Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,615 detections
Filters
Last updated
All Time
Detection languages
1,725
690
266
214
190
Contributors
985
505
494
256
209
Categories
814
787
730
629
473
Platforms
2,071
629
488
459
346
Products / Services
769
666
527
195
185
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
3,615
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
This rule detects potential Agent Tesla malware activity by correlating process execution with network connections. It looks for processes named 'agenttesla.exe', 'atsvc.exe', or 'atservice.exe' that execute with command-line arguments indicative of data exfiltration (e.g., 'smtp', 'ftp', 'http.post', 'exfil'). The rule then correlates these process events with outbound network connections to non-private IP addresses, flagging instances where multiple process runs and multiple network connections occur within a 30-minute window.
This rule detects suspicious process creations where the command line contains keywords indicative of keylogger activity (e.g., 'keylog', 'keystroke', 'inputmanipulator', 'spyware') combined with installation-related keywords (e.g., 'install', 'create', 'load', 'run'). It aggregates these events by computer and user over one-hour intervals to identify potential keylogger installation attempts.
Identifies the creation of '.node' payload modules by Lucid Stealer in the Common AppData folder, indicative of the SEA payload staging its remote control and theft modules. This rule specifically looks for file creation events where the file name ends with '.node' and the folder path matches a pattern under the user's local AppData 'Common' folder.
This rule looks for fake reverse-engineering or debugging tools installing clipboard monitors that swap cryptocurrency addresses. Developers are targeted because they handle valuable assets. Use official vendor downloads only. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Hunting rule: correlate with additional signals before alerting. Detects recursive collection of office documents into a single archive, common pre-exfil staging.
Detects the execution of WinSCP or Rclone binaries, which are frequently used by threat actors like UNC3753 to exfiltrate staged data. This rule specifically looks for process creation events where the image name is 'winscp.exe' or 'rclone.exe'.
Detects extraction of network device running configurations
Detects keylogger captured data being exfiltrated via HTTP POST requests
Detects bulk file reading from removable media shares for data collection
Detects screen capture image data being exfiltrated via HTTP POST
Detects keylogger-captured data exfiltration via HTTP POST requests
Detects creation of archives for staging collected data before exfiltration
Detects LD_PRELOAD environment variable set to load malicious shared libraries
This rule detects potential data exfiltration or unauthorized copying of data from USB drives via an SSH SCP session. It specifically looks for TCP traffic on port 22 (SSH) within the home network, where the data flow is from the client to the server (upload). The rule triggers if the content of the SCP session includes both "/media/" and "/usb" (case-insensitive), indicating paths commonly associated with mounted USB devices on Linux systems, and the data size is greater than 1000 bytes. This suggests that contents from a USB drive are being copied off the system over SSH.
This rule detects when a client makes repeated HTTP requests to the SharePoint download.aspx page, specifically looking for the URI pattern "/_layouts/download.aspx". This behavior, when occurring frequently from a single source, could indicate an attempt to enumerate and potentially exfiltrate content from a SharePoint site. The rule uses a threshold of 20 requests within 60 seconds from the same source IP to trigger an alert, suggesting a bulk download or enumeration activity.
This rule detects potential bulk email collection activity over IMAP. It triggers when a client makes 30 or more IMAP 'FETCH' commands containing 'BODY[]' (indicating a request for the full email body) to a server on port 143 within a 60-second window. This behavior can be indicative of an attacker or malicious insider exfiltrating a large number of emails from an IMAP server.
This rule detects attempts to copy the running configuration from a network device via SSH. It specifically looks for the string "show running-config" within TCP traffic destined for port 22 (SSH) on the home network. This activity is often associated with reconnaissance or data exfiltration by attackers or malicious insiders.
This rule detects the creation of a tar archive using the 'tar -czf' command, specifically when the archive is being created in the '/tmp/' directory over an SSH connection. This activity is indicative of data staging, where an attacker might be preparing data for exfiltration or further malicious use.
This rule detects the delivery of a fake GUI login prompt over HTTP, likely for credential capture. It looks for HTTP responses (flow:to_client) containing the strings "ShowDialog", "Password", and "GetWindowText" (case-insensitive) within the file data. This combination of keywords suggests an attempt to mimic a legitimate login interface to trick users into providing their credentials.
This rule detects a rogue DHCP server offer on the network. It specifically looks for UDP traffic on port 67 (DHCP server port) to the home network, containing the DHCP message type '02' (DHCP Offer) at the beginning of the payload. A threshold is set to trigger an alert if 3 such offers are detected from the same source within 10 seconds, indicating a potentially malicious or misconfigured DHCP server attempting to assign IP addresses.
Detects in-memory archive creation using .NET compression libraries
Page 121 of 173