Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
435 detections
Filters
Last updated
All Time
Detection languages
203
81
49
26
23
Contributors
104
89
27
26
20
Categories
361
138
86
69
48
Platforms
225
84
74
61
45
Products / Services
81
77
50
48
44
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
1
IDS Classtypes
25
17
7
IDS Protocols
31
13
4
Detects the use of rclone, a command-line program to manage files on cloud storage, by identifying its default user-agent string in proxy logs. This activity can indicate data exfiltration to cloud storage services.
Detects DNS queries for subdomains related to the MEGA cloud storage service. This activity can indicate data exfiltration to cloud storage, potentially using tools like Rclone.
Detects DNS queries to "ufile.io", which has been observed as a method for data exfiltration by malware and threat actors. This rule specifically looks for Event ID 3008 in the Microsoft-Windows-DNS Client Events/Operational log where the QueryName contains 'ufile.io'.
This rule detects DNS queries for subdomains associated with the MEGA cloud storage service, specifically 'userstorage.mega.co.nz'. Such queries can indicate attempts to exfiltrate data to MEGA, potentially using tools like Rclone, or legitimate usage of the service. The rule focuses on the DNS layer to identify communication with this cloud storage provider.
Detects DNS queries to "ufile.io", which has been observed as a method for data exfiltration by malware and threat actors. This service can be used to upload and share files, making it a convenient target for adversaries to move stolen data out of a compromised network.
Detects DNS queries for 'anonfiles.com', which is an anonymous file upload platform frequently used for malicious purposes, including data exfiltration by malware such as BlackByte ransomware. This rule specifically looks for Event ID 3008 from the Microsoft-Windows-DNS Client Operational log, indicating a DNS query for a domain containing '.anonfiles.com'.
Detects the creation of Rclone configuration files, which are typically stored in a specific user directory path. Rclone is a command-line program used for syncing files with various cloud storage services and is often leveraged by adversaries for data exfiltration.
Detects DNS queries for the domain "anonfiles.com", which is an anonymous file upload platform often used by adversaries for malicious purposes, including data exfiltration. This rule specifically looks for any DNS query containing '.anonfiles.com'.
Detects DNS queries for subdomains related to MEGA sharing website
Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration
Detects DNS queries for anonfiles.com, which is an anonymous file upload platform often used for malicious purposes
Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration
Detects DNS queries for "anonfiles.com", which is an anonymous file upload platform often used for malicious purposes
Detects DNS queries for subdomains related to MEGA sharing website
Detects Rclone config files being created
Page 21 of 21