Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
640 detections
Filters
Last updated
All Time
Detection languages
302
82
80
57
53
Contributors
139
126
122
26
24
Categories
510
318
124
86
79
Platforms
309
155
127
112
91
Products / Services
164
119
84
80
76
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
8
2
1
1
1
IDS Classtypes
44
25
6
5
1
IDS Protocols
60
12
5
1
Identifies when a user shares a file on Google Drive with a free email domain, which may indicate data exfiltration.
Identifies when a user copies multiple files from Google Drive, which may indicate data exfiltration.
Detects suspicious DNS queries to Monero mining pools
This rule detects outbound network connections to ngrok tunneling service endpoints. Ngrok is a legitimate tool that can be used to expose local servers to the internet, but it is also frequently leveraged by malicious actors for data exfiltration, command and control, and bypassing network restrictions. Detection of communication to these specific ngrok domains could indicate unauthorized use of the service for malicious purposes.
This rule detects the use of DataSvcUtil.exe, a legitimate Microsoft utility, with command-line arguments indicative of data exfiltration. Specifically, it looks for the presence of '/in:', '/out:', and '/uri:' parameters in the command line, combined with the execution of 'DataSvcUtil.exe'. This behavior is often associated with Living Off The Land Binaries (LOLBAS) techniques where adversaries leverage legitimate system tools for malicious purposes, in this case, to exfiltrate data.
Detects an executable initiating a network connection to "ngrok" tunneling domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Detects the execution of "ConfigSecurityPolicy.EXE" with command-line arguments containing URLs (ftp://, http://, https://). This Windows Defender binary can be abused by attackers to download or upload files, potentially leading to arbitrary file download or data exfiltration.
Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors
Detects an executable initiating a network connection to "ngrok" tunneling domains.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Detects the execution of "ConfigSecurityPolicy.EXE", a binary part of Windows Defender used to manage settings in Windows Defender.
Users can configure different pilot collections for each of the co-management workloads.
It can be abused by attackers in order to upload or download files.
Users can configure different pilot collections for each of the co-management workloads.
It can be abused by attackers in order to upload or download files.
Page 31 of 31