Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
Detects a non-Discord process preparing multipart attachment data from a local path for upload through a messaging API. This behavior is indicative of malware like EchoCreep exfiltrating data via messaging platforms.
Searches for outbound GET requests containing specific parameter structures used to label harvested metadata sources, indicative of data exfiltration via the Stitch-SDK.
Detects curl commands transmitting harvested GitHub tokens (ghp_ prefix) in the request body, representing the final exfiltration stage of gh-token-monitor.
Detects rclone remote configuration or config file creation when the binary is running from a portable user writable location, such as Downloads, Temp, AppData, Desktop, /tmp/, or /var/tmp/. This activity can indicate an attempt to exfiltrate data to cloud storage services.
Identifies network traffic to the attacker logging server endpoint ey.php initiated by the wrapper ._cache_GAME1.exe, which is associated with malicious Steam wallpapers.
This rule detects the execution of JavaScript files named 'bw_setup.js' or 'execution.js' using the 'bun' runtime, immediately followed by an outbound network connection to the command and control (C2) domain 't.m-kosche.com'. The detection logic correlates process execution events with network connection events within a 10-minute window, indicating potential malicious activity associated with supply chain attacks.
Detects rclone copy, sync, move, or copyto operations with options commonly used for unattended bulk transfer, indicating potential data exfiltration to cloud storage.
Detects exfiltration of sensitive data pushed to GitHub repositories
Detects bulk export of CRM customer data for collection and theft
Detects bulk download of AWS S3 objects indicating cloud data theft
Identifies Storm-1175 utilizing the rclone utility (often renamed) with MEGA or Mega-CMD configurations to exfiltrate vast data troves before encryption.
Detects a persistent process creating similarly sized outbound transfers at regular intervals after staging local results, indicative of the Kazuar malware's exfiltration behavior. The rule identifies processes with significant outbound network traffic (bytes > 10000), aggregates this traffic over 15-minute intervals, and then looks for processes that exhibit consistent outbound activity with intervals between 10 and 20 minutes (600 to 1200 seconds).
Detects PHP or web server processes launching tools commonly used to download or upload files. This activity can indicate a web shell or other compromise where an attacker is attempting to transfer files to or from the compromised server. Investigate the transferred destination, remote endpoint, and whether the activity occurred during an approved deployment.
This rule detects potential ransomware activity by identifying a combination of three distinct behaviors occurring on a single endpoint within a short window: high-volume file modifications (indicative of file encryption), deletion of system recovery resources (e.g., volume shadow copies, backup catalogs), and high-frequency network activity (indicative of data exfiltration). The rule uses cross-event correlation to reduce false positives by requiring all three signals to be present.
Detects references to 'evisa_cookies.txt' in process command lines, which is indicative of data exfiltration related to the Omani eVisa portal, as observed in specific threat actor activities.
Detects one-way C2 communication via data drops to cloud storage services
Detects curl.exe exfiltrating screenshots to .onion domains via proxy.
Detects the hollowed MsBuild.exe making POST requests to data-harvesting endpoints.
Detects the creation of temporary files containing harvested tokens in the /tmp/ directory. This activity is indicative of a script using these files as a staging ground before network exfiltration. The rule specifically looks for file creation events in '/tmp/' where the filename contains 'tokens' and the initiating process is a common shell or text processing utility.
Detects PowerShell compressing stolen data prior to POST exfiltration. This rule specifically looks for the execution of 'powershell.exe' or 'pwsh.exe' with command-line arguments that include 'Compress-Archive', 'Invoke-WebRequest', and '-Method POST'. This combination indicates an attempt to compress data and then exfiltrate it via an HTTP POST request.
This rule detects the creation of a new GitHub repository from a compromised endpoint, specifically looking for indicators of stolen credential exfiltration. The rule identifies GitHub application events where a repository is created and the raw event data contains keywords associated with credential dumping or specific campaign names like "Miasma" or "Spreading Blight". Automated exfiltration to GitHub is often fast and difficult to remediate, making prompt detection crucial. If triggered, it's recommended to revoke tokens used to create the repository and investigate the endpoint for compromise.
Page 71 of 124