Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
https://www.microsoft.com/en-us/security/blog/2026/04/18/crosstenant-helpdesk-impersonation-data-exfiltration-human-operated-intrusion-playbook/
Detects HTTP POST requests destined for specific PHP endpoints (/res.php, /tele.php) frequently used by the BlobPhish campaign to exfiltrate stolen credentials from memory-resident phishing pages.
Detects HTTP POST requests to specific URI paths (res.php, tele.php) commonly associated with BlobPhish credential exfiltration. This rule identifies attempts to send stolen credentials or other sensitive data to attacker-controlled endpoints.
https://github.com/blackarrowsec/redteam-research/tree/master/CVE-2026-33829
Detects instances where Windows screen capture tools (Snipping Tool or Screen Sketch) initiate network connections to external IP addresses on ports commonly associated with Server Message Block (SMB) or Common Internet File System (CIFS). This could indicate an attempt to exfiltrate captured screenshots to an external server.
Detects network connections over FTP (port 21) to specific compromised IP addresses abused by the LucidRook malware. The threat actor utilizes these Taiwanese FTP servers to stage payloads and receive exfiltrated data.
Detects the execution of the prt-scan supply chain campaign payload by identifying specific hardcoded exfiltration and reconnaissance log markers in command line arguments. These markers include 'PRT_EXFIL', 'PRT_RECON', 'PRT_HARVEST', 'PRT_DELAYED', 'PRT_GIT_AUTH', and 'PRT_LABEL_BYPASS'.
This rule detects the exposure of Kuwaiti Civil ID numbers in various log sources, including process command lines, additional device event fields, and email subjects/sender addresses. A Kuwaiti Civil ID is identified by a 12-digit number starting with 1, 2, or 3.
Detects the use of the curl command-line utility to perform an HTTP POST request uploading a .zip archive. This behavior is characteristic of the exfiltration phase used by macOS malware, such as Miolab Stealer, to silently transfer staged sensitive files and system profiles to a remote command-and-control server.
Detects unusual outbound network connections from ATM devices (identified by device names containing 'ATM', 'NCR', 'DIEBOLD', 'WINCOR'). The rule flags connections to public IP addresses, excluding common internal networks and standard web/DNS ports (80, 443, 53). Alerts are triggered if an ATM device shows a high number of connections, unique remote IPs, or significant data transfer, indicating potential compromise or unauthorized activity.
This rule detects the exposure of Kuwaiti Civil ID numbers in various log sources, including process command lines, additional device event fields, and email subjects/sender addresses. A Kuwaiti Civil ID is identified by a 12-digit number starting with 1, 2, or 3.
Detects high-volume data downloads (AUY) from SAP to a local frontend file, potentially indicating exfiltration.
Detects emails where the subject line contains a 13-16 digit number, potentially indicating sensitive numerical patterns like a Credit Card. The rule looks for contiguous digits or common dashed/spaced credit card formats and filters out common automated email keywords to reduce false positives.
Detects cleartext network connections using FTP (port 21) or Telnet (port 23) to external IP addresses. This rule specifically filters out internal RFC1918 traffic to focus on public-facing cleartext communications, addressing compliance requirements such as PCI-DSS for strong cryptography over public networks.
Detects emails where the subject line contains a 13-16 digit number, potentially indicating sensitive numerical patterns like a Credit Card. The rule looks for contiguous digits or common dashed/spaced credit card formats and filters out common automated email keywords to reduce false positives.
This rule detects emails that contain keywords related to 'civil id' in English or Arabic and subsequently extract potential Civil ID numbers from the email body. It then validates the extracted numbers based on birth month and day, and categorizes the risk level based on sender's domain and attachment count. This could indicate data exfiltration or sensitive information exposure.
Detects indicators of the TeamPCP LiteLLM supply chain compromise. This includes the creation or modification of specific malicious files (litellm_init.pth, tpcp.tar.gz, sysmon.py, sysmon.service), execution of commands related to persistence (systemctl for sysmon.service), data archiving (tar for tpcp.tar.gz), or direct execution of the backdoor (sysmon.py). It also identifies network connections or DNS queries to known command and control (C2) domains (models.litellm.cloud, checkmarx.zone) and HTTP requests to checkmarx.zone. Furthermore, the rule detects unauthorized AWS API calls (ListSecrets, GetSecretValue, DescribeParameters) made using the 'python-urllib' user agent, which is indicative of custom scripting rather than standard boto3 usage.
This rule detects unusual network connections from processes to legitimate service endpoints that are commonly abused for Command and Control (C2) activities (LOLC2). It specifically looks for connections to services like Telegram, Slack, Discord, GitHub, Google APIs, Pastebin, Dropbox, and others, originating from processes that are not recognized as legitimate applications for those services, and not from common system processes or standard program file paths. This helps identify potential adversary communication channels masquerading as legitimate traffic.
Detects native Windows scripting hosts (wscript.exe, cscript.exe) establishing outbound network connections over SMTPS (port 465). This is highly anomalous and was observed in the FAUX#ELEVATE campaign where threat actors exfiltrated stolen credentials and browser data using Collaboration Data Objects (CDO) via VBScript to external SMTP servers.
This rule detects unusual network connections from processes to legitimate service endpoints that are commonly abused for Command and Control (C2) activities (LOLC2). It specifically looks for connections to services like Telegram, Slack, Discord, GitHub, Google APIs, Pastebin, Dropbox, and others, originating from processes that are not recognized as legitimate applications for those services, and not from common system processes or standard program file paths. This helps identify potential adversary communication channels masquerading as legitimate traffic.
This rule detects a multi-stage exfiltration technique observed on macOS systems, specifically targeting the AMOS malware. It correlates process execution events related to archiving (using 'ditto'), splitting files (using 'split'), and network connections involving 'curl' with specific headers or to known malicious infrastructure. The rule looks for a combination of these activities, indicating data staging and subsequent exfiltration in chunks.
Page 84 of 124