Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,119
15,639
12,589
8,399
6,227
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
Analyzes HTTP network events to detect the Komari agent executing HTTP POST requests with large data payloads, indicating data exfiltration. This rule specifically looks for HTTP POST requests combined with recent file access events for common archive file types (zip, rar, 7z, db) on the same device and by the same initiating process.
Detects network communication patterns indicative of RedLine Stealer activity by looking for specific keywords in the RemoteUrl field during inbound or outbound connections.
This rule detects HTTP PUT requests with specific URL parameters ('buildtxd=', 'upload_id=', 'chunk_index=', 'total_chunks=') and a 'Mozilla/5.0' user agent, directed towards known malicious domains ('bestbuydomain.com', 'premierrentalpurchase.com'). This pattern is indicative of data exfiltration, potentially by malware uploading stolen data in chunks.
Detects anomalous svchost.exe behavior involving the use of libjpeg-turbo compression function symbols in the command line, alongside potential C2 communication with a known suspicious domain (kkxqbh.top) or connection over non-standard ports, which may indicate malicious exfiltration or data staging.
Detects anomalous network activity originating from 'NearShareReceive.exe' (Windows Near Share) to public IP addresses on non-standard ports, potentially indicating unauthorized use of the Near Share feature for data staging or exfiltration.
Detects outbound network connections initiated by common CLI tools (curl, wget, python, node) when spawned as child processes of an IDE or extension host (e.g., VS Code). This pattern is indicative of potential AWS credential exfiltration where an adversary manipulates IDE configurations (like .amazonq/mcp.json) to execute unauthorized network requests containing AWS secrets.
Detects DNS queries for domains associated with the Tykit phishing kit infrastructure. These domains are used for hosting phishing pages and for C2 exfiltration.
Detects DNS queries for domains associated with the Tykit phishing kit infrastructure. These domains are used for hosting phishing pages and for C2 exfiltration.
Detects a sequence of activity where WinRAR is used to archive data, followed by the use of WinSCP to potentially exfiltrate that data, occurring on the same host within a 24-hour window.
Detects WinRAR executing with archiving flags (create, add, move) on sensitive paths, followed by an outbound network connection to a non-private IP address within a 10-minute window, which is characteristic of data staging and exfiltration.
This rule detects the staging of data using WinRAR, followed by potential exfiltration to known public file-sharing services (easyupload.io, anonfiles.com, gofile.io, transfer.sh) within a 2-hour window. It monitors for either DNS requests to these domains or the execution of web browsers or common command-line tools (curl, wget, PowerShell) with these domains in the command line arguments following WinRAR usage.
Detects network connections to known ShinyHunters infrastructure, identified by specific IP addresses and DNS queries for 'azurenetfiles.net'. This activity is associated with the exploitation of Oracle PeopleSoft servers via gadget chain exploitation.
Detects a non-cloud client process issuing API-style requests associated with object listing, content upload, or content download to a cloud storage service. The rule specifically targets processes with names matching patterns like 'bird', 'rok', 'game', or 'update' followed by '.exe', and command lines containing API-related keywords ('files/list', 'files/upload', 'files/download', 'oauth', 'bearer', 'api') in conjunction with cloud storage service names ('dropbox', 'pcloud', 'cloud'). This behavior is indicative of malware using legitimate cloud services for command and control or data exfiltration.
Detects the presence or installation of known malicious Adblock for YouTube browser extensions. These extensions are flagged for utilizing overly broad host permissions (e.g., <all_urls>) in conjunction with webRequest and scripting capabilities, which facilitates cross-site data collection, potential session hijacking, and the injection of malicious remote scripts.
Detects FTP data connections initiated by 'squid.exe' on high port ranges (1024-65535). This could indicate an attempt to exfiltrate data using an alternative protocol, potentially related to the 'Squidbleed' vulnerability or other malicious activity.
Detects unusually large FTP responses containing 'LIST' or 'NLST' commands, potentially indicating an attempt to exploit the Squidbleed vulnerability or similar data exfiltration over FTP. The rule specifically looks for network events on port 21 (FTP) where the action type is 'NetworkSignatureInspected' and the RemoteUrl contains either 'LIST' or 'NLST' with a string length greater than 4000 characters.
A master aggregation capturing processes generating connections to multiple known malicious ports tied to specific campaigns, indicating potential C2 beaconing activity.
Hunts for the stealer exfiltrating compressed host profiling information (sw_vers, system_profiler) via HTTP POST using curl.
This rule detects HTTP POST connections initiated by 'AutoIt3.exe' which is indicative of Vidar Stealer attempting to exfiltrate data to its C2 server. The rule specifically looks for network events where the HTTP method is POST and joins them with process events where the initiating process is 'AutoIt3.exe'.
Detects a rapid burst of file upload activity to cloud storage applications from a single account, including unusual proxy or device context. This rule identifies scenarios where an account performs 20 or more upload events or uploads 20 or more distinct objects within a 15-minute time window to common cloud storage services like Google Drive, Dropbox, Box, MEGA, OneDrive, or ShareFile. It also highlights if any of these uploads originate from an anonymous proxy.
Detects the HTTPS POST exfiltration enforcing the server-side gate using the actor's custom X-Rise-To-The-Trinny: agree header or X-QT-SR: 14 header, associated with TeamPCP supply chain attacks.
Page 66 of 124