Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,115
15,636
12,582
8,393
6,221
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
Detects anomalous POST requests to the RubyGems API endpoint '/api/v1/gems' that include an 'Authorization' header and a 'Content-Type' of 'application/octet-stream'. This pattern suggests the automated upload of binary files, potentially indicating exfiltration of data disguised as Ruby gems.
This rule detects network activity associated with the GemStuffer malware, specifically monitoring for DNS queries to known OAST callback domains, HTTP requests to specific C2 paths, and unauthorized data exfiltration attempts to the webhook.site service.
Detects a multi-stage communication pattern involving an initial request to a URL-mirroring or shortening service with a long base64-encoded path, followed by a request to a screenshot/rendering API, and culminating in the reception of an image file. This chain is indicative of command and control (C2) communication where command output or exfiltrated data is encoded into images rendered by external web services to bypass traditional network security filters.
Detects outbound network connections to known SectopRAT C2 infrastructure, specifically targeting the hardcoded IP 98.142.252.140 or the non-standard port 15847 often used for encrypted exfiltration.
Detects an AI agent or automated process that accesses sensitive data sources (such as vaults, databases, or documentation platforms) followed by an outbound HTTP POST request to known high-risk SaaS or web services (e.g., paste sites, file sharing, or webhook services) with a suspicious or large payload.
This rule detects potential data exfiltration by monitoring corporate user activities involving consumer generative AI services (e.g., ChatGPT, Gemini, Claude). It identifies suspicious patterns such as large volume submissions, repeated chunked prompts, and the presence of sensitive content (e.g., PII markers, classification labels) or obfuscated payloads (base64/rot13) that suggest an attempt to bypass DLP or detection controls.
Detects a suspicious sequence of events where a host performs multiple reconnaissance-style probes (health checks, documentation, or OpenAPI definitions) followed within 10 minutes by access to sensitive artifact-related URLs on the same remote host. This pattern is indicative of an attacker profiling a target server for metadata and then proceeding to exfiltrate files or sensitive artifacts.
Detects a behavioral chain where a process establishes persistence using a 'WindowsUpdate' Registry Run key or a scheduled task, followed within five minutes by an outbound network connection from the same process. The rule specifically excludes cases where a ZIP file was written to disk, identifying potential in-memory staging for exfiltration.
Detects high-volume outbound network connections over port 443 with significant duration, which is indicative of staged data exfiltration activity. The rule identifies sustained transfers exceeding 50MB that last longer than 5 minutes, targeting non-local network destinations.
Detects an suspicious progression of activities originating from identified AI assistant/agent processes. The rule monitors for a chain of behaviors occurring within a 15-minute window: execution of an AI agent/tool, followed by host discovery (network/system enumeration), access to sensitive local credential files, archival of data, and outbound network communication to common file-sharing/exfiltration platforms.
This rule detects potential data exfiltration by correlating access to files labeled as sensitive (confidential, restricted, etc.) with a subsequent upload to a personal cloud storage provider or transmission via email to a personal domain within a two-hour window.
This rule performs a retrospective hunt for indicators of compromise (IOCs) associated with the ClosedQuorum malware. It identifies suspicious activity by matching against known file hashes, specific filenames, and network traffic directed towards services (such as DeepSeek, OpenRouter, Mistral, and Discord) which the malware uses for C2 or data exfiltration. The detection logic aggregates results from file system, process, and network telemetry.
Detects anomalous, high-frequency outbound network connections to port 443 initiated by the binary 'rnpkeys.exe'. This behavior is characteristic of the Sauron Loader, which uses this masqueraded process to exfiltrate collected data, such as screenshots, via an encrypted C2 channel.
Detects the creation of password-protected archives using 7-Zip or WinRAR command-line utilities. Adversaries often use these tools to compress and encrypt data prior to exfiltration to bypass security controls and prevent inspection of contents.
Detects the execution of rclone, a command-line tool for synchronizing files to and from cloud storage services. The rule identifies suspicious command-line usage patterns, specifically looking for common transfer operations (copy, sync, copyto), usage of configuration files, transfer tuning flags, or direct remote cloud storage identifiers, which are characteristic of unauthorized data exfiltration.
Detects the execution of rclone.exe or renamed binaries with command-line flags indicative of data exfiltration to cloud storage providers such as S3, Mega, OneDrive, or Google Drive. This behavior is frequently associated with ransomware actors, including Akira, Qilin, and Storm-2570, who use Rclone to perform mass exfiltration of sensitive file share data prior to encryption (double extortion).
Detects anomalous, high-volume file access or preview activity in OneDrive or SharePoint from non-browser user agents. This pattern is indicative of potential data exfiltration where adversaries use scripted clients or APIs to mass-read or preview files, bypassing traditional download-based alerts.
Detects anomalous, high-volume file access or preview activity in OneDrive or SharePoint from non-browser user agents. This pattern is indicative of potential data exfiltration where adversaries use scripted clients or APIs to mass-read or preview files, bypassing traditional download-based alerts.
Detects potential insider threats or departing employees by correlating abnormal bulk data downloads from cloud repositories (SharePoint/OneDrive/Box/etc.) with subsequent sensitive data access and exfiltration signals. It uses baseline behavioral profiling, requires a threshold of sensitive file interactions, and mandates high-confidence exfiltration indicators (removable media usage, suspicious external domains, or multiple combined destination events) to reduce noise. Archive/staging activity is used as an optional confidence booster.
Detects potential insider threats or departing employees by correlating abnormal bulk data downloads from cloud repositories (SharePoint/OneDrive/Box/etc.) with subsequent sensitive data access and exfiltration signals. It uses baseline behavioral profiling, requires a threshold of sensitive file interactions, and mandates high-confidence exfiltration indicators (removable media usage, suspicious external domains, or multiple combined destination events) to reduce noise. Archive/staging activity is used as an optional confidence booster.
Detects potential insider threats or departing employees by correlating abnormal bulk data downloads from cloud repositories (SharePoint/OneDrive/Box/etc.) with subsequent sensitive data access and exfiltration signals. It uses baseline behavioral profiling, requires a threshold of sensitive file interactions, and mandates high-confidence exfiltration indicators (removable media usage, suspicious external domains, or multiple combined destination events) to reduce noise. Archive/staging activity is used as an optional confidence booster.
Page 9 of 124