Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
Detects anomalous bulk GET requests directed at Cisco SD-WAN (vManage) REST API endpoints, specifically targeting topology information, device lists, and configuration templates. This pattern of activity is indicative of reconnaissance or exfiltration attempts against the SD-WAN fabric management interface.
Detects outbound FTP STOR (Store) commands directed to external networks. This indicates that a host inside the local network is attempting to upload data to an external server. The rule uses a threshold to filter out isolated commands, triggering when 3 or more STOR commands are detected within 120 seconds, which is characteristic of data exfiltration or staging behavior.
This rule detects DNS queries containing an exceptionally long subdomain label (50 or more characters). Such patterns are often indicative of DNS tunneling techniques where data is encoded within the subdomain portion of a DNS query to bypass network security controls or establish command-and-control channels.
This rule detects a sequence of behaviors indicative of credential theft followed by data staging and exfiltration. It identifies processes accessing sensitive browser credentials or KeePass database files, followed by the creation of a ZIP archive within user profile directories, and concludes with an outbound HTTPS connection to a non-trusted, non-Microsoft external destination by the same process.
This rule detects unauthorized modifications to Firefox registry keys related to the 'SmartWindow' AI feature, specifically identifying instances where the feature is silently enabled without user consent or where the SmartWindow endpoint and API key configurations are redirected to non-standard, potentially malicious URLs. It also monitors for Firefox process executions involving SmartWindow-related arguments, which may indicate exploitation of this browser-based feature.
Detects anomalous network activity originating from 'NearShareReceive.exe' (Windows Near Share) to public IP addresses on non-standard ports, potentially indicating unauthorized use of the Near Share feature for data staging or exfiltration.
Identifies PowerShell execution using 'Invoke-RestMethod' or 'Invoke-WebRequest' to perform HTTP POST operations containing 'multipart/form-data'. This pattern is frequently used to exfiltrate staged data or archives from a compromised host to an external web server.
This rule detects suspicious network connections originating from internal IP addresses to common service ports (DNS, SMB, RDP, WinRM) on remote, non-internal IP addresses. It flags instances where a single process on a device makes 10 or more such connections within an hour, which could indicate reconnaissance, lateral movement, or data exfiltration attempts.
This rule detects devices making a high volume of successful network connections to GitHub's API endpoints (api.github.com or api.releases). A count of 5 or more successful connections within an hour from a single device is considered suspicious and could indicate data exfiltration, automated tooling, or unusual development activity.
This rule detects successful network connections to known paste sites like Pastebin or Gist. Adversaries often use these services to host malicious code, exfiltrate data, or for command and control (C2) communications. Monitoring such connections can help identify potential data exfiltration attempts or the download of malicious content.
Detects repeated 'git clone' or 'git fetch' commands executed on a system within a short timeframe. This activity could indicate an adversary attempting to exfiltrate data from a code repository or staging environment, or rapidly pull down multiple repositories.
This rule identifies when a single account creates three or more files containing 'backup', 'export', or 'dump' in their filenames within a one-hour period. This activity could be indicative of data staging for exfiltration or an attempt to back up sensitive information prior to a malicious action.
Detects when a single account initiates a high volume of Office file (Word, Excel, PowerPoint) copy or move operations within a one-hour window. This could indicate data exfiltration or staging activities.
Detects cloud disk snapshot creation potentially for data exfiltration
Detects high-volume, rapid outbound network requests from Opera or Opera GX browser processes, characteristic of CSS attribute-selector trigram enumeration used in XS-Leak attacks to exfiltrate sensitive information from loaded web pages.
Detects network activity associated with the EKZ Stealer malware, specifically an HTTP POST request used to exfiltrate base64-encoded credentials to a known malicious destination at 83.138.53.110/service/save.php.
This rule detects network connections to known IP addresses associated with FortiBleed activity, categorizing them by their suspected role (e.g., C2, pentest lab, credential validation, sniffer node). It monitors both successful connections and connection attempts.
This rule detects activities associated with the NotDoor malware used by APT28 for email-based exfiltration. It specifically monitors for the creation of staging files in temporary directories, the use of Outlook.exe to establish external SMTP connections on common mail ports, and the transmission of emails to known adversary-controlled addresses.
Detects suspicious OpenProcess calls initiated by common user applications (explorer.exe, winword.exe, outlook.exe) targeting svchost.exe, followed by an outbound network connection from the target svchost.exe to the file sharing service filen.io within a 30-minute window. This behavior is indicative of process injection used to facilitate network communication or data exfiltration under the guise of a system process.
Detects malicious activities associated with Akira ransomware affiliates, including Active Directory enumeration using AdFind, data staging via WinRAR, and exfiltration attempts utilizing tools like WinSCP, rclone, or MEGAcmd. The rule also monitors for the presence of campaign-specific malware binaries.
This rule detects network connections or process command lines referencing 'easyupload.io' and 'limewire.com', as well as searches for 'eayupload'. These indicators are often associated with unauthorized file transfers or potentially malicious activity involving known file sharing platforms.
Page 51 of 124