Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,116
15,636
12,583
8,393
6,221
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
Suspicious SQL Query
Sigma
Detects suspicious SQL query keywrods that are often used during recon, exfiltration or destructive activities. Such as dropping tables and selecting wildcard fields
The analytic identifies ICMP traffic to external IP addresses with total bytes (sum of bytes in and bytes out) greater than 1,000 bytes. It leverages network traffic data to detect large ICMP packets that aren't blocked and are directed toward external networks. This can indicate information smuggling, covert communication, or command-and-control (C2) activities, potentially signaling ICMP tunneling, unauthorized data transfer, or compromised endpoints.
This analytic detects potentially suspicious large outbound data transfers from internal to external networks using Cisco Secure Firewall Threat Defense logs. It calculates the total volume of data exchanged per connection by summing InitiatorBytes and ResponderBytes. Connections exceeding 100 MB are flagged, as these may indicate unauthorized data exfiltration, especially if initiated by unusual users, hosts, or processes. The detection is scoped to inside-to-outside network flows. If confirmed malicious, this behavior may reflect data staging and exfiltration over an encrypted or stealthy transport.
The analytic identifies potential DNS exfiltration using the nslookup application. It detects specific command-line parameters such as query type (TXT, A, AAAA) and retry options, which are commonly used by attackers to exfiltrate data. The detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process execution logs. This activity is significant as it may indicate an attempt to communicate with a Command and Control (C2) server or exfiltrate sensitive data. If confirmed malicious, this could lead to data breaches and unauthorized access to critical information.
This analytic detects API calls to enable S3 bucket replication services. It leverages AWS CloudTrail logs to identify `PutBucketReplication` events, focusing on fields like `bucketName`, `ReplicationConfiguration.Rule.Destination.Bucket`, and user details. This activity is significant as it can indicate unauthorized data replication, potentially leading to data exfiltration. If confirmed malicious, attackers could replicate sensitive data to external accounts, leading to data breaches and compliance violations.
The following analytic identifies potential DNS data exfiltration using a pre-trained deep learning model. It leverages DNS request data from the Network Resolution datamodel and computes features from past events between the same source and domain. The model generates a probability score (pred_is_exfiltration_proba) indicating the likelihood of data exfiltration. This activity is significant as DNS tunneling can be used by attackers to covertly exfiltrate sensitive data. If confirmed malicious, this could lead to unauthorized data access and potential data breaches, compromising the organization's security posture.
The analytic identifies web activity related to employment searches within a network using Zscaler web proxy logs. It focuses on entries categorized as 'Job/Employment Search' and analyzes data points such as device owner, user, URL category, destination URL, and IP. This detection helps monitor potential insider threats by identifying users who may be seeking new employment, which could indicate a risk of data exfiltration or other insider threats, potentially leading to sensitive information leakage or other security breaches.
The following analytic detects a series of AWS API calls related to EC2 snapshots within a short time window, indicating potential exfiltration via EC2 Snapshot modifications. It leverages AWS CloudTrail logs to identify actions such as creating, describing, and modifying snapshot attributes. This activity is significant as it may indicate an attacker attempting to exfiltrate data by sharing EC2 snapshots externally. If confirmed malicious, the attacker could gain access to sensitive information stored in the snapshots, leading to data breaches and potential compliance violations.
The analytic identifies spikes in blocked outbound network connections originating from within an AWS environment. It uses VPC Flow Logs data from CloudWatch, specifically looking for 'blocked' actions from internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) to external destinations. A spike is determined by comparing the current number of blocked connections against a calculated baseline (average and standard deviation) over time. This detection is significant as it can indicate potential exfiltration attempts or misconfigurations leading to data leakage. If confirmed malicious, such activity could allow attackers to bypass network defenses, leading to unauthorized data transfer or communication with malicious external entities.
The following analytic detects when an EC2 snapshot is shared with an external AWS account by analyzing AWS CloudTrail events. This detection method leverages CloudTrail logs to identify modifications in snapshot permissions, specifically when the snapshot is shared outside the originating AWS account. This activity is significant as it may indicate an attempt to exfiltrate sensitive data stored in the snapshot. If confirmed malicious, an attacker could gain unauthorized access to the snapshot's data, potentially leading to data breaches or further exploitation of the compromised information.
This analytic detects when an excessive number of files are accessed from Office 365 by the same user over a short period of time. This behavior may indicate an attacker staging data for exfiltration or an insider threat removing organizational data. The rule specifically looks for `fileaccessed` operations in the Office 365 Universal Audit Log, excluding SharePoint app access and common image file extensions. It then calculates the count of unique source file names accessed per user and flags users whose access count significantly exceeds the average (3 standard deviations above the mean) and is greater than 50 files. This can help identify malicious actors abusing "open in app" functionality or Graph API-based access to evade typical file download events.
This analytic detects network connections flagged by Cisco Secure Firewall's Encrypted Visibility Engine (EVE) with a high threat confidence score (80% or greater). This indicates that the encrypted traffic is highly likely to be malicious, potentially associated with malware command and control (C2), remote access tools, or suspicious tunneling behavior. Such activity could signify covert communication from compromised hosts.
The analytic identifies excessive DNS query failures by counting DNS responses that do not indicate success, triggering when there are more than 50 occurrences. It leverages the Network_Resolution data model, focusing on DNS reply codes that signify errors. This activity is significant because a high number of DNS failures can indicate potential network misconfigurations, DNS poisoning attempts, or malware communication issues. If confirmed malicious, this activity could lead to disrupted network services, hindered communication, or data exfiltration attempts by attackers.
The analytic identifies blocked destinations within a network that are deemed privacy risks by Zscaler. It leverages web proxy logs, focusing on entries marked as "Privacy Risk." Key data points such as device owner, user, URL category, destination URL, and IP are analyzed. This activity is significant for a SOC as it helps monitor and manage privacy risks, ensuring a secure network environment. If confirmed malicious, this activity could indicate attempts to access or exfiltrate sensitive information, posing a significant threat to data privacy and security.
The following analytic identifies potential AWS S3 exfiltration behavior by correlating multiple risk events related to Collection and Exfiltration techniques. It leverages risk events from AWS sources, focusing on instances where two or more unique analytics and distinct MITRE ATT&CK IDs are triggered for a specific risk object. This activity is significant as it may indicate an ongoing data exfiltration attempt, which is critical for security teams to monitor. If confirmed malicious, this could lead to unauthorized access and theft of sensitive information, compromising the organization's data integrity and confidentiality.
The following analytic identifies high inbound or outbound network I/O anomalies in Kubernetes containers. It leverages process metrics from an OTEL collector and Kubelet Stats Receiver, along with data from Splunk Observability Cloud. A lookup table with average and standard deviation values for network I/O is used to detect anomalies persisting over a 1-hour period. This activity is significant as it may indicate data exfiltration, command and control communication, or unauthorized data transfers. If confirmed malicious, it could lead to data breaches, service outages, financial losses, and reputational damage.
This analytic detects when an excessive number of files are synced from Office 365 by the same user over a short period of time. This behavior may indicate an attacker staging data for exfiltration or an insider threat removing organizational data. The rule specifically looks for `filesyncdownload*` operations with a `UserAgent` containing `*SkyDriveSync*` and filters out cases where the `SiteUrl` matches the user's flat ID, which could be legitimate personal sync activity. A threshold of more than 50 unique source file names downloaded by a single user is used to trigger the alert. Additional attention should be taken with any Azure Guest (#EXT#) accounts.
The analytic detects the execution of 7z, 7za, or 7zr processes with command lines pointing to SMB network shares. This activity may indicate an attempt to archive and exfiltrate sensitive files to a network share, a technique observed in CONTI LEAK tools. If confirmed malicious, this behavior could lead to data exfiltration, compromising sensitive information and potentially aiding further attacks.
The analytic identifies a spike in API activity related to the deletion of S3 buckets in an AWS environment. It uses AWS CloudTrail logs to detect anomalies by comparing current deletion activity against a historical baseline. Unusual spikes in S3 bucket deletions could indicate malicious actions such as data exfiltration or unauthorized data destruction, leading to significant data loss, disruption of services, and potential exposure of sensitive information. Immediate investigation is required to determine the legitimacy of the activity.
This analytic detects when an excessive number of files are downloaded from Office 365 by the same user over a short period of time. Office 365 may bundle these files together as a ZIP file, however each file will have its own download event. This behavior may indicate an attacker staging data for exfiltration or an insider threat removing organizational data. Additional attention should be taken with any Azure Guest (#EXT#) accounts.
The analytic identifies the execution of rundll32.exe with command-line arguments loading davclnt.dll and the davsetcookie function to access a remote WebDAV instance. This activity is significant as it may indicate an attempt to exploit CVE-2023-23397, a known vulnerability. If confirmed malicious, this could allow an attacker to execute remote code or exfiltrate data, posing a severe threat to the environment.
Page 114 of 124