Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
Detects exfiltration of sensitive data pushed to GitHub repositories
Detects large data transfers occurring outside normal business hours
This rule detects an unusual spike in 'Export' or 'Download' operations within Azure Activity logs by a single caller. It triggers when a user performs 5 or more such operations within an hour, which could indicate data exfiltration attempts or suspicious data access patterns.
Udm Mail Raw Ip Https
YARA-L
This rule detects network connections made by processes commonly associated with mail collection, archiving, or data export (e.g., mail, archive, collector, export, rclone, winscp, curl executables). The detection specifically looks for these processes making HTTPS connections where the command line contains keywords related to email data files (.pst, .ost) or email processing (aspose.email, mailbox). The rule aims to identify potential exfiltration or collection of email data over HTTPS.
Detects bulk export of Confluence wiki content
This rule tracks the execution of a file named 'uds.exe' and subsequently monitors for any network connections initiated by this process within a 10-minute window of its creation. This behavior is indicative of a compiled payload attempting unauthorized network exfiltration shortly after dynamic compilation, as observed in the 'Operation SilentCanvas' campaign.
This rule detects when a Key Vault item is deleted in Azure. Monitoring deletions of sensitive items like those in Key Vaults is crucial for detecting potential data exfiltration, sabotage, or unauthorized access attempts by adversaries.
Detects connections to a known XenoRAT C2 IP address (185.235.137.106) originating from processes other than common web browsers (mshta.exe, chrome.exe, msedge.exe). This aims to identify potentially injected shellcode or RAT processes establishing command and control communications.
Detects the creation or alteration of a SQL trigger that utilizes sp_invoke_external_rest_endpoint. Attackers can abuse database triggers to automatically exfiltrate newly added credentials or sensitive records in real-time.
Detects pythonw.exe establishing a connection to the Vidar C2 domains and sending a significant byte count, confirming credential exfiltration.
Detects bulk file reading from network shares for data collection
Detects bulk download of AWS S3 objects indicating cloud data theft
Detects DNS-based data exfiltration via high-volume TXT record queries
Detects upload of malicious payloads to file hosting services for staging
This rule identifies HTTP requests containing specific URL affiliate tracking parameters associated with the "Borrowed Trust" SEO poisoning campaign. The campaign utilizes these parameters to monetize its activities, often redirecting users to gambling sites. Detection is based on the presence of known affiliate codes in `RemoteUrl` from `DeviceNetworkEvents` or `RequestURL` from `CommonSecurityLog` (proxy/firewall logs).
Detects sustained large HTTP POST requests indicating data exfiltration
This rule detects an unusually high volume of file sharing events from a single user in OneDrive within a one-hour window. Specifically, it looks for five or more 'SharingSet' or 'AnonymousLinkCreated' operations by the same UserId within an hour, which could indicate data exfiltration or unauthorized sharing.
Detects the staging of Miasma exfiltration payloads, specifically JSON files matching the 'results-*.json' naming convention, and Git operations interacting with these files. Miasma is known to exfiltrate harvested credentials by creating public GitHub repositories and committing encrypted JSON files with this specific naming convention.
Detects network connections to known ShinyHunters infrastructure, including specific IP addresses and DNS queries for 'azurenetfiles.net', which has been linked to their operations targeting Oracle PeopleSoft servers via gadget chain exploitation.
Detects audio capture and exfiltration via RTP media streams
Detects large HTTPS uploads used for data exfiltration over encrypted channels
Page 73 of 124