Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
This rule detects outbound network connections to URLs associated with common file sharing services (e.g., Dropbox, Mega, Gofile) or temporary email providers (e.g., Temp-Mail). Such connections can indicate data exfiltration attempts, use of unsanctioned services, or communication with command and control infrastructure.
This rule detects outbound HTTP POST requests to dynv6-hosted infrastructure, specifically targeting communication patterns associated with Kimsuky campaigns. It monitors for exfiltration indicators such as the 'finalservice.php' endpoint, specific multipart form boundaries, and file indicators like 'Info.txt' used for data exfiltration.
Detects instances where Chrome or Microsoft Edge web browsers access local sensitive credential storage files (e.g., Login Data, Web Data, Cookies) from unexpected file system paths, combined with external network traffic from the same process instance. This behavior is indicative of potential malicious browser extension abuse, DLL sideloading, or unauthorized browser instance execution for credential exfiltration.
This rule detects file system artifacts and network activity associated with a malicious Chromium-based browser extension (ID: flkebkiofojicogddingbdmcmkpbplcd). The extension utilizes service workers to intercept browser search queries and capture keystrokes, subsequently exfiltrating the data to an attacker-controlled domain.
Detects high-volume file writes or the use of common command-line copy utilities (xcopy, robocopy, copy) targeting removable drive paths (E-G:). This behavior is often indicative of data staging or exfiltration activities.
This rule detects a high volume of file creation or modification events on removable media (e.g., USB drives). A count of 10 or more file operations within a one-hour window by a single initiating process account on paths containing 'USB' or 'Removable' is considered suspicious and may indicate data exfiltration or staging.
Detects an unusually high number of file copy operations to 'public' or 'external' folders within a one-hour window, initiated by the same process account. This behavior could indicate data exfiltration or unauthorized data staging.
Detects unusual DNS requests initiated by common development, scripting, and administrative tools (e.g., node, python, powershell, curl) to domains that follow patterns often used for webhooks, relays, or command-and-control services. The rule specifically excludes common package management or source code repositories to reduce noise.
Detects activity associated with the RoguePlanet exploit, which involves creating EICAR content and NTFS Alternate Data Streams (ADS) within specific staging directories (wdtest_temp or RP_<UUID>). This behavior is intended to trigger Windows Defender scans and induce a TOCTOU race condition (CVE-2026-50656) by manipulating file operations near the wermgr.exe process.
Detects network communication to the Telegram Bot API (api.telegram.org) initiated by processes other than standard web browsers. This behavior is indicative of malicious activity such as automated data exfiltration, C2 communication, or victim status reporting, as observed in ransomware campaigns like BQTLock.
Detects browser-initiated DNS queries to bing.com during an active Microsoft 365 Copilot session within the same process storyline. This pattern is indicative of a potential SearchLeak HTML rendering race condition (CVE-2026-42824), where a malicious streamed <img> tag triggers an outbound request to Bing before Content Security Policy (CSP) sanitization is applied, potentially exfiltrating sensitive Copilot-retrieved mailbox data.
Detects evidence of SearchLeak (CVE-2026-42824), a post-exploitation technique where M365 Copilot prompt injection causes a browser to perform a Bing 'searchbyimage' request. The 'imgurl' parameter points to an attacker-controlled server, with the URL path containing exfiltrated mailbox data (e.g., MFA codes, email content) encoded as underscore-delimited segments. The Bing service performs an SSRF, fetching the image from the attacker's server and thereby delivering the data while bypassing local client-side security controls like CSP.
Detects a high volume of file uploads (greater than 50) to OneDrive or SharePoint by a single user within a 5-minute window, potentially indicating bulk exfiltration of data.
This rule detects a multi-stage process indicative of Server-Side Request Forgery (SSRF) leveraging Bing's Search-by-Image service. Stage 1 captures browsers submitting arbitrary URLs (via the imgurl= parameter) to Bing. Stage 2 detects subsequent inbound requests to an external, attacker-controlled server originating from Bing's infrastructure, suggesting that Bing performed an unauthorized fetch of a resource and delivered it to the attacker, potentially exfiltrating sensitive data.
Detects the SearchLeak (CVE-2026-42824) attack chain targeting M365 Copilot. The rule monitors for a three-stage sequence within 1 minute: (1) A user accessing a crafted Enterprise Search URL with an injected prompt in the query string; (2) Evidence of bulk data access (MailItemsAccessed or FileAccessed, 5+ events); and (3) An outbound HTTP request to a Bing image search endpoint containing exfiltrated data encoded within a long (>500 chars) 'imgurl' parameter, indicating a potential SSRF/CSP bypass exfiltration path.
This rule detects high-volume data exfiltration attempts over common HTTPS ports (443 or 8443). It identifies network connections where more than 1MB of data is sent in a single connection, then aggregates these connections over one-hour intervals per device and remote IP. Finally, it flags any device that has sent a total of 50MB or more within that hour to a specific remote IP, indicating potential data exfiltration to a command and control server.
This rule detects when a single process account initiates a high volume (10 or more) of file move operations to folders associated with cloud storage services (e.g., 'cloud', 'dropbox', 'drive') within a one-hour window. This behavior could indicate data exfiltration or staging for exfiltration.
This rule detects processes making three or more successful outbound network connections within an hour to known code or text sharing sites like Pastebin, GitHub, or Gist. This activity can be indicative of data exfiltration, command and control (C2) communication, or staging of malicious code.
This rule detects suspicious file export activity by monitoring for the creation of files with names containing keywords like 'export', 'dump', or 'extract'. It triggers an alert if five or more such files are created by the same account within a one-hour window, indicating potential data exfiltration or staging.
Detects when a single user account creates 5 or more files within an hour that contain keywords like 'confidential', 'secret', or 'restricted' in their filenames. This behavior could indicate an attempt to stage sensitive data for exfiltration or unauthorized access to sensitive information.
This rule identifies accounts that create or modify 10 or more files, each larger than 200MB, within a one-hour period. This behavior can be indicative of data exfiltration, staging of large files, or other suspicious bulk file operations.
Page 46 of 124