Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,124
15,647
12,595
8,404
6,230
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
Detects Python or Node.js processes reading sensitive SSH private key files (id_rsa, id_ed25519) followed by an outbound network connection within a one-minute window. This behavior is indicative of credential theft and exfiltration, such as that observed in the InvisibleFerret campaign.
Detects Python scripts, launched by code.exe or node.exe (common IDE-related processes), accessing SSH private key files (id_rsa, id_ed25519, id_ecdsa) followed by an outbound network connection within 60 seconds. This behavior is indicative of credential theft and potential exfiltration or lateral movement.
Detects rapid high-volume file and messaging operations across multiple Microsoft 365 services (SharePoint, OneDrive, Teams, Exchange) within a compressed 10-minute window from a single identity and IP address. This behavior can indicate data exfiltration or reconnaissance by an adversary.
Detects data exfiltration using asymmetric encrypted non-C2 protocols
Detects indicators of the Meow RAT malware staging collected data in the /tmp/shub_ directory, compressing it into shub_log.zip using 'ditto', and subsequently exfiltrating it to a hardcoded command and control (C2) domain 'qwqerrqwr2145qw[.]com/gate'. The rule correlates process events, network events, and file events to identify the full attack chain.
Identifies PowerShell using Invoke-RestMethod or Invoke-WebRequest to exfiltrate archives via HTTP POST, specifically looking for multipart/form-data boundaries in the command line.
Detects command-line utilities connecting to notorious cloud storage providers heavily favored by threat actors for data exfiltration.
Detects network connections on port 21 (FTP) where the RemoteUrl contains common FTP data type commands ('TYPE A', 'TYPE I', 'TYPE a', 'TYPE i'). This could indicate active FTP sessions, potentially for data transfer or exfiltration.
Detects the execution of S3 Browser or Office installation executables, followed by network traffic from the same host to known cloud storage or file-sharing sites within a short time window. This behavior aligns with Muddled Libra's method of staging and exfiltrating sensitive data, such as PST files, to adversary-controlled cloud buckets.
Detects rapid high-volume file and messaging operations across multiple Microsoft 365 services (SharePoint, OneDrive, Teams, Exchange) within a compressed 10-minute window. This behavior can indicate data exfiltration or collection by an adversary.
This rule detects the execution of suspicious executables ('servertool.exe', 'encrypt.exe') when their command line arguments contain references to common cloud storage services (OneDrive, SharePoint, GoogleDrive, Dropbox, iCloud). This pattern could indicate an attempt to exfiltrate data to cloud storage or encrypt data for impact, potentially as part of a ransomware attack.
This rule detects network connections to known IP addresses associated with the FortiBleed vulnerability exploitation. These IP addresses have been categorized based on their observed roles in FortiBleed attacks, including aggregator/C2, pentest lab, credential validation, and sniffer nodes. Monitoring these connections can help identify compromised systems or active exploitation attempts related to FortiBleed.
Detects unusually large FTP responses containing 'LIST' or 'NLST' commands, potentially indicating an attempt to exploit the Squidbleed vulnerability or similar data exfiltration over FTP. The rule specifically looks for network events on port 21 (FTP) where the action type is 'NetworkSignatureInspected' and the RemoteUrl contains either 'LIST' or 'NLST' with a string length greater than 4000 characters.
Detects non-browser processes accessing sensitive browser data files (such as Login Data, Cookies, or key stores) followed by network activity to known suspicious, cryptocurrency, or potential malware-hosting domains. This behavior is indicative of credential theft and exfiltration by information-stealing malware.
This rule detects network connections to known IP addresses associated with the FortiBleed vulnerability exploitation. These IP addresses have been categorized based on their observed roles in FortiBleed attacks, including C2, pentest lab, credential validation, and sniffer nodes. Monitoring these connections can help identify compromised systems communicating with FortiBleed infrastructure.
This rule detects outbound network connections from devices to a specific remote IP address (62.102.148.212) on a set of suspicious remote ports (37393, 45839, 38471, 12345, 4444, 5555). This pattern is indicative of potential command and control (C2) communication or data exfiltration to a known malicious infrastructure.
This rule detects network connections to known IP addresses associated with the FortiBleed vulnerability exploitation. These IP addresses have been categorized based on their observed roles in FortiBleed attacks, including C2, pentest lab, credential validation, and sniffer nodes.
Detects successful or failed logon attempts originating from IP addresses identified as associated with botnets, C2 infrastructure, or proxies by threat intelligence feeds. This indicates potential malicious activity or compromised accounts.
Detects outbound network connections to specific cloud storage providers (Wasabi, Tebi, I3Storage) which are commonly leveraged by adversaries for data exfiltration.
Detects the use of weaponized GitHub Actions workflows (e.g., impersonating 'Run Copilot' or 'Dependabot Updates') designed to exfiltrate CI/CD secrets via artifacts, as observed in the Miasma/Mini Shai-Hulud supply chain campaign.
Detects anomalous credential exfiltration attempts by GitHub Actions runners. The rule monitors for runner child processes (printenv, env, set) attempting to access sensitive CI/CD variables, or networking tools (curl, wget) transmitting data to unauthorized external endpoints, consistent with Miasma worm behavior.
Page 61 of 124