Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
Detects HTTP POST requests directed to the specific URI path '/api/validate/keyboard-events', which is used by a North Korean-linked npm malware to exfiltrate keylogger data.
Detects HTTP requests where the Cookie header contains the specific prefixes 'euconsent-v2=' or 'zd_cs_pm=', which are used by the OceanLotus SPECTRALVIPER backdoor to exfiltrate encrypted host profiling data.
Recent reporting indicates the campaign targeted GitHub repositories by inserting malicious GitHub Actions / CI workflows designed to steal secrets and credentials.
5,561 repositories were affected in roughly six hours
Attackers pushed 5,718 malicious commits.
The objective was credential theft from CI/CD environments, including:
cloud credentials
SSH keys
access tokens
CI/CD secrets
The campaign reportedly used:
fake automation-style commit identities such as build-bot, ci-bot, or similar
malicious .github/workflows changes
workflow triggers that either:
executed automatically on push / pull request, or
remained dormant until manually triggered
Web reporting further states the payload collected environment variables, cloud metadata credentials, and repository runner secrets, then exfiltrated them to 216.126.225.129:8443.
5,561 repositories were affected in roughly six hours
Attackers pushed 5,718 malicious commits.
The objective was credential theft from CI/CD environments, including:
cloud credentials
SSH keys
access tokens
CI/CD secrets
The campaign reportedly used:
fake automation-style commit identities such as build-bot, ci-bot, or similar
malicious .github/workflows changes
workflow triggers that either:
executed automatically on push / pull request, or
remained dormant until manually triggered
Web reporting further states the payload collected environment variables, cloud metadata credentials, and repository runner secrets, then exfiltrated them to 216.126.225.129:8443.
This rule detects a high volume of network connections (10 or more within an hour) from a single process to remote URLs containing 'artifact' or 'maven' on standard HTTP (port 80) or HTTPS (port 443) ports. This activity could indicate legitimate software development or build processes, but also potentially malicious activities such as supply chain compromise, data staging, or exfiltration of development-related artifacts.
This rule detects attempts to access sensitive configuration or backup files on an IIS web server. It looks for requests where the URI stem contains keywords like '.env', 'config', or 'backup', which are commonly associated with files that may contain sensitive information.
This rule detects suspicious outbound network connections initiated by an IIS worker process (w3wp.exe) to non-standard ports. This behavior can indicate a web shell or other compromise establishing Command and Control (C2) communication, potentially for data exfiltration or further malicious activity. The rule specifically looks for successful connections where the remote port is not commonly used for web traffic (80 or 443).
Detects unusually large outbound network data transfers (over 1TB) from a single process account within an hour. This could indicate data exfiltration, unauthorized bulk data synchronization, or other malicious activity where large volumes of data are being moved out of the environment.
Detects an unusually high number of file copy operations to 'public' or 'external' folders within a one-hour window, initiated by the same process account. This behavior could indicate data exfiltration or unauthorized data staging.
This rule detects when a single process account creates or copies 10 or more files to a removable media device (e.g., USB drive) within a one-hour window. This behavior can be indicative of data exfiltration attempts.
This rule detects an unusual spike in large file downloads from SharePoint by a single user within a one-hour window. It specifically looks for users downloading 5 or more files, each larger than 100MB, from SharePoint.
This rule detects when a single process account initiates a high volume (10 or more) of file move operations to folders associated with cloud storage services (e.g., 'cloud', 'dropbox', 'drive') within a one-hour window. This behavior could indicate data exfiltration or staging for exfiltration.
This rule detects when a single user downloads 50 or more files from OneDrive within a one-hour period. This could indicate data exfiltration or unauthorized bulk access to sensitive information.
This rule detects suspicious file export activity by monitoring for the creation of files with names containing keywords like 'export', 'dump', or 'extract'. It triggers an alert if five or more such files are created by the same account within a one-hour window, indicating potential data exfiltration or staging.
This rule detects large encrypted data uploads (over 65KB) on TCP port 8443, which is an alternate port often used for TLS/HTTPS traffic. The rule triggers if 10 such uploads occur from the same source within 60 seconds, indicating a potential policy violation or data exfiltration attempt.
This rule detects potential data exfiltration over TLS to non-standard endpoints. It triggers when a large amount of data (greater than 65000 bytes) is sent from the home network to any destination IP on port 443 (HTTPS). A threshold is applied, triggering an alert if this occurs 20 times within 60 seconds from the same source IP, indicating a high volume of outbound encrypted traffic.
This rule detects potential data exfiltration attempts via Slack incoming webhooks. It triggers when an HTTP POST request is made to 'hooks.slack.com' with a URI containing '/services/' and a data size greater than 500 bytes. This pattern is indicative of an application or script sending data to a Slack channel using a webhook.
Detects instances where Windows screen capture tools (Snipping Tool or Screen Sketch) initiate network connections to external IP addresses on ports commonly associated with Server Message Block (SMB) or Common Internet File System (CIFS). This could indicate an attempt to exfiltrate captured screenshots to an external server.
This rule detects potential Agent Tesla malware activity by correlating process execution with network connections. It looks for processes named 'agenttesla.exe', 'atsvc.exe', or 'atservice.exe' that execute with command-line arguments indicative of data exfiltration (e.g., 'smtp', 'ftp', 'http.post', 'exfil'). The rule then correlates these process events with outbound network connections to non-private IP addresses, flagging instances where multiple process runs and multiple network connections occur within a 30-minute window.
This rule detects high volume data exfiltration (over 1GB) from devices to a list of known malicious IP addresses within a one-hour window. It specifically looks for network events where a significant amount of data (SentBytes > 100MB initially, then summed to over 1GB) is sent to hardcoded remote IP addresses associated with potential command and control or data exfiltration infrastructure.
Detects the configuration change that enables the 'external rest endpoint' feature in SQL Server 2025. Threat actors can abuse this feature using sp_invoke_external_rest_endpoint to natively exfiltrate data and establish C2 channels.
Detects the execution of WinSCP or Rclone binaries, which are frequently used by threat actors like UNC3753 to exfiltrate staged data. This rule specifically looks for process creation events where the image name is 'winscp.exe' or 'rclone.exe'.
Page 76 of 124