Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,119
15,639
12,589
8,399
6,227
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
Detects FTP protocol traffic (on port 21) initiated by a process named 'squid.exe' or containing 'squid' in its filename. This rule is designed to identify potential exploitation attempts related to the Squidbleed vulnerability, where a compromised Squid proxy might be used for unauthorized FTP communications.
Detects the execution of known cloud storage synchronization and transfer tools (rclone, MEGA) often used by adversaries to exfiltrate data from an endpoint to unauthorized cloud storage providers. The rule specifically flags these tools when they are not running from their standard installation directories or are not digitally signed by verified publishers.
Detects a single host making Zulip REST API POST requests to multiple distinct topics, specifically looking for patterns associated with system profiling and command/tasking as observed in ZiChatBot. The rule identifies activity where a source IP uses the Zulip API to send messages to at least two different topics, with the raw request content indicating either 'channel/stream' and 'topic/subject' or keywords like 'system info', 'shellcode', 'task', or 'command'.
Detects anomalous process execution patterns where a database process (postgres or postmaster) or a common system utility (nc, python, bash) is observed initiating unauthorized network connections to a known external C2 IP or accessing sensitive cryptographic files (e.g., server.key). This behavior is indicative of potential post-exploitation activity, specifically the exfiltration of credentials or sensitive data via database-level command execution (sys_eval) or direct file manipulation.
Detects the use of PowerShell to archive files (using Compress-Archive) followed by an HTTP network connection to a suspicious external IP address (91.196.32.232) within a short time window. This sequence is often indicative of data staging followed by exfiltration.
Detects evidence of potential data exfiltration activities including the execution of known exfiltration scripts, the use of netcat for unauthorized data transfer to a specific C2 IP, and the presence or access of BloodHound dump files. The rule also monitors for network communication with a known command and control IP address.
Detects a sequence of events where a Google Cloud Storage bucket is deleted by a user, followed by the creation or modification of a Pub/Sub subscription referencing a Cloud Storage destination. This pattern is indicative of 'Universal Bucket Hijacking', where an attacker attempts to hijack a data stream by recreating a deleted bucket or reconfiguring a service to redirect traffic to an attacker-controlled destination.
Detects Python scripts or processes accessing common browser credential and cookie storage files (such as Login Data, key4.db, or cookies.sqlite) and subsequently making outbound network connections, indicating potential theft and exfiltration of browser data.
This rule identifies suspicious outbound network traffic potentially related to data exfiltration or command-and-control (C2) communication. It monitors for connections to the Telegram Bot API utilizing 'sendMessage' methods, often used by malware for exfiltrating credentials or sensitive data, as well as connections to known 'Bluekit' PhaaS (Phishing-as-a-Service) operator domains.
Detects potential malicious browser extension activity by correlating internal browser process network connections to suspicious infrastructure (e.g., adblock-for-youtube.com) with subsequent network traffic from the same process PID to third-party domains within 60 seconds of visiting sensitive high-value websites (e.g., login portals, banking). The rule also alerts on any direct network connection to identified malicious exfiltration infrastructure.
Detects a potential logging sink hijack in Google Cloud Platform (GCP) by identifying the deletion of a logging sink's destination bucket followed by the creation of a new bucket with the same name in a different project. This technique could allow an attacker to redirect logs to an attacker-controlled bucket, impairing defenses and potentially exfiltrating sensitive log data.
This rule detects programmatic file downloads from SharePoint and OneDrive using various automation tools and SDKs, rather than typical browser access. It specifically looks for `FileDownloaded`, `FileSyncDownloadedFull`, `FileAccessed`, or `FilePreviewed` operations within SharePoint or OneDrive audit logs where the user agent string indicates the use of PowerShell, PnP, Microsoft Graph SDK, Python, Node.js, or common command-line tools like curl or wget. This behavior can be indicative of data exfiltration.
Detects usage of curl to upload files to known file sharing domains, which may indicate data exfiltration.
Detects high-volume SQL UPDATE operations indicating data manipulation attack
Detects network connections attempting to exfiltrate data via Discord webhooks. This rule specifically looks for POST requests to the Discord API webhook endpoint.
Detects DNS resolution to attacker-controlled AWS S3 buckets masquerading as Outlook/OneDrive service pages used by UNC6692 for phishing delivery, SNOWBELT C2, and credential exfiltration. The rule specifically looks for DNS queries to S3 domains with patterns indicative of spoofed Outlook/OneDrive service pages or specific known malicious S3 bucket names.
Detects outbound network communication from node.exe to the domain 'stitch-production.org'. This domain is associated with the 'Miasma' (also known as Mini Shai-Hulud) campaign, which uses malicious npm packages with post-install scripts to steal developer credentials, including Git, Docker, SSH, and cloud service configuration files.
This rule detects the execution of common scripting interpreters (PowerShell, WScript, CScript) that include command-line arguments referencing major cloud storage providers and file-hosting services. This behavior is frequently associated with data exfiltration or the staging of malicious payloads using legitimate web services.
Detects network communication patterns indicative of RedLine Stealer activity by looking for specific keywords in the RemoteUrl field during inbound or outbound connections.
Detects network connections from suspicious or unexpected processes to common public webhook and automation services, which may indicate data exfiltration or automated C2 communication.
Detects the execution of a local, polymorphic HTML file that contains AI-obfuscated JavaScript, followed by an HTTP POST request to an external server within a 5-minute window, indicating potential credential exfiltration.
Page 63 of 124