Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
This rule detects large data exfiltration attempts over SMTP Submission (port 587). It triggers an alert if more than 50,000 bytes of data are sent from a single source IP address to a server via SMTP Submission, with a threshold of 5 such events within a 300-second window. This indicates a potential policy violation related to data exfiltration.
This rule detects large attachments being exfiltrated via SMTP. Specifically, it looks for SMTP traffic on port 25, flowing to the server, that contains the 'Content-Transfer-Encoding: base64' header and has a data size greater than 50,000 bytes. This combination suggests a large, base64-encoded file being sent as an email attachment, which could indicate data exfiltration.
This rule detects the exfiltration of encrypted archives over HTTP POST requests. It specifically looks for HTTP POST methods, the presence of file data, the 'PK' magic bytes indicating a ZIP or similar archive, and a file size greater than 50,000 bytes. This combination suggests an attempt to send a large, potentially encrypted, archive out of the network.
This rule detects devices exhibiting high volume outbound network traffic, specifically more than 10MB of data transferred across more than 100 sessions to a single remote IP address within a one-minute window. This behavior can be indicative of data exfiltration, unauthorized data transfer, or other suspicious network activity.
Detects the creation of email forwarding rules in Google Workspace that direct emails to external domains. This activity can indicate potential Business Email Compromise (BEC) for persistence or insider data exfiltration.
This rule detects a high number of distinct URLs and total network connections originating from a single remote IP address within a one-minute time window. This behavior can be indicative of various malicious activities such as data exfiltration, command and control (C2) communication, or network scanning. The threshold for distinct URLs is set to greater than 100 and total connections greater than 500.
Detects outbound web requests or GitHub API interactions containing the specific description string "Miasma: The Spreading Blight". This string is used as a signature by the Miasma malware (a Shai-Hulud variant involved in the @redhat-cloud-services npm supply chain attack) when creating malicious GitHub repositories to exfiltrate stolen credentials.
This rule detects potential DNS tunneling or data exfiltration by identifying high volumes of DNS queries with unusually long subdomains from a single process on a device. It aggregates DNS connection inspection events, extracts the subdomain length, and then summarizes the count of queries, unique domains, and average subdomain length within a 10-minute window. An alert is triggered if the query count exceeds 100 or if more than 50 unique domains are observed, combined with subdomain lengths greater than 30 characters.
This rule detects instances where a single remote IP address exhibits a high number of idle network events (more than 200 idle events) and a high total number of network events (more than 500 total events) within a one-minute interval. This pattern can be indicative of Command and Control (C2) communication, where an adversary establishes a connection and then waits for commands, or data exfiltration, where data is sent in bursts with idle periods in between. It highlights unusual network communication patterns that might suggest malicious activity.
Detects the export of Microsoft Teams messages, transcripts, recordings, and chat retrieval activities, particularly when performed via the Graph API. This rule identifies suspicious activity by looking for specific operation names in SaaS audit logs from Microsoft Teams and flags user agents commonly associated with automation tools (e.g., python-requests, axios, go-http, curl, wget, powershell, httpx, aiohttp, node) which could indicate post-compromise attackers using stolen tokens to silently export chat history.
This rule detects the creation or modification of Exchange transport rules or inbox rules that forward or redirect emails to external domains. It specifically looks for operations like 'New-TransportRule', 'Set-TransportRule', 'New-InboxRule', 'Set-InboxRule', 'Set-Mailbox', 'UpdateInboxRules', and 'Set-TransportConfig' where the destination is an email address outside of the organization's verified domains. This activity can indicate data exfiltration or an attempt to maintain persistence and collect sensitive information.
Identifies Node.js processes downloading the Bun runtime from GitHub Releases. This behavior was observed in the vpmdhaj npm supply chain attack, where Gen-2 stagers silently downloaded Bun to execute bundled credential harvesting payloads without an immediate C2 payload drop.
Detects a device making an unusually high number of unique outbound network connections to different remote IP addresses within a short time frame (5 minutes). This behavior can indicate various malicious activities such as network scanning, botnet activity, or data exfiltration to multiple external hosts.
Box SaaS Suspicious File Upload
Cortex XDR
Detects suspicious file uploads to Box indicating potential data staging, tool upload, or exfiltration via shared folders. This rule specifically looks for the 'UPLOAD' operation within Box SaaS audit logs and extracts various file and user-related details.
Detects outbound web requests or GitHub API interactions containing the specific description string "Miasma: The Spreading Blight". This string is used as a signature by the Miasma malware (a Shai-Hulud variant involved in the @redhat-cloud-services npm supply chain attack) when creating malicious GitHub repositories to exfiltrate stolen credentials.
Box SaaS Suspicious File Download
Cortex XDR
Detects file downloads from Box which could indicate potential data exfiltration by insiders or compromised accounts. This rule specifically looks for 'DOWNLOAD' operations within Box SaaS audit logs.
KQL Query
High Email Volume to Personal Accounts
Cortex XDR
Detects potential data exfiltration or policy violation by identifying users sending a high volume of emails, large emails, or emails to many unique personal email addresses (e.g., Gmail, Yahoo, Outlook.com) from an Office 365 Exchange Online mailbox. This rule aggregates email activity by sender and flags if any of the defined thresholds are met: total sent data to personal addresses exceeds 25 MB, total messages sent to personal addresses exceeds 10, emails sent to more than 5 unique personal addresses, or any single message sent to a personal address exceeds 25 MB. This is designed to be ran as a scheduled correlation for a day time frame. Thresholds can also be configured to fit your environment. Each user will have a different line that contains all of the matching emails they sent to, the attachments, and subjects of the emails.
Detects suspicious sharing activity in Box, including the creation of open links, external collaboration invites, role escalation, and weakening of sharing policies. This rule identifies high-risk activities such as making files publicly visible without password protection, inviting external users with co-owner or editor roles, and changes that reduce security like removing expiration dates on shared links.
Detects Microsoft 365 access attempts where the ClientAppId masquerades as Microsoft Office (d3590ed6-52b3-4102-aeff-aad2292ab01c) to bypass conditional access policies, but the UserAgent string reveals the use of a programmatic script (e.g., Python, PowerShell). This mismatch is a known tactic utilized by UNC6671 (BlackFile) during automated data exfiltration operations.
Systeminfo.exe Making Network Connection
Cortex XDR
Detects network connections originating from the systeminfo.exe process. This activity is suspicious because systeminfo.exe is a legitimate system enumeration tool not typically expected to initiate outbound network connections. This behavior has been observed in malware campaigns, such as CountLoader, which injects a cryptocurrency clipper into systeminfo.exe to communicate with C2 servers and the Ethereum blockchain.
Page 82 of 124