Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
435 detections
Filters
Last updated
All Time
Detection languages
203
81
49
26
23
Contributors
104
89
27
26
20
Categories
361
138
86
69
48
Platforms
225
84
74
61
45
Products / Services
81
77
50
48
44
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
1
IDS Classtypes
25
17
7
IDS Protocols
31
13
4
Detects data exfiltration patterns used by HoneyMyte scripts. The rule monitors for rar.exe compressing files with a specific password or curl.exe uploading data to the Pixeldrain file-sharing service.
This rule detects a suspicious sequence of events: a file named 'host.exe' being created in the Windows Startup folder, a 'runtime.zip' file being created in the local temporary directory, and subsequent network communication to the Telegram API (api.telegram.org) from the same device. This pattern is indicative of malware establishing persistence, staging data, and exfiltrating it via Telegram, potentially associated with malware like Small Sieve.
This rule detects outbound network connections to known Command and Control (C2) and exfiltration domains associated with the SANDWORM_MODE campaign. These domains are used to exfiltrate stolen credentials and other sensitive data.
This detection identifies network connections from non-browser processes to known Large Language Model (LLM) API endpoints. While some connections may be legitimate developer or application traffic, unexpected processes connecting to these services could indicate unauthorized data exfiltration, corporate espionage, or misuse of AI services.
This rule detects suspicious enumeration of Azure Blob, File, Table, Queue, or DFS storage accounts by internal users. It identifies devices making network connections to public Azure storage URLs using potentially suspicious processes (e.g., PowerShell, Python, AzCopy, curl, wget, WinSCP, FileZilla, Storage Explorer). The rule then analyzes the distinct storage accounts accessed and uses a Jaccard index to identify unusual naming conventions among the accessed storage accounts, potentially indicating an insider attempting to discover or exfiltrate data from unfamiliar storage resources.
Detects the use of curl.exe to upload data to the temp.sh file-sharing service. This technique has been observed in post-compromise reconnaissance activities, including those following Notepad++ compromises.
Detects the execution of S3 Browser or Office installation executables, followed by network traffic from the same host to known cloud storage or file-sharing sites within a short time window. This behavior aligns with Muddled Libra's method of staging and exfiltrating sensitive data, such as PST files, to attacker-controlled cloud buckets.
Detects curl commands uploading files to temp.sh service for data exfiltration via update.exe.
Detects when a web browser or the Dropbox client accesses a file that is potentially sensitive, based on file name or security labels. This may indicate unauthorized data exfiltration of HBI (Highly Business-Impact) data to a personal or public Dropbox account.
This rule detects the creation of 'rclone.conf' file on a device. The 'rclone.conf' file is a configuration file used by the Rclone utility, a command-line program for syncing files with various cloud storage services. The presence of this file often indicates the installation or use of Rclone, which can be leveraged by adversaries for data exfiltration to cloud storage.
Apt28 Cloud Storage C2
YARA-L
Detects outbound network traffic to legitimate cloud storage domains (filen.io, icedrive.net, koofr.net) known to be abused by APT28 for Command and Control (C2) and data exfiltration as part of Operation Phantom Net Voxel.
Detects the creation of a directory junction pointing to a OneDrive synchronization folder. This is a key component of the 'DoubleDrive' technique, used to force the synchronization of arbitrary local files for data exfiltration or cloud-based ransomware encryption.
Detects the use of curl.exe to upload files to the temp.sh service while simultaneously passing the resulting temp.sh URL within the User-Agent string to a C2 server. This specific exfiltration and beaconing TTP was observed in the Notepad++ supply chain attack.
Detects the use of curl.exe to upload data to the anonymous file-sharing service temp.sh. This technique has been observed being used by threat actors for reconnaissance data exfiltration, notably after gaining initial access through a compromised Notepad++ updater.
Detects instances where an AI agent process (e.g., Moltbot, ClawdBot) performs a web search or HTTP request containing suspicious internal identifiers (like API keys or project names) as URL parameters. This behavior is a hallmark of 'search-and-leak' exfiltration tactics, often triggered by indirect prompt injection.
This detection identifies when a user or service principal executes a command inside an AKS pod ('kubectl exec') and then, using the same identity, accesses data in a sensitive Azure Blob Storage container within a short time frame. This pattern can indicate an attacker, having gained initial access to the Kubernetes API, is using a pod as a pivot point to discover and exfiltrate sensitive data.
Detects techniques used by the INC Ransomware Group, including the execution of their RainINC payload from C:\PerfLogs and the abuse of a renamed Restic binary for data exfiltration.
This rule detects successful 'GetObject' operations on AWS S3 buckets originating from external IP addresses (not within common private IP ranges). This could indicate an attempt to exfiltrate data from S3 buckets by an unauthorized entity or compromised credential.
vvs-stealer
KQL
This rule detects activities associated with the VVS Stealer malware, as described in the Palo Alto Networks Unit 42 blog. It identifies the malware through specific SHA256 hashes of known VVS Stealer executables, network connections to hardcoded Discord webhook URLs used for exfiltration, persistence mechanisms via creation of executables in Windows startup folders, creation of '_vault.zip' files (likely containing stolen data), and suspicious Discord-related process activity indicative of the stealer's operation.
Detects the DriverFixer0428 macOS credential stealer, attributed to the North Korean 'Contagious Interview' campaign. This rule identifies the malware based on unique internal strings, network IOCs related to Dropbox exfiltration, and social engineering text.
Detects phishing emails with malicious HTML attachments designed to harvest credentials and exfiltrate them via the Telegram Bot API. The detection looks for specific attachment filenames (e.g., RFQ, INQUIRY) or content patterns indicative of this threat.
Page 17 of 21