Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
88 detections
Filters
Last updated
All Time
Detection languages
52
15
8
5
3
Contributors
17
11
10
10
7
Categories
71
35
24
24
19
Platforms
48
25
10
9
9
Products / Services
30
16
14
13
10
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
1
1
IDS Classtypes
7
5
3
IDS Protocols
12
3
This rule detects network connections to known cloud storage, file hosting, and webhook services (Discord, Pastebin, Dropbox, Telegram, AnonFiles) initiated by processes other than standard web browsers. Such behavior is often indicative of data exfiltration or C2 activity using legitimate web services to blend in with normal traffic.
This rule detects network connections to known cloud storage, file hosting, and webhook services (Discord, Pastebin, Dropbox, Telegram, AnonFiles) initiated by processes other than standard web browsers. Such behavior is often indicative of data exfiltration or C2 activity using legitimate web services to blend in with normal traffic.
Detects instances where language-related processes (amazonq-language-server, node) or common tools (bash, sh, curl, aws) execute commands containing AWS access credentials or perform potential data exfiltration via curl POST requests.
Detects the use of 'curl' with '-X PUT' and '--data-binary' options, which can indicate data exfiltration or staging activities. This combination is often used to upload raw data to a specified endpoint.
Detects network connections to the Telegram API (api.telegram.org) from processes identified as LOLBins or residing in suspicious, potentially writable locations such as Temp, AppData, or user-defined directories. This activity is often indicative of C2 communication or data exfiltration by malware bypassing standard messaging client restrictions.
Detects data exfiltration through Discord webhook POST requests
This rule detects network connections to known cloud storage, file hosting, and webhook services (Discord, Pastebin, Dropbox, Telegram, AnonFiles) initiated by processes other than standard web browsers. Such behavior is often indicative of data exfiltration or C2 activity using legitimate web services to blend in with normal traffic.
Detects suspicious network connections or process activity targeting Discord webhooks or API endpoints, potentially indicating data exfiltration, command and control, or token validation by malicious actors. The rule specifically looks for non-Discord processes making these connections or using suspicious user agents.
Detects network connections to the Telegram API (api.telegram.org) from processes identified as LOLBins or residing in suspicious, potentially writable locations such as Temp, AppData, or user-defined directories. This activity is often indicative of C2 communication or data exfiltration by malware bypassing standard messaging client restrictions.
Detects network connections attempting to exfiltrate data via Discord webhooks. This rule specifically looks for POST requests to the Discord API webhook endpoint.
This rule detects the creation of a '_vault.zip' archive, which is characteristic of the VVS Stealer malware, followed by network activity to Discord from the same process within a 15-minute window. VVS Stealer uses these archives to store stolen browser data (passwords, cookies, history, autofill) before exfiltrating it, often via Discord webhooks.
This rule detects potential data exfiltration attempts or sensitive information disclosure through Microsoft Copilot Enterprise Search. It specifically looks for 'URLClick' actions from 'Microsoft Copilot Enterprise Search' where the raw event data contains a 'q=' parameter (indicating a query) and also contains keywords like 'extract', 'embed', or 'img'. This combination suggests that a user might be attempting to extract or embed content, potentially sensitive, via a Copilot search query, which could lead to data leakage.
Detects use of Discord webhooks for covert C2 or data exfiltration
This rule detects potential data exfiltration attempts or sensitive information disclosure through Microsoft Copilot Enterprise Search. It specifically looks for 'URLClick' actions from 'Microsoft Copilot Enterprise Search' where the raw event data contains a 'q=' parameter (indicating a query) and also contains keywords like 'extract', 'embed', or 'img'. This combination suggests that a user might be attempting to extract or embed content, potentially sensitive, via a Copilot search query, which could lead to data leakage.
Detects the creation, alteration, or deletion of a SQL external model that could be used to establish a persistent exfiltration channel. Threat actors can leverage this to send data to an external server whenever a table is updated, particularly when combined with SQL triggers.
This rule detects potential data exfiltration attempts via Slack incoming webhooks. It triggers when an HTTP POST request is made to 'hooks.slack.com' with a URI containing '/services/' and a data size greater than 500 bytes. This pattern is indicative of an application or script sending data to a Slack channel using a webhook.
Detects the configuration change that enables the 'external rest endpoint' feature in SQL Server 2025. Threat actors can abuse this feature using sp_invoke_external_rest_endpoint to natively exfiltrate data and establish C2 channels.
This rule detects potential data exfiltration attempts via Discord webhooks. It specifically looks for HTTP POST requests to discord.com/api/webhooks/ with a data size greater than 500 bytes. This could indicate an attacker sending sensitive information out of the network using Discord's API.
This rule detects potential data exfiltration attempts via Microsoft Teams webhook connectors. It specifically looks for HTTP POST requests to 'outlook.office.com' with a URI containing '/webhook/' and a data size greater than 500 bytes. This combination suggests that data might be sent out through a Teams webhook, which can be abused for exfiltration.
This rule detects network connections from devices to a predefined list of domains commonly associated with data exfiltration services. Monitoring these connections can help identify attempts to transfer sensitive data out of the network.
This rule detects unusual network connections from processes to legitimate service endpoints that are commonly abused for Command and Control (C2) activities (LOLC2). It specifically looks for connections to services like Telegram, Slack, Discord, GitHub, Google APIs, Pastebin, Dropbox, and others, originating from processes that are not recognized as legitimate applications for those services, and not from common system processes or standard program file paths. This helps identify potential adversary communication channels masquerading as legitimate traffic.
Page 2 of 5