Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
Detects the final curl command utilized by AMOS or ClearFake transmitting the archived credentials to the remote C2 via a multipart form-data upload.
Detects network connection activity originating from the Windows Update service process (wusvc.exe) to a known C2 IP address (38.60.253.35) on port 8084. This pattern is indicative of VSHELL RAT communication, potentially using masquerading to hide its network activity.
Detects instances where a process command line includes both 'base64' and '.env', indicating potential encoding of sensitive .env files. Attackers often encode these files before exfiltration to bypass basic Data Loss Prevention (DLP) string matching and obscure the data.
Detects outbound network connections to specific known malicious egress IP addresses associated with Operation Escaneo, utilizing the Wget user agent to request the '/pwned' resource over port 8888, indicative of SOCKS5-tunneled data exfiltration.
Identifies successful device code authentication followed by a high volume of file downloads within a short timeframe, which could indicate data exfiltration after an adversary has gained access through a device code phishing campaign.
Detects potential S3 bucket exfiltration attempts originating from command-line interface (CLI) tools or Node.js applications. The rule specifically looks for network connections to AWS S3 regional endpoints (us-west or us-east) initiated by processes named 'node.exe', 'python.exe', or 'aws.exe'.
Detects a non-browser mailbox collection or archive utility connecting directly to an IP address while RemoteUrl is empty. This behavior is suspicious as legitimate email clients typically use hostnames. The rule filters out common browsers and svchost.exe and looks for keywords in the command line indicative of mailbox or archive activity (e.g., .pst, .ost, Aspose.Email, mailbox, archive). This suggests an attempt to exfiltrate or collect email data, potentially bypassing DNS resolution for C2 or evasion.
Detects HTTP network connections to the specific URI path and parameters used by the OnyxC2 stealer for C2 beaconing and data exfiltration.
Detects HTTPS POST requests to known attacker-controlled infrastructure associated with the BadBlocker campaign (e.g., Unistream SDK, adblock-for-youtube domains). These requests often originate from browser extensions via injected scripts, facilitating the potential exfiltration of sensitive browser session data or credentials.
Detects behavior indicative of the 'Adblock for YouTube' browser extension (or associated malicious variants) fetching rule configuration files from 'api.adblock-for-youtube.com', followed by suspicious outbound network traffic to non-Google/YouTube domains. This pattern suggests the extension is performing unauthorized data exfiltration, such as harvesting session cookies or credentials via injected scripts.
Detects credential and session data exfiltration by browsers communicating with Bluekit PhaaS-associated domains or Telegram API webhooks. The rule filters network traffic originating from common web browsers to known malicious domains associated with Bluekit infrastructure or to the public Telegram API for automated exfiltration.
Detects explorer.exe making DNS requests to Discord or Telegram, which is anomalous and indicates potential process injection for data exfiltration. This behavior is associated with information stealer malware like Phantom Stealer.
Detects processes attempting to exfiltrate data over a Telegram C2 channel by making network connections to api.telegram.org or t.me, excluding legitimate Telegram client binaries and common web browsers. This behavior is characteristic of Vidar Stealer and other Malware-as-a-Service (MaaS) stealers.
This rule detects potential data exfiltration attempts or sensitive information disclosure through Microsoft Copilot Enterprise Search. It specifically looks for 'URLClick' actions from 'Microsoft Copilot Enterprise Search' where the raw event data contains a 'q=' parameter (indicating a query) and also contains keywords like 'extract', 'embed', or 'img'. This combination suggests that a user might be attempting to extract or embed content, potentially sensitive, via a Copilot search query, which could lead to data leakage.
Detects bulk file copies to removable drives for physical data exfiltration
Detects outbound web requests to Bing's 'Search by Image' endpoint where the embedded image URL points to a non-Microsoft domain. This mechanism is used in the SearchLeak attack (CVE-2026-42824) to bypass CSP and exfiltrate data from Microsoft 365 Copilot.
This rule detects network connections from endpoints to a list of known malicious domains. The detection is further refined by looking for specific URL paths such as '/wlc/', '/load/', or 'success/', which are commonly associated with command and control (C2) communication or data exfiltration activities by malware. This indicates potential compromise and active communication with adversary infrastructure.
Detects data exfiltration attempts using curl.exe to the public file transfer service sendit.sh. This rule specifically looks for the execution of 'curl.exe' with 'sendit.sh' in its command line arguments, indicating a potential attempt to upload or transfer data to this service.
This rule detects the explicit use of `curl` or `wget` to exfiltrate data, specifically AWS tokens, to a known Megalodon infrastructure IP address (216.126.225.129). This activity is indicative of the Megalodon CI/CD malware attempting to post extracted data.
Detects network events where a device communicates with the 'urlzzz.php' endpoint, specifically when this communication is correlated with file events involving 'Login Data' or 'Cookies'. This indicates potential exfiltration of browser credentials or session information by the UnregStealer malware.
Detects browser connections to the Bing Search by Image endpoint, which can be exploited as an SSRF proxy to bypass Content Security Policies (CSP) and exfiltrate data, as seen in the SearchLeak attack.
Page 69 of 124