Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,615 detections
Filters
Last updated
All Time
Detection languages
1,725
690
266
214
190
Contributors
985
505
494
256
209
Categories
814
787
730
629
473
Platforms
2,071
629
488
459
346
Products / Services
769
666
527
195
185
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
3,615
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
Detects when a non-Outlook process running as SYSTEM accesses Outlook mailbox data files (.pst or .ost). This rule focuses on identifying suspicious access to sensitive email data outside of normal application behavior, retaining principal and target context for correlation.
Udm Mail Raw Ip Https
YARA-L
This rule detects network connections made by processes commonly associated with mail collection, archiving, or data export (e.g., mail, archive, collector, export, rclone, winscp, curl executables). The detection specifically looks for these processes making HTTPS connections where the command line contains keywords related to email data files (.pst, .ost) or email processing (aspose.email, mailbox). The rule aims to identify potential exfiltration or collection of email data over HTTPS.
Detects patterns indicative of double extortion ransomware attacks, specifically the staging of large volumes of archived data followed by suspicious command and control (C2) communications. The rule identifies the creation, modification, or movement of multiple large archive files (RAR, 7z, ZIP, TAR, GZ, CAB) in common temporary or system directories, and correlates this activity with outbound network connections to known C2 indicators such as Tor/I2P/VPN/proxy services or non-RFC1918 IP addresses.
Detects the creation or modification of large Zstandard (.zst or .tar.zst) archive files (100MB or larger) within common temporary, data exfiltration, staging, or PeopleSoft-related directories. This activity can indicate an attacker archiving collected data for exfiltration or staging it for further actions.
Detects the gh-token-monitor script using grep to extract GitHub Classic or Fine-Grained tokens (matching the ghp_ or gho_ structure) from the filesystem. This rule specifically looks for process command lines containing 'grep' and the regex pattern 'gh[po]_[a-zA-Z0-9]{36}', which is indicative of searching for GitHub tokens.
Detects an unsigned game-related process creating an archive and initiating cloud-storage network activity without an interactive cloud client. This rule specifically looks for network events where the process name contains 'bird', 'rok', 'game', 'update', 'python', or 'ruby' (case-insensitive) and the command line includes terms like 'zip', 'archive', 'upload', 'multipart', 'cloud', 'dropbox', or 'pcloud'.
Detects the specific xcopy command-line arguments used by APT37 NarwhalRAT to silently copy data from removable drives to a local temporary path. This rule looks for the combination of '/s', '/e', '/y', '/c', '/q', '/h', and '/b' flags used with xcopy.exe, which is indicative of the malware's data staging behavior.
Detects a non-Firefox process creating staged copies of at least three NSS, login, cookie, history, or preference files from Firefox-style profiles. The logic requires the reported SessionGate, Remus, or AnimateClipper structure rather than a standalone executable name.
Detects patterns indicative of double extortion ransomware attacks, specifically the staging of large volumes of archived data followed by suspicious command and control (C2) communications. The rule identifies the creation, modification, or movement of multiple large archive files (RAR, 7z, ZIP, TAR, GZ, CAB) in common temporary or system directories, and correlates this activity with outbound network connections to known C2 indicators such as Tor/I2P/VPN/proxy services or non-RFC1918 IP addresses.
Detects post-compromise inbox rule creation that moves security/phishing alerts to a folder and marks them as read. This behavior is often associated with adversaries attempting to hide their activities or prevent detection.
Detects an administrative content rule that combines strategic research or defence collection terms with an external BCC, forward, or redirect destination. GTIG reported that the Patroit rule matched subjects related to medical research, Chikungunya, artificial intelligence, cyber programmes, Indo-Pacific operations, defence, and uncrewed systems before silently forwarding the messages.
Detects unique INFINITERED marker strings in process command lines or event metadata. The indicators include the upgrade-code GUID delimiter, its Base64 representation, the stolen-session identifier prefix, and the custom file-download command tag. These values are specific to the reported malware and should be treated as high-confidence evidence when present.
Detects PHP or web server processes launching archive and compression utilities. A compromised web application may use these tools to package REDCap files, database exports, credentials, or research data before exfiltration. This behaviour should be rare outside documented backup or deployment activity.
This rule correlates the modification of 'Upgrade.php' with subsequent changes to REDCap authentication, login, or hook-related PHP files on the same device within a 30-minute window. This activity is indicative of the INFINITERED threat actor's technique to intercept the REDCap upgrade process and reinject credential harvesting, backdoor, and persistence code into new software versions. Such a sequence should be compared with approved maintenance windows and expected deployment activity to identify malicious behavior.
Uses time-windowing to detect a single anomalous process rapidly opening multiple telecom billing/radius .xml or .cfg files, indicating automated config parsing prior to exfiltration.
Detects bulk export of CRM customer data for collection and theft
Detects PowerShell using the Add-Type cmdlet to dynamically compile C# code referencing keylogging (SetWindowsHookEx) or screen capture (CopyFromScreen) APIs. This behavior is indicative of PS1Bot in-memory module execution.
Detects the creation of large archive files (zip, rar, 7z, tar.gz) exceeding 50MB in common temporary or program data folders, specifically when these archives are created shortly after files from user document directories (Documents, Desktop, Downloads, Finance, HR, Accounting) were copied or read. This behavior is indicative of data staging by the MedusaLocker ransomware variant prior to encryption or exfiltration.
This rule detects the presence of specific files and API calls associated with the SprySocks malware, which functions as a keylogger. It looks for 'lgf.dat' and 'lg.dat' files within a 'Microsoft\Vault' directory, combined with the presence of keylogging-related API functions like 'GetClipboardData', 'GetForegroundWindow', and 'GetAsyncKeyState'. This combination indicates potential keylogger activity on a Windows system.
Detects unusual communication patterns from executive accounts in Office 365, specifically looking for mail activity, inbox rule creation, or mailbox modifications combined with keywords related to wire transfers, payments, or urgent financial actions. The rule flags scenarios where multiple such activities occur within a short timeframe (3 hours) or if new inbox rules are created, indicating potential deepfake/synthetic impersonation or Business Email Compromise (BEC) attempts.
Detects unusual communication patterns from executive accounts in Office 365, specifically looking for mail activity, inbox rule creation, or mailbox modifications combined with keywords related to wire transfers, payments, or urgent financial actions. The rule flags scenarios where multiple such activities occur within a short timeframe (3 hours) or if new inbox rules are created, indicating potential deepfake/synthetic impersonation or Business Email Compromise (BEC) attempts.
Page 115 of 173