Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
This rule detects outbound network connections from a device to a specific remote IP address (62.102.148.212) on a set of suspicious ports (37393, 45839, 38471, 12345, 4444, 5555). This pattern is indicative of potential command and control (C2) communication or data exfiltration to a known malicious endpoint.
Detects the use of rclone, MEGAcmd, or common command-line tools like curl/wget to transfer data to known cloud storage endpoints (mega.nz, gofile.io, anonfiles, pixeldrain) when initiated from non-standard system paths (i.e., not 'C:\Program Files'). This rule aims to identify data exfiltration activities, particularly those associated with the Qilin threat actor's double extortion tactics.
This rule detects outbound network connections from devices to a specific remote IP address (62.102.148.212) on a set of suspicious remote ports (37393, 45839, 38471, 12345, 4444, 5555). This pattern is indicative of potential command and control (C2) communication or data exfiltration to a known malicious endpoint.
This rule monitors network, proxy, and DNS traffic for connections to the domain 'perplexity-ai.online'. It identifies potentially suspicious activity by aggregating requests and distinguishing between general outbound traffic and traffic to specific endpoints, such as search queries that may indicate data exfiltration or reconnaissance.
Detects anomalous network activity originating from Firefox (firefox.exe). The rule flags connections to port 8765 (associated with specific browser-based exfiltration PoCs) and any outbound connection on non-standard ports (excluding common browser ports: 80, 443, 8080, 8443, 8888, 53) directed to public IP addresses.
Detects outbound network traffic associated with Djinn Stealer malware beaconing to a hardcoded C2 IP address (96.126.130.126) on port 58942. The detection specifically monitors for HTTP POST requests containing the malicious User-Agent 'telemetry-client/1.0' and 'application/octet-stream' content-type, which are characteristic of this stealer's exfiltration activity.
Detects behavior indicative of the InvisibleFerret information stealer, specifically focusing on Python execution spawned by development tools (VS Code/Node.js), unauthorized access to browser-based credential stores or local crypto wallets, and suspicious outbound network activity originating from Python processes spawned by development/automation tools.
Detects the execution of known cloud storage synchronization and transfer tools (rclone, MEGA) often used by adversaries to exfiltrate data from an endpoint to unauthorized cloud storage providers. The rule specifically flags these tools when they are not running from their standard installation directories or are not digitally signed by verified publishers.
Detects the execution of pg_dump or pg_restore initiated by Splunk processes with unexpected remote hosts or custom directories. This behavior is indicative of CVE-2026-20253 exploitation, where an unauthenticated attacker can abuse the PostgreSQL Sidecar Service to achieve remote code execution.
Detects outbound email from an organizational mailbox to a common consumer email provider with multiple or large attachments. This could indicate data exfiltration or unauthorized transfer of sensitive information.
Targets mailbox export naming and immediate use of cloud transfer tools such as rclone, WinSCP, Dropbox, or OneDrive. The UDM rule retains principal and target context for correlation.
Detects network connections using the GRE (Generic Routing Encapsulation) protocol destined for non-internal (outside of RFC 1918) IP addresses. GRE is frequently used for tunneling traffic and, when used to communicate with external hosts, may indicate unauthorized tunneling or data exfiltration.
This rule detects the exfiltration of sensitive developer tokens (specifically .npmrc or .pypirc files) to public paste sites like Pastebin or GitHub Gists. It correlates network events where a process attempts to connect to these sites with file access events on the specified token files by the same process.
Detects browser connections to the Bing Search by Image endpoint, which can be exploited as a Server-Side Request Forgery (SSRF) proxy to bypass Content Security Policies (CSP) and exfiltrate data, as seen in the SearchLeak attack. The rule specifically looks for connections to 'bing.com/images/searchbyimage' that also include the 'imgurl=' or 'imgurl%3d' parameter, indicating an attempt to use the server-side fetch functionality.
Correlates the completion of the OpenClaw theft routine with a network connection to Discord Webhooks to notify the threat actor. Specifically, it looks for network connections to discord.com/api/webhooks initiated by 'python.exe'.
Correlates the dropping of an rclone.conf file with the immediate execution of the Rclone utility, indicating potential data exfiltration activity.
This rule detects suspicious activity involving interaction with the 'perplexity-ai.online' domain and the creation of specific browser extension files, which may indicate browser-based data exfiltration or credential theft. The rule correlates file creation events, DNS queries, and network connections, assigning a higher risk score when multiple indicators are present, particularly when evidence suggests exfiltration of keystroke or search data via web requests.
Detects network connections to the typosquatted domain 'perplexity-ai.online', associated with a malicious browser extension used for data exfiltration. Additionally, it detects the creation or modification of 'background.js' files within common web browser extension directories, which is a common persistence mechanism for malicious extensions.
Detects artifacts and behaviors associated with a malicious Chromium extension identified as 'Search for perplexity ai' (extension ID: flkebkiofojicogddingbdmcmkpbplcd). The rule monitors for unauthorized extension installation, registry modifications to the browser's default search provider settings pointing to a suspicious domain (perplexity-ai.online), and outbound browser network traffic or DNS queries directed toward the same domain for potential data exfiltration.
Detects outbound network traffic from common web browsers (Chrome, Edge, Brave, etc.) to the typosquatted domain 'perplexity-ai.online'. This rule identifies behavior associated with a malicious browser extension ('Search for perplexity ai') that exfiltrates keystrokes and search queries captured via the browser's Omnibox functionality to an attacker-controlled server.
This rule detects potential command and control (C2) activity associated with a known npm RAT, identified by network connections to specific C2 infrastructure (95.216.92.207:8080) or DNS resolution of 'nvidiadriver.net'. The rule specifically flags these events when performed by common execution tools like 'python.exe' or 'chost.exe', or when the process image is running from a temporary directory, which is a common persistence or execution indicator for malware.
Page 67 of 124