Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
Detects usage of the 'One Outlook Web' application (ApplicationId 20893) to access Microsoft 365 Exchange REST APIs. This activity is a potential precursor to high-volume mailbox data exfiltration and should be monitored for volumetric anomalies.
Detects instances where a large volume of data (greater than 5GB) is transferred through an anonymous proxy using specific cloud application IDs. This pattern is indicative of potential data exfiltration via third-party or obscured network channels.
Detects high-volume file download or data access events across SharePoint, OneDrive, and Exchange Online. This rule monitors for requests from Python-based HTTP libraries (httpx, requests, urllib) targeting Microsoft Graph API endpoints, which is a pattern indicative of automated bulk data collection or exfiltration, often observed in campaigns like Storm-3121 or Storm-3032.
Detects a sequence of user activities—authentication, MFA registration, Graph API reconnaissance, and data exfiltration—originating from a rotating set of distinct source IP addresses for the same user within a 24-hour period. This behavior is indicative of coordinated infrastructure rotation tactics used by threat actors in cloud intrusions.
Detects network connections to known JeetBot infrastructure domains and IP addresses. The rule specifically identifies potential exfiltration of Twitch OAuth tokens via URL parameters or interaction with known token-collection proxy endpoints, which are associated with the JeetBot/Twitch Enhanced Viewer credential harvesting campaign.
Detects network connections originating from browser processes to known JeetBot command and control (C2) infrastructure. The rule identifies suspicious C2 communication and, specifically, attempts at token exfiltration by monitoring for auth tokens in the URL of requests directed to known JeetBot hosts and Twitch-related infrastructure.
This rule detects file creation or modification events occurring within the 'ProgramData\ZlibDate' directory. This specific path and the associated file extensions (.Dat and .zip) are frequently associated with data staging activities or unauthorized file management by malicious software attempting to persist or exfiltrate data under the guise of legitimate application data.
This rule monitors network traffic for requests directed at a specific domain ('luizestrelhashapr.online') and path ('/google_api/b83fa72d.css'), which is identified in threat intelligence as an indicator of browser history exfiltration.
Detects outbound network communication from common web browsers (chrome.exe, msedge.exe) to a specific malicious domain and path associated with suspected Kremlin-linked screenshot exfiltration activities.
Detects outbound network communication from common web browsers (chrome.exe, msedge.exe) to a specific malicious domain and path associated with suspected Kremlin-linked screenshot exfiltration activities.
Detects network indicators associated with the StealC information stealer, including DNS lookups for identified C2 domains, HTTPS traffic to known C2 endpoints, and suspicious POST requests using multipart/form-data indicative of credential or session data exfiltration.
Detects instances where the outbound byte count to external (non-private) IP addresses for a source host significantly exceeds its historical hourly baseline. This detection is designed to identify potential data exfiltration stages occurring after system or network compromise.
This rule monitors Office 365 file download activity, identifying users whose download volume significantly deviates from their historical baseline. It specifically looks for an unusually high number of unique files downloaded in a one-hour window, while excluding known service accounts and synchronization agents like OneDrive sync client.
Detects anomalous, large-scale cloning or mirroring of code repositories combined with targeted access to infrastructure-as-code configuration files (e.g., .tfvars, .tfstate) or automated exfiltration of CI/CD build artifacts. This behavior is indicative of an adversary attempting to exfiltrate proprietary source code or sensitive secrets stored within repositories.
Detects the creation of a new AWS S3 bucket followed by a large volume of data uploads (more than 200 objects) within a 2-hour window. The detection focuses on activity attributed to a single identity with limited source IP diversity, which is highly indicative of scripted data staging and potential exfiltration preparation by an unauthorized actor.
Detects Odyssey Stealer malware communicating with a known C2 infrastructure using TLS and performing data exfiltration via HTTP requests to raw-IP destinations using disguised file names such as analytics.gif, pixel.png, and content.js.
This rule detects potential automated cryptocurrency wallet draining activity by correlating the execution of known stealer processes (such as GapiUpdate or NeedleStealer) with subsequent outbound network connections to suspicious command-and-control domains or API endpoints within a 30-minute window.
Detects NeedleStealer Go-based stealer payload via embedded module path, internal API namespace, build tag, and C2 backend domain
Detects NeedleStealer Go-based stealer payload via embedded module path, internal API namespace, build tag, and C2 backend domain
This rule detects potential exfiltration of sensitive files, specifically 'cert.pem' and 'private.key', via HTTP POST requests to the '/api/adbk/upload' endpoint. This pattern is characteristic of the RatHat malware attempting to exfiltrate device credentials to a Command and Control (C2) server.
Detects HTTP POST requests from Android devices identified as RatHat malware, specifically targeting exfiltration of sensitive data including credentials, cipher keys, and ADB certificate/key uploads via the malware's C2 API.
Page 31 of 124