Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,124
15,647
12,595
8,404
6,230
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
Credential and browser data stealer distributed via OXLOADER campaigns
Credential and browser data stealer distributed via OXLOADER campaigns
Detects DNS resolutions for major AI/LLM provider domains (e.g., OpenAI, Anthropic, Google AI) originating from processes that are not common, known browsers or development tools. This behavior is indicative of potentially malicious applications or malware using AI APIs for automated tasks, such as content exfiltration or sophisticated C2 communication.
This rule detects the use of Rclone for cloud file synchronization or configuration file creation on endpoints that have shown recent activity related to QEMU virtualization. The detection correlates process execution or file creation events involving Rclone with prior QEMU execution within a 24-hour window, which may indicate an adversary using virtualization to stage or exfiltrate data.
Identifies the execution of wget.exe or curl.exe with command-line flags indicative of file uploads (specifically archives like zip, rar, or 7z), which may be used by adversaries to exfiltrate staged data to remote infrastructure.
Detects the execution of QEMU hypervisor binaries (qemu-system-x86_64, qemu.exe, etc.) when initiated from non-standard parent processes or from non-standard directories, or when associated with disk image files. This behavior may indicate the unauthorized deployment of virtualization software to facilitate lateral movement, data exfiltration, or environment evasion.
Detects activity associated with the unauthorized copying of sensitive system files (e.g., NTDS.dit, SAM, SYSTEM) using Volume Shadow Copy, or the use of Rclone for potential data exfiltration via SFTP, copy, or sync operations.
This rule detects potential data staging and exfiltration behavior characterized by large volumes of outbound network data combined with high frequency file write operations across multiple file types. It monitors Sysmon Event IDs 3 (Network connection) and 11 (FileCreate) to identify indicators often associated with pre-encryption staging by ransomware or data theft campaigns.
This rule detects potential data staging and exfiltration behavior characterized by large volumes of outbound network data combined with high frequency file write operations across multiple file types. It monitors Sysmon Event IDs 3 (Network connection) and 11 (FileCreate) to identify indicators often associated with pre-encryption staging by ransomware or data theft campaigns.
This rule detects potential large-scale exfiltration or staging of sensitive documents to common cloud storage locations (Dropbox, Google Drive, OneDrive) or removable media. The rule specifically triggers when a high count (more than 20) of files labeled as sensitive are accessed or transferred by a single user within a session, specifically outside of standard business hours (before 7 AM or after 8 PM).
Detects BQTLock ransomware (BQT.exe) identifying and exfiltrating captured desktop screenshots via the Telegram Bot API 'sendPhoto' endpoint. The rule monitors network connections initiated by the identified malware process to api.telegram.org.
Detects network connections to the Telegram API (api.telegram.org) from processes identified as LOLBins or residing in suspicious, potentially writable locations such as Temp, AppData, or user-defined directories. This activity is often indicative of C2 communication or data exfiltration by malware bypassing standard messaging client restrictions.
Detects instances where a non-standard browser process accesses sensitive browser credential files (e.g., Login Data, Cookies, key4.db) and simultaneously establishes a network connection to Discord or transmits data to a Discord webhook. This pattern is consistent with infostealer malware attempting to exfiltrate cached credentials via external services.
Detects suspicious activity within GitHub Actions, identifying potential exfiltration or malicious automation by correlating signals such as masquerading actors (e.g., bots like dependabot), specific IronWorm-associated commit message patterns, usage of secrets-related JSON expressions in logs, and the use of innocuous file names for artifact uploads.
This rule detects outbound network connections to common webhook and temporary storage services (e.g., discord.com webhooks, webhook.site, pipedream.net) initiated by processes other than standard web browsers. Such behavior is often indicative of automated data exfiltration, command-and-control (C2) communication, or malicious script activity using these services to bypass traditional network defenses.
Detects the unauthorized exfiltration of SSL private key files using Netcat to a known malicious C2 IP address (62.171.185.97). The rule monitors process execution commands that include specific file names associated with certificate harvesting or extraction tools being piped or transmitted over the network.
This rule detects suspicious activity on Oracle database hosts, including the spawning of unexpected child processes from Oracle service binaries (such as cmd.exe or shells), the creation or access of known exploit-related script filenames, and the use of UTL_FILE to write files with suspicious extensions to temporary directories, which are patterns indicative of exploitation attempts like DBMS_SCHEDULER remote code execution or data exfiltration.
Detects HTTP PUT requests directed at Wasabi Cloud Storage domains that originate from an Rclone user agent. This pattern is commonly indicative of data exfiltration activities where an attacker uses the Rclone utility to synchronize or upload sensitive data to unauthorized cloud storage.
This rule detects potentially malicious HTTP POST requests directed at a specific URI path ('/V1/Update/GetUpdate') associated with software update functionality. It identifies suspicious traffic by analyzing parameters in the request body (such as Id, Hostname, Mac, Version, Arch) and potential process names (e.g., setup.exe, IntelAudioService.exe). High-risk scores are assigned based on the destination IP and the presence of these specific identifying parameters, which may indicate command-and-control (C2) beaconing or data exfiltration masquerading as legitimate update check traffic.
This rule detects the execution of the NUKESPED backdoor component 'zlrenu8.exe' and its subsequent outbound HTTP/HTTPS network connections to specific IP addresses associated with Fastly CDN. This behavior is highly characteristic of sensitive data exfiltration activities performed by the Kimsuky threat group.
This rule detects processes frequently creating image files (bmp, png, jpg, jpeg) in temporary directories and subsequently initiating external network connections. The logic identifies suspicious patterns where a non-whitelisted process generates files at consistent, short intervals and performs network activity, which is a common indicator of automated screen capture and exfiltration.
Page 58 of 124