Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
This rule detects large file uploads (greater than 100MB) from endpoints to unmanaged or personal cloud storage services such as Google Drive, OneDrive, and Dropbox. This behavior may indicate unauthorized data exfiltration or the improper use of unapproved cloud storage platforms to move sensitive data outside of corporate control.
This rule detects a multi-stage attack pattern associated with Akira ransomware, including AD enumeration using PowerShell, data staging with WinRAR, S3 exfiltration via s5cmd, AnyDesk service installation, registry manipulation for persistence via Safe Mode, and boot configuration changes to facilitate EDR bypass. It also incorporates detection for specific IOCs like attacker jump host RDP connections and malicious file hashes.
Detects users who have downloaded more than 50 files from cloud storage applications within a single hour, potentially indicating data exfiltration or mass data harvesting.
This rule monitors Netskope cloud application events to detect potential data exfiltration. It triggers if there is a significant volume anomaly (z-score >= 2) for any cloud application activity, or if a 'Share' or 'Upload' activity occurs that is only configured to 'Alert' rather than being blocked. This helps identify unusual spikes in data movement or sensitive operations that bypass formal enforcement controls.
Detects the use of curl.exe or curl to communicate with the malicious domain 'i.apee.my.id', initiated by a VS Code integrated terminal process. This behavior is indicative of malicious VS Code extensions exfiltrating data via a hidden terminal session.
This rule aggregates Zscaler Internet Access (ZIA) logs to identify users with Data Loss Prevention (DLP) violations. It calculates the frequency of incidents and flags high-activity users for potential data exfiltration analysis.
Detects high or critical severity Data Loss Prevention (DLP) alerts triggered by the Zscaler NSS platform. The rule identifies web traffic involving sensitive information categories such as Personally Identifiable Information (PII), financial data, or source code, which have been either allowed or blocked by Zscaler policy.
Detects an egress transfer of 100-120KB to known ACRStealer C2 IPs (45.155.68.45, 104.21.70.245) immediately followed within 60 seconds by an ingress transfer of 4-8MB, matching the campaign's post-collection exfiltration-then-payload-ingress pattern.
Detects HTTP traffic to StopAndProtect's compromised-WordPress C2 operational endpoints, heartbeat beaconing, encrypted-archive exfiltration, and victim data directory access.
Detects high or critical severity Data Loss Prevention (DLP) alerts triggered by the Zscaler NSS platform. The rule identifies web traffic involving sensitive information categories such as Personally Identifiable Information (PII), financial data, or source code, which have been either allowed or blocked by Zscaler policy.
Detects high-risk user behavior associated with unsanctioned or restricted Generative AI applications, specifically targeting large data uploads (potential data exfiltration) or repeated access following a coaching intervention.
Detects DLP events from Netskope where sensitive data (PII, PCI, Source Code, or Credentials) is being uploaded or shared, indicating potential data exfiltration.
Detects DLP policy violations flagged by Netskope when users upload, share, post, or send files within Slack or Microsoft Teams. This rule monitors for DLP profile matches which may indicate unauthorized exfiltration or exposure of sensitive data via collaboration tools.
Detects DLP policy violations flagged by Netskope when users upload, share, post, or send files within Slack or Microsoft Teams. This rule monitors for DLP profile matches which may indicate unauthorized exfiltration or exposure of sensitive data via collaboration tools.
Detects ACRStealer C2 data-transfer bursts (outbound credential-data exfiltration >100KB, inbound follow-on payload >1MB) correlated with prior credential-sweep and process-injection-stage flowbits, rather than raw transfer size alone.
This rule detects large file uploads (greater than 100MB) from endpoints to unmanaged or personal cloud storage services such as Google Drive, OneDrive, and Dropbox. This behavior may indicate unauthorized data exfiltration or the improper use of unapproved cloud storage platforms to move sensitive data outside of corporate control.
Detects data exfiltration by the Kynx Stealer ChunkSender module which uses HTTP POST requests to a specific ingestion path.
Detects HTTP POST requests characteristic of the Kynx Stealer's ChunkSender module. The rule monitors for specific URI patterns used during the exfiltration phase, where stolen data categories like passwords, cookies, and system information are sent to a remote C2 panel.
This rule aggregates Zscaler Internet Access (ZIA) logs to identify users with Data Loss Prevention (DLP) violations. It calculates the frequency of incidents and flags high-activity users for potential data exfiltration analysis.
Detects instances where sensitive or organizational data is uploaded to public text storage repositories like Pastebin or GitHub Gists through Netskope, which may indicate data exfiltration.
This rule identifies potential DNS tunneling or exfiltration attempts by monitoring for high volumes of DNS queries, a high count of distinct subdomains, or the usage of unusual DNS record types (TXT, NULL) within Zscaler Internet Access logs.
Page 38 of 124