Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,115
15,635
12,577
8,388
6,220
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
This rule detects potential data exfiltration attempts via Microsoft Teams webhook connectors. It specifically looks for HTTP POST requests to 'outlook.office.com' with a URI containing '/webhook/' and a data size greater than 500 bytes. This combination suggests that data might be sent out through a Teams webhook, which can be abused for exfiltration.
This rule set detects various stages of the JFMBackdoor and Showboat malware, including DLL sideloading of FLTLIB.dll by fltMC.exe from non-standard directories, network connections to known C2 and staging infrastructure (namefuture.site or 23.27.201.160), command-line activity referencing a specific Pastebin URL used by Showboat for process-hiding code, and the creation of JFMBackdoor payload artifacts (flt.bin, scr.mui).
Detects network connections from Bun or Node.js processes to GitHub API endpoints
used by the Miasma worm for credential exfiltration. The malware creates repos under
the liuende501 account and uploads encrypted stolen credentials.
used by the Miasma worm for credential exfiltration. The malware creates repos under
the liuende501 account and uploads encrypted stolen credentials.
Detects network requests associated with FallSpy, an Android spyware utilized by the Russia-nexus threat group GREYVIBE. FallSpy is deployed via fake persona lures and spoofed applications to harvest critical intelligence. While the original YARA rule targets file-based artifacts (e.g., class names like DataCollectorWork), this Sigma rule adapts the logic to focus on the highly reliable exfiltration URL parameters observable in proxy and web gateway logs.
This rule set detects various stages of the JFMBackdoor and Showboat malware, including DLL sideloading of FLTLIB.dll by fltMC.exe from non-standard directories, network connections to known C2 and staging infrastructure (namefuture.site or 23.27.201.160), command-line activity referencing a specific Pastebin URL used by Showboat for process-hiding code, and the creation of JFMBackdoor payload artifacts (flt.bin, scr.mui).
Detects the execution of MEGAsync.exe with the /upload argument, a technique used by NightSpire ransomware operators to exfiltrate staged data to MEGA cloud storage.
This rule detects suspicious processes (e.g., powershell.exe, cmd.exe, mshta.exe) making outbound network connections to public IP addresses on non-standard ports. This behavior can indicate command and control (C2) communication or data exfiltration attempts, as adversaries often use non-standard ports to evade detection.
Detects co-occurrence of MicrosoftSystem64 binary execution and DNS queries to huggingface.co from the same host within a 5-minute window. MicrosoftSystem64 is a DPRK-attributed (FAMOUS CHOLLIMA / Contagious Interview) multi-platform RAT delivered via malicious npm packages that exfiltrates stolen credentials, screenshots, and wallet data to attacker-controlled HuggingFace datasets. SafeDep confirmed the exfiltration pipeline was actively operating with real victims as of May 28, 2026.
This rule identifies an anomalous surge in network connection attempts to a particular remote IP address. It establishes a baseline of average daily connection counts to each remote IP over the past week. It then compares the current hourly connection count to this baseline, triggering an alert if the current count is more than five times the baseline and surpasses a total of 500 connections within that hour. This could indicate various malicious activities such as data exfiltration, command and control communication, or a denial-of-service attack originating from the monitored environment.
Detects the use of curl.exe to upload files to sendit.sh, indicative of staging stolen data to a public file-transfer service as observed in Seedworm campaigns.
This rule set detects various stages of the JFMBackdoor and Showboat malware, including DLL sideloading of FLTLIB.dll by fltMC.exe from non-standard directories, network connections to known C2 and staging infrastructure (namefuture.site or 23.27.201.160), command-line activity referencing a specific Pastebin URL used by Showboat for process-hiding code, and the creation of JFMBackdoor payload artifacts (flt.bin, scr.mui).
Detects DNS queries commonly associated with Local LLM (Large Language Model) frameworks or AI-related domains. This activity may indicate unauthorized AI usage or potential data exfiltration channels.
This rule detects outbound Server Message Block (SMB) communications from internal devices to external (non-private) IP addresses. It specifically looks for connections on ports 137, 138, 139, and 445. The rule then aggregates these events over 10-minute intervals and flags devices that have more than 5 such SMB connections to distinct external IPs, indicating potential data exfiltration or unauthorized external communication.
This rule detects potential Agent Tesla malware activity by correlating process execution with network connections. It looks for processes named 'agenttesla.exe', 'atsvc.exe', or 'atservice.exe' that execute with command-line arguments indicative of data exfiltration (e.g., 'smtp', 'ftp', 'http.post', 'exfil'). The rule then correlates these process events with outbound network connections to non-private IP addresses, flagging instances where multiple process runs and multiple network connections occur within a 30-minute window.
Detects wscript.exe initiating outbound network connections to non-standard HTTP ports (ports other than 80, 443, or 8080), which aligns with JS.MonoGlyphRAT's C2 communication profile. This rule specifically looks for successful network connections from wscript.exe to remote IPs that are not private and are not using standard web ports, indicating potential command and control activity.
Detects Python processes (python.exe, pythonw.exe) making more than 3 connections to public IP addresses. This activity could indicate data exfiltration, command and control communication, or other suspicious network behavior originating from a Python script.
This rule detects potential video stream exfiltration over HTTP POST. It specifically looks for HTTP POST requests with a large payload size (greater than 100,000 bytes) and the byte sequence '|52 49 46 46|' at the beginning of the file data, which corresponds to the 'RIFF' header commonly found in multimedia file formats like AVI and WAV. This combination suggests an attempt to upload or exfiltrate video or audio data.
This rule detects a bulk file copy pattern to a removable share over SMB (port 445). It triggers an alert if there are more than 200 SMB 'to_server' flows from a single source within a 60-second window, indicating a high volume of data transfer. This behavior is often associated with data exfiltration or large-scale data movement to external storage.
This rule detects potential data exfiltration to an AWS S3 bucket. It triggers on HTTP PUT requests to 's3.amazonaws.com' with a payload size greater than 10000 bytes. This could indicate an attacker uploading sensitive data from the internal network to an external S3 bucket they control.
WebDAV File Upload Exfiltration
Suricata
This rule detects potential WebDAV file upload exfiltration attempts by monitoring HTTP traffic for the 'PROPFIND' method. It uses a threshold of 10 occurrences within 60 seconds from the same source IP address to identify suspicious activity, indicating a possible attempt to enumerate or exfiltrate files via WebDAV.
This rule detects potential Secure File Transfer Protocol (SFTP) large file exfiltration attempts. It triggers an alert when a TCP connection on port 22 (SFTP) from the home network to any destination transfers a large amount of data (greater than 65000 bytes) to the server. A threshold of 20 such transfers within 60 seconds from the same source IP is set to reduce false positives. The rule specifically looks for the SFTP protocol magic bytes '|00 00 00|' within the first 4 bytes of the payload.
Page 81 of 124