Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
This rule detects HTTP network connections to the Telegram bot API (api.telegram.org/bot). This pattern is often associated with infostealers exfiltrating data to attacker-controlled Telegram bots. The rule specifically looks for the 'NETWORK_HTTP' event type and a URL containing '/api.telegram.org/bot' (case-insensitive).
Detects the creation or modification of repository webhooks in GitHub. Attackers can use webhooks for real-time data exfiltration of code pushes, pull request comments, and workflow data. Once a webhook is established, it operates independently of the creating user; revoking the creator's credentials will NOT stop the data flow. Only deleting the webhook itself terminates the exfiltration.
This YARA rule detects the Arkanix Stealer by identifying specific strings found within its code or related artifacts. It looks for a combination of unique user agent strings, domain names associated with its command and control infrastructure, API endpoints used for session creation or data exfiltration, a secret key, and a staging identifier. The rule requires at least one domain, one endpoint, and one of the distinctive user agent, key, or staging hints to trigger, aiming to reduce false positives by combining multiple indicators.
This rule detects suspicious enumeration of Azure Blob, File, Table, Queue, or DFS storage accounts by internal users. It identifies devices making network connections to public Azure storage URLs using potentially suspicious processes (e.g., PowerShell, Python, AzCopy, curl, wget, WinSCP, FileZilla, Storage Explorer). The rule then analyzes the distinct storage accounts accessed and uses a Jaccard index to identify unusual naming conventions among the accessed storage accounts, potentially indicating an insider attempting to discover or exfiltrate data from unfamiliar storage resources.
Detects files being written to USB-mounted removable drives. The rule enriches these alerts with USB device identifiers such as VID_PID, InstancePathId, and SerialNumberId, gathered from fleet-wide Plug and Play (PnP) events. This enrichment allows security analysts to cross-reference the detected USB devices against an organization's approved device exclusion list, potentially managed by solutions like Microsoft Intune, to differentiate legitimate data transfers from potential data exfiltration attempts.
This rule detects OysterLoader C2 communication based on specific HTTP User-Agent strings and URI paths. It looks for 'WordPressAgent' or 'FingerPrint' in the User-Agent field combined with URIs like '/reg', '/login', '/api/kcehc', '/api/v2/init', '/api/v2/facade', or '/api/jgfnsfnuefcnegfnehjbfncejfh'. This activity is indicative of OysterLoader's multi-stage evasion techniques as described in a Sekoia report.
Detects Chromium-based browsers (e.g., Microsoft Edge, Google Chrome) being launched with specific command-line arguments that attempt to hide the browser window (headless mode or positioning it off-screen).
This technique was observed in the "Operation MacroMaze" campaign, attributed to APT28, where it was used to silently execute scripts and exfiltrate data using legitimate services like webhook.site.
This technique was observed in the "Operation MacroMaze" campaign, attributed to APT28, where it was used to silently execute scripts and exfiltrate data using legitimate services like webhook.site.
Detects outbound network traffic to known infrastructure used in OpenClaw malicious skill delivery or credential exfiltration. These IOCs were identified in the NSFOCUS report on OpenClaw security risks.
Detects a sequence of events associated with a malicious Notepad++ update. This malicious process executes reconnaissance commands.
Detects the use of curl.exe to upload data to the temp.sh file-sharing service. This technique has been observed in post-compromise reconnaissance activities, including those following Notepad++ compromises.
Detects the execution of S3 Browser or Office installation executables, followed by network traffic from the same host to known cloud storage or file-sharing sites within a short time window. This behavior aligns with Muddled Libra's method of staging and exfiltrating sensitive data, such as PST files, to attacker-controlled cloud buckets.
Detects the execution of 'finger.exe' or 'ct.exe' with command-line arguments indicating an attempt to start 'cmd.exe', correlated with network connections to a known malicious IP address (69.67.173.30). This behavior is indicative of LOLBIN (Living Off the Land Binaries and Scripts) abuse for command and control communication.
Detects file access or download activity from SharePoint or OneDrive where the user agent is PowerShell. This TTP has been associated with UNC6671 (related to ShinyHunters) for data exfiltration from SaaS applications.
Detects an unusual exfiltration technique where a URL, typically from temp.sh, is embedded within the User-Agent string of an HTTP request. This TTP was observed in the Notepad++ supply chain attack in 2025 for exfiltrating system information.
Detects when a Network Attached Storage (NAS) or Internet of Things (IoT) device establishes multiple or high-volume outbound SSH/SFTP connections to an external IP address. This behavior can indicate that the device has been compromised and is being used as an 'Operational Relay Box' (ORB) to proxy malicious traffic, mask C2 communications, or exfiltrate data.
Detects a specific data exfiltration pattern observed in the Notepad++ supply chain attack. An attacker uses curl.exe to upload a file containing reconnaissance data to the temp.sh file sharing service. Subsequently, a beacon is sent to the C2 where the User-Agent string of the HTTP request contains the temp.sh URL for the exfiltrated data.
Detects file access or download operations from Microsoft SharePoint Online where the User-Agent string indicates the use of PowerShell. This behavior has been observed in campaigns by threat groups for bulk data exfiltration.
Detects curl commands uploading files to temp.sh service for data exfiltration via update.exe.
Detects a sequence of system reconnaissance commands followed by data exfiltration to temp.sh, a TTP used in the Notepad++ supply chain attack.
This rule detects network connections and DNS resolutions to a predefined list of known malicious IP addresses and domains. It also identifies HTTP requests containing specific URL paths ('update/update.exe', '/users/admin', '/api/') when made to these malicious IPs. This behavior is indicative of potential command and control (C2) communication or malware attempting to download updates or exfiltrate data.
The rule detects large file transfers where the MIME type is declared as 'text/plain' but the file size exceeds 1,000,000 bytes. It specifically looks for files originating locally and excludes transfers to internal IP addresses. This behavior is often used by C2 frameworks to disguise binary payloads or exfiltrated data as harmless text to evade proxy inspection.
Page 89 of 124