Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,615 detections
Filters
Last updated
All Time
Detection languages
1,725
690
266
214
190
Contributors
985
505
494
256
209
Categories
814
787
730
629
473
Platforms
2,071
629
488
459
346
Products / Services
769
666
527
195
185
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
3,615
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
Detects a hidden PowerShell process dynamically loading the Windows Forms assembly to inject base64-encoded keystrokes into foreground applications. This behavior is associated with the SStar Agent RAT's remote 'type' functionality.
Detects a hidden PowerShell process dynamically loading the Windows Forms assembly to inject base64-encoded keystrokes into foreground applications. This technique is used by the SStar Agent RAT for its remote 'type' functionality.
This rule detects an unusually high number of web search queries (identified by 'search' or 'query' in the URI) originating from a single IP address within a one-hour window. A threshold of 100 or more queries triggers the alert. This behavior could indicate automated activity such as web scraping, reconnaissance, or a denial-of-service attempt against the search functionality.
This rule detects potential Agent Tesla malware activity by correlating process execution with network connections. It looks for processes named 'agenttesla.exe', 'atsvc.exe', or 'atservice.exe' that execute with command-line arguments indicative of data exfiltration (e.g., 'smtp', 'ftp', 'http.post', 'exfil'). The rule then correlates these process events with outbound network connections to non-private IP addresses, flagging instances where multiple process runs and multiple network connections occur within a 30-minute window.
GitHub CLI Token Extraction
Cortex XDR
Detects the execution of `gh auth token` which is used by the Shai-Hulud malware to steal the active GitHub Personal Access Token (PAT). This rule specifically looks for the `gh.exe` or `gh` process executing with command-line arguments containing both "auth" and "token".
This rule detects potential video stream exfiltration over HTTP POST. It specifically looks for HTTP POST requests with a large payload size (greater than 100,000 bytes) and the byte sequence '|52 49 46 46|' at the beginning of the file data, which corresponds to the 'RIFF' header commonly found in multimedia file formats like AVI and WAV. This combination suggests an attempt to upload or exfiltrate video or audio data.
This rule detects potential audio stream exfiltration using the Real-time Transport Protocol (RTP). It specifically looks for UDP traffic with a packet size between 160 and 200 bytes, which is characteristic of some RTP audio streams. A threshold of 100 such packets from the same source within 10 seconds triggers the alert, indicating a sustained audio stream.
This rule detects the upload of a PNG image file over HTTP using a POST request. This could indicate an attacker exfiltrating screen captures, which aligns with MITRE ATT&CK technique T1113 (Screen Capture). The rule specifically looks for the HTTP POST method and the PNG file signature (89 50 4E 47) within the file data.
This rule detects suspicious NTLM network or remote interactive logon activity. It specifically looks for multiple distinct accounts logging in from the same device and remote IP address within a one-hour window, using NTLM authentication via NtLmSsp or Seclogon processes. This pattern can indicate credential stuffing, NTLM relay attacks, or other forms of credential misuse.
Detects the creation of email forwarding rules in Google Workspace that direct emails to external domains. This activity can indicate potential Business Email Compromise (BEC) for persistence or insider data exfiltration.
Detects the creation of archive files (zip, rar, 7z, tar.gz) by processes other than common archiving utilities. This could indicate data staging or preparation for exfiltration by an adversary.
Detects suspicious processes attempting to access the Signal Desktop attachments directory. This behavior indicates potential data collection by post-compromise tooling, such as the InboxSetupPro second-stage tool observed in Nimbus RAT campaigns.
Detects the creation of the specific hardcoded temporary file (~wra1269.tmp) used by the Argamal RAT to store captured screenshots during its surveillance operations prior to exfiltration.
Detects execution of 7z in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.
Detects the export of Microsoft Teams messages, transcripts, recordings, and chat retrieval activities, particularly when performed via the Graph API. This rule identifies suspicious activity by looking for specific operation names in SaaS audit logs from Microsoft Teams and flags user agents commonly associated with automation tools (e.g., python-requests, axios, go-http, curl, wget, powershell, httpx, aiohttp, node) which could indicate post-compromise attackers using stolen tokens to silently export chat history.
This rule detects the creation or modification of Exchange transport rules or inbox rules that forward or redirect emails to external domains. It specifically looks for operations like 'New-TransportRule', 'Set-TransportRule', 'New-InboxRule', 'Set-InboxRule', 'Set-Mailbox', 'UpdateInboxRules', and 'Set-TransportConfig' where the destination is an email address outside of the organization's verified domains. This activity can indicate data exfiltration or an attempt to maintain persistence and collect sensitive information.
Identifies Node.js processes downloading the Bun runtime from GitHub Releases. This behavior was observed in the vpmdhaj npm supply chain attack, where Gen-2 stagers silently downloaded Bun to execute bundled credential harvesting payloads without an immediate C2 payload drop.
Detects the creation or modification of GitHub Actions workflow files designed to dump and exfiltrate repository secrets, a technique observed in the Mini Shai-Hulud supply chain attack. This rule specifically looks for file events in GitHub Actions workflow directories combined with command-line patterns indicative of secret exfiltration or the creation of a specific malicious workflow file ('codeql_analysis.yml') by scripting interpreters.
Box SaaS Suspicious File Upload
Cortex XDR
Detects suspicious file uploads to Box indicating potential data staging, tool upload, or exfiltration via shared folders. This rule specifically looks for the 'UPLOAD' operation within Box SaaS audit logs and extracts various file and user-related details.
Detects a temporal pattern characteristic of CVE-2026-42897 XSS exploitation: an OWA user reads a message (via Bind, OpenMessage, or similar EWS/OWA endpoints), and within 60 seconds, the same session issues a POST request to create or modify an inbox rule. This rapid succession from the same session cookie indicates programmatic action (XSS-driven JavaScript) rather than human-driven workflow. The rule correlates events by client IP and username within a 60-second window.
Detects the execution of rundll32.exe calling a specific exported function ('open') associated with the fake lock screen DLL ('com6848.dll') to capture user passwords. This technique is often used in credential harvesting campaigns.
Page 127 of 173