g., 'confidential', 'secret') and assigns a risk score based on factors like email volume, attachment count, and presence of sensitive attachments. This could indicate an attempt to exfiltrate sensitive company data to a personal account.
It matches first name and last name keywords within the Recipient's email address, including prefixes, suffixes, or in-between parts. Therefore, the false positive rate for this query is lower.
It matches first name and last name keywords within the Recipient's email address, including prefixes, suffixes, or in-between parts. Therefore, the false positive rate for this query is lower.
This rule detects outbound TLS connections to known temporary file sharing services, which can be indicative of data exfiltration. The rule inspects the Server Name Indication (SNI) field in TLS traffic for specific domain names associated with these services.
When, for example, a printer, camera, IoT appliance, or other device suddenly makes outbound connections to countries such as China, Russia, or Iran, this may not be noise. The following detection helps identify connections from these specific device groups that we were not previously aware of and that could be exfiltrating information.
Detects network traffic to Large Language Model (LLM) providers that have not implemented mitigations for the Whisper Leak side-channel attack. Communication with these providers is more susceptible to topic inference attacks.
Detects when a user performs data exfiltration by using DataSvcUtil.exe
This rule detects HTTP GET requests for PNG files from github.com with a minimal set of HTTP headers. Specifically, it looks for requests where the total size of HTTP header names is less than 30 bytes and explicitly excludes common headers like 'user-agent', 'referer', 'accept', 'x-auth', and 'cookie'. This pattern could indicate an attempt to exfiltrate data or perform other covert communication using a simplified HTTP client, potentially to evade detection by security tools that expect full browser-like headers.
Detects the use of various command-line utilities like PowerShell, curl, and wget to exfiltrate data via web requests, specifically looking for POST requests containing common system information or sensitive data commands.
Detects the execution of the 'curl.exe' process with specific flags that indicate an attempt to upload or exfiltrate data. This includes flags like '--form', '--upload-file', '--data', and variations of '--data-' (e.g., '--data-ascii', '--data-binary', '--data-raw', '--data-urlencode'), as well as shorthand flags like '-F', '-T', and '-d'. The rule filters out connections to localhost to reduce false positives.
The following analytic identifies the use of Living Off the Land Binaries and Scripts (LOLBAS) with network traffic. It leverages data from the Network Traffic data model to detect when native Windows binaries, often abused by adversaries, initiate network connections. This activity is significant as LOLBAS are frequently used to download malicious payloads, enabling lateral movement, command-and-control, or data exfiltration. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a severe threat to organizational security.
The analytic detects a high volume of outbound web traffic, specifically over 1GB of data sent to a URL within a 2-minute window. It leverages web access logs to identify significant uploads by analyzing the sum of bytes out. This activity is significant as it may indicate potential data exfiltration by malware or malicious insiders. If confirmed as malicious, this behavior could lead to unauthorized data transfer, resulting in data breaches and loss of sensitive information. Immediate investigation is required to determine the legitimacy of the transfer and mitigate any potential threats.
Detects the use of the rclone tool with data transfer commands (copy, move, sync, copyto, moveto) originating from a GoAnywhere server process or common interactive shell processes (cmd.exe, powershell.exe). This activity is highly suspicious and could indicate data exfiltration.
KQL Query
This detection looks at emails being sent from a users company email address to their personal email through comparing the sender and recipient email addresses to see if they contain similar strings. Users who are close to leaving the company and working their notice period etc should be monitored more closely and an increased number of emails being sent to a personal email can indicate data exfiltration.
Base64 Website Access
YARA-L
Detects a user accessing multiple websites commonly used for Base64 encoding and decoding within a short time frame. This activity could be a precursor to data exfiltration or an attempt to obfuscate malicious commands.
A Google Workspace user is attempting to download, print or email as an attachment a suspicious amount of files over a short time period. This can indicate an attacker trying to exfiltrate data.
Detects the execution of legitimate file transfer or backup utilities like FileZilla (fzsftp.exe), Restic, or BackBlaze (b2.exe) that have been observed being abused by threat actors for data exfiltration.
Detects network connections to domains associated with BTunnels, a service that can be abused by attackers to establish reverse shells or persistence on a machine. The rule specifically looks for outbound connections where the destination hostname ends with '.btunnel.co.in'.
This rule detects the upload of files to cloud storage services that are known to be used for data exfiltration or are associated with suspicious tunneling activities. It leverages a list of suspicious domains (LOTTunnels) to identify potentially malicious file uploads.
This rule detects the creation of new Microsoft Power Automate flows that are configured to use connectors capable of exfiltrating data via email or collaboration platforms like Microsoft Teams. It specifically looks for flows created with connectors which could indicate an attempt to send sensitive information outside the organization.
This rule detects potential data exfiltration attempts via email by monitoring internal users sending emails to external domains. It flags suspicious activity based on three criteria: a high volume of emails sent (over 100) combined with a large total data size (over 50 MB), a significant number of emails sent to personal domains (over 20), or a notable count of emails with sensitive subjects (over 5). The rule aggregates these metrics over a 1-day window for each user.
The analytic detects the execution of the 'gdrive' tool on a Linux host. This tool allows standard users to perform tasks associated with Google Drive via the command line, such as downloading, uploading, listing, updating, syncing, sharing, and managing accounts or files. Adversaries can use this tool to stage other tools or exfiltrate data. The detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. If confirmed malicious, this activity could lead to system compromise or sensitive data theft.
Page 27 of 31