Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,119
15,639
12,589
8,399
6,227
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
Detects instances where a process not associated with standard SSH operations (e.g., ssh, scp, git) accesses SSH private key files, followed by an outbound network connection to a non-private IP address within a 5-minute window. This behavior is indicative of credential theft and subsequent exfiltration of sensitive SSH keys, often associated with infostealer malware.
Detects outbound HTTP POST requests to file.io originating from a Go-based HTTP client, consistent with the GopherWhisper APT C2 or exfiltration activity.
Detects outbound HTTP POST requests containing keywords indicative of credential and data theft associated with VBV Stealer malware, specifically looking for fields related to passwords, cookies, or wallets in the request body.
Detects outbound HTTP POST requests to file.io originating from a Go-based HTTP client, consistent with the GopherWhisper APT C2 or exfiltration activity.
Detects outbound HTTP POST requests containing keywords indicative of credential and data theft associated with VBV Stealer malware, specifically looking for fields related to passwords, cookies, or wallets in the request body.
Correlates the execution of known data exfiltration utilities (rclone, mega-cmd, filezilla) passing configuration files or remote cloud repository targets dynamically.
Identifies AstarionRAT establishing HTTP POST connections to transmit the compressed archive containing the stolen browser and keylogger data. This rule correlates network HTTP POST requests with the creation of zip files by the same process, indicating potential data exfiltration.
This rule correlates rapid file modifications (potential encryption or mass deletion) with the execution of commands known to inhibit system recovery (e.g., deleting shadow copies or modifying boot recovery settings) and significant outbound network data transfers from the same host. This pattern is characteristic of ransomware deployment.
Detects outbound network connections to major Large Language Model (LLM) API endpoints (OpenAI, Google, Anthropic) initiated by processes not explicitly identified as standard web browsers or command-line utilities. This pattern may indicate automated data exfiltration ('prompt stealing' or unauthorized access to corporate data) using custom or malicious tools executing from suspicious directories like temp, appdata, or public folders.
Detects network connections initiated by Windows Nearby Sharing processes (quick_share.exe, nearby_sharing.exe, or NearbyShare.exe) to non-standard ports, potentially indicating unauthorized file transfers or exfiltration over unusual network channels.
This rule detects the creation of a '_vault.zip' archive, which is characteristic of the VVS Stealer malware, followed by network activity to Discord from the same process within a 15-minute window. VVS Stealer uses these archives to store stolen browser data (passwords, cookies, history, autofill) before exfiltrating it, often via Discord webhooks.
Detects outbound web traffic directed towards common password management services (e.g., 1Password, LastPass, Bitwarden) originating from user agents associated with AI and LLM tools (e.g., OpenAI, Claude, Copilot). This combination of destinations and user agents is highly anomalous and may indicate potential credential exfiltration or interaction with automated agents acting on behalf of a user to access sensitive vault data.
Detects the use of curl.exe to upload files to the temp.sh service while simultaneously passing the resulting temp.sh URL within the User-Agent string to a C2 server. This specific exfiltration and beaconing TTP was observed in the Notepad++ supply chain attack.
This rule detects potential bulk data exfiltration by monitoring for outbound HTTP POST requests to non-standard ports where the Content-Length header indicates a transfer of over 10 megabytes. This behavior can be indicative of an attacker exfiltrating large amounts of sensitive data from the network to an external server.
Detects outbound HTTP POST requests where the Content-Length is at least 10MB and the Content-Type header indicates the transfer of archived data (zip or x-tar). This pattern is often associated with the staging and exfiltration of compressed sensitive data from an internal host to an external network destination.
This rule monitors for HTTP POST requests to external networks containing 'gtag=' in the URI, which is a known technique used by the TrickBot malware to exfiltrate its group identifier during C2 communication.
Detects outbound HTTP POST requests where the Content-Length header indicates a transfer size exceeding 10MB to external (non-HOME_NET) addresses. This pattern is indicative of potential data exfiltration via HTTP.
Detects large HTTP POST requests (over 5MB) directed at external hosts that utilize multipart or chunked encoding, which are commonly used to obfuscate or stream large volumes of data during an exfiltration event.
Detects DNS query traffic where the subdomain label length exceeds 50 characters and contains patterns consistent with Base64 or Hexadecimal encoding. This behavior is indicative of potential data exfiltration or command-and-control communication performed over the DNS protocol by tunneling data within query labels.
This rule detects potential bulk data exfiltration by monitoring for outbound HTTP POST requests to non-standard ports where the Content-Length header indicates a transfer of over 10 megabytes. This behavior can be indicative of an attacker exfiltrating large amounts of sensitive data from the network to an external server.
Detects outbound FTP STOR (Store) commands directed to external networks. This indicates that a host inside the local network is attempting to upload data to an external server. The rule uses a threshold to filter out isolated commands, triggering when 3 or more STOR commands are detected within 120 seconds, which is characteristic of data exfiltration or staging behavior.
Page 65 of 124