Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
435 detections
Filters
Last updated
All Time
Detection languages
203
81
49
26
23
Contributors
104
89
27
26
20
Categories
361
138
86
69
48
Platforms
225
84
74
61
45
Products / Services
81
77
50
48
44
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
1
IDS Classtypes
25
17
7
IDS Protocols
31
13
4
Detects execution of RClone utility for exfiltration as used by various ransomwares strains like REvil, Conti, FiveHands, etc
Detects the use of rclone, a command-line program to manage files on cloud storage, via its default user-agent string
Detects users who accessed Microsoft Copilot Studio and correlates that activity with OAuth consent events for third-party applications in Azure Active Directory. Optionally, it verifies whether the consented application was used to access data via Microsoft Graph API, indicating potential account compromise.
Detects when an Azure Blob Storage container's access level is changed to allow public access, or when a long-lived, highly privileged Shared Access Signature (SAS) token is created. Threat actors can use these methods for persistence and data exfiltration.
Detects the execution of the Restic backup tool, which can be used for data exfiltration. Threat actors may leverage Restic to back up and exfiltrate sensitive data to remote storage locations, including cloud services. If not legitimately used in the enterprise environment, its presence may indicate malicious activity.
Detects GitHub activity associated with the 'Shai-Hulud' NPM supply chain attack. The attack involves malicious NPM packages that use stolen GitHub tokens to create a new branch, inject a malicious workflow file to exfiltrate secrets, and make private repositories public.
KQL Query from file: Shuyal Stealer Detection
Detects the execution of the Restic backup tool, which can be used for data exfiltration.
Threat actors may leverage Restic to back up and exfiltrate sensitive data to remote storage locations, including cloud services.
If not legitimately used in the enterprise environment, its presence may indicate malicious activity.
Threat actors may leverage Restic to back up and exfiltrate sensitive data to remote storage locations, including cloud services.
If not legitimately used in the enterprise environment, its presence may indicate malicious activity.
Detects modifications to the Windows Registry by 'OneDrive.exe' when the initiating process command line does not correspond to a legitimate update operation. This could indicate an attempt to establish persistence or modify OneDrive's behavior for malicious purposes, potentially by an adversary using a compromised OneDrive account or malware like CreepyDrive.
Detects network traffic consistent with XWorm malware using the Telegram API for Command and Control (C2) or data exfiltration. This rule specifically looks for HTTP requests to 'api.telegram.org' with URL patterns indicative of sending messages or files via the Telegram Bot API (e.g., /bot<token>/sendMessage, /bot<token>/sendDocument, /bot<token>/sendPhoto).
This detection identifies execution of the file synchronization utility "rclone" with network activity, as captured by Cisco Network Visibility Module flow data. It specifically looks for `rclone.exe` or `rclone` commands with arguments indicative of data transfer to cloud storage providers (e.g., `copy`, `remote:`, `mega:`, `ftp:`) and suspicious flags (`--transfers`, `--ignore-existing`, `--auto-confirm`). Rclone is a legitimate tool but is frequently abused by threat actors for data exfiltration or cloud abuse.
Detects the malicious telemetry.js file used in the s1ngularity supply chain attack. This script harvests sensitive developer assets and exfiltrates them to attacker-controlled GitHub repositories.
Detects outbound API calls to api.github.com for repository creation or file uploads matching patterns used in the s1ngularity supply chain attack.
Detects potential data exfiltration from cloud storage or SaaS platforms based on a large volume of data transferred or a high number of distinct files accessed by a single user or application within a one-hour window. This is a common TTP for threat actors like ShinyHunters who aim to steal large datasets.
A new RoKRAT variant tied to APT37 delivers payloads via oversized LNK shortcuts, executing a two‑stage encrypted shellcode loader that uses steganography to conceal content. The malware achieves fileless execution by injecting into trusted processes (e.g., mspaint.exe, notepad.exe) and hides C2 activity within legitimate cloud storage services such as pCloud, Yandex Disk, and Dropbox, often leveraging hardcoded API tokens.
High‑level TTPs:
Initial Access: Malicious LNK files in compressed archives.
Execution & Persistence: PowerShell/BAT‑driven staged loaders with XOR decryption.
Defense Evasion: Process injection into signed Windows binaries; steganography for payload concealment.
Command & Control: Use of trusted cloud service APIs with embedded tokens to obfuscate malicious traffic.
High‑level TTPs:
Initial Access: Malicious LNK files in compressed archives.
Execution & Persistence: PowerShell/BAT‑driven staged loaders with XOR decryption.
Defense Evasion: Process injection into signed Windows binaries; steganography for payload concealment.
Command & Control: Use of trusted cloud service APIs with embedded tokens to obfuscate malicious traffic.
This rule detects the upload of files to cloud storage services that are known to be used for data exfiltration or are associated with suspicious tunneling activities. It leverages a list of suspicious domains (LOTTunnels) to identify potentially malicious file uploads.
Detects the use of the 'mdimport' command to index sensitive user directories. This is a key step in the Sploitlight TCC bypass technique (CVE-2025-31199), where a malicious Spotlight importer is triggered to run within the 'mdworker' process and exfiltrate data from TCC-protected locations by writing it to the system log.
Detects the use of GoodSync command-line tools for data exfiltration, a TTP associated with the Chaos ransomware group. The rule looks for suspicious command-line patterns, including masquerading as wininit.exe.
This rule detects suspicious network connections to Dropbox API endpoints (api.dropboxapi.com or content.dropboxapi.com) originating from any executable that is not the legitimate Dropbox application. This behavior can indicate an adversary using a non-standard or malicious process to exfiltrate data or establish command and control via Dropbox.
Detects indicators and behaviors related to the Chaos ransomware group including command-line patterns, suspicious registry changes, and specific known IOCs.
This rule detects network connections initiated by any binary to the domains 'mega.co.nz' or 'mega.nz'. Attackers have been observed using file-sharing services like MEGA for uploading and downloading additional payloads, facilitating data exfiltration or staging. This detection aims to identify such suspicious communication patterns.
Page 18 of 21