Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
Detects the creation, alteration, or deletion of a SQL external model that could be used to establish a persistent exfiltration channel. Threat actors can leverage this to send data to an external server whenever a table is updated, particularly when combined with SQL triggers.
Detects data exfiltration occurring over non-standard alternate network mediums
This rule identifies potential data exfiltration or unusual data transfer activity by detecting a high volume of large data transfers (over 1MB per transfer) from or to an IIS web server. It aggregates these transfers hourly by client IP and alerts if 10 or more such transfers occur within that hour from a single IP.
This rule detects an abnormal volume of large file downloads or exports from cloud applications, excluding SharePoint, OneDrive, and Teams. It identifies instances where a single account downloads or exports more than 3 files with an average size greater than 10 MB within an hour from a specific application and IP address. This behavior could indicate data exfiltration or unauthorized data access.
This rule detects users uploading a high volume of files (50 or more within an hour) to SharePoint or OneDrive. This activity could indicate data exfiltration or unauthorized mass data transfer.
This rule detects when a single user downloads 100 or more files from SharePoint within a one-hour period. This activity could indicate data exfiltration or unauthorized bulk access to sensitive documents.
This rule detects when a single process account initiates a high volume (10 or more) of file move operations to folders associated with cloud storage services (e.g., 'cloud', 'dropbox', 'drive') within a one-hour window. This behavior could indicate data exfiltration or staging for exfiltration.
Detects unusually large outbound network data transfers (over 1TB) from a single process account within an hour. This could indicate data exfiltration, unauthorized bulk data synchronization, or other malicious activity where large volumes of data are being moved out of the environment.
Detects when a single user account creates 5 or more files within an hour that contain keywords like 'confidential', 'secret', or 'restricted' in their filenames. This behavior could indicate an attempt to stage sensitive data for exfiltration or unauthorized access to sensitive information.
This rule detects devices making a high volume of successful network connections to GitHub's API endpoints (api.github.com or api.releases). A count of 5 or more successful connections within an hour from a single device is considered suspicious and could indicate data exfiltration, automated tooling, or unusual development activity.
This rule detects outbound network connections to URLs associated with common file sharing services (e.g., Dropbox, Mega, Gofile) or temporary email providers (e.g., Temp-Mail). Such connections can indicate data exfiltration attempts, use of unsanctioned services, or communication with command and control infrastructure.
Detects a device making an unusually high number of unique outbound network connections to different remote IP addresses within a short time frame (5 minutes). This behavior can indicate various malicious activities such as network scanning, botnet activity, or data exfiltration to multiple external hosts.
This rule detects a high number of distinct URLs and total network connections originating from a single remote IP address within a one-minute time window. This behavior can be indicative of various malicious activities such as data exfiltration, command and control (C2) communication, or network scanning. The threshold for distinct URLs is set to greater than 100 and total connections greater than 500.
This rule detects potential data exfiltration attempts over non-standard network ports. It identifies devices that establish more than 5 network sessions to external (non-private IP) destinations on ports other than common ones like 80 (HTTP), 443 (HTTPS), 21 (FTP), 22 (SSH), 25 (SMTP), 110 (POP3), 143 (IMAP), 993 (IMAPS), and 995 (POP3S) within a one-hour window. This behavior can indicate an adversary attempting to bypass network monitoring by using less common ports for data transfer.
This rule detects unusual network beaconing activity from processes. It identifies processes that make more than 50 network connections within a 15-minute window to distinct remote IP addresses and ports, excluding common legitimate processes like svchost.exe, chrome.exe, msedge.exe, and explorer.exe. The rule then enriches this information with the last seen time of the process.
This rule detects high-volume data exfiltration attempts over common HTTPS ports (443 or 8443). It identifies network connections where more than 1MB of data is sent in a single connection, then aggregates these connections over one-hour intervals per device and remote IP. Finally, it flags any device that has sent a total of 50MB or more within that hour to a specific remote IP, indicating potential data exfiltration to a command and control server.
Detects symmetric encryption patterns in C2 communications for encrypted channel detection
Detects bulk email collection via IMAP protocol for mass email harvesting
Detects automated sustained outbound data transfers indicative of automated exfiltration
Detects large internal data transfers used for staging before exfiltration
Detects data exfiltration via generic web services or cloud platforms
Page 75 of 124