Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
Detects HTTP requests where the User-Agent string contains a full URL pointing to 'temp.sh'. This technique was observed in the Notepad++ supply chain attack where attackers passed the URL of exfiltrated data back to their C2 server within the User-Agent header.
Detects when a web browser or the Dropbox client accesses a file that is potentially sensitive, based on file name or security labels. This may indicate unauthorized data exfiltration of HBI (Highly Business-Impact) data to a personal or public Dropbox account.
This rule detects the creation of 'rclone.conf' file on a device. The 'rclone.conf' file is a configuration file used by the Rclone utility, a command-line program for syncing files with various cloud storage services. The presence of this file often indicates the installation or use of Rclone, which can be leveraged by adversaries for data exfiltration to cloud storage.
Detects the use of curl.exe where the User-Agent header is abused to pass a URL. This is a specific technique observed in the Notepad++ supply chain attack where attackers used it to exfiltrate reconnaissance data by sending a temp.sh URL to their C2 server.
Apt28 Cloud Storage C2
YARA-L
Detects outbound network traffic to legitimate cloud storage domains (filen.io, icedrive.net, koofr.net) known to be abused by APT28 for Command and Control (C2) and data exfiltration as part of Operation Phantom Net Voxel.
Detects the creation of a directory junction pointing to a OneDrive synchronization folder. This is a key component of the 'DoubleDrive' technique, used to force the synchronization of arbitrary local files for data exfiltration or cloud-based ransomware encryption.
Detects a process reading a .env file, which often contains sensitive credentials like API keys. This is often the first step of a data exfiltration pattern where the credentials are then sent to an attacker-controlled server. This behavior was observed in the malicious 'rankaj' OpenClaw skill. This rule should be correlated with subsequent network activity from the same process to a rare destination.
Detects attempts to exploit a vulnerability in Google Looker (CVE-2025-12743) by using error-based SQL injection within LookML dimension definitions. Attackers can use this to exfiltrate the internal Looker database.
This query parses the complex JSON parameters of the New-TransportRule and Set-TransportRule commands to find instances where email is being secretly copied externally or security is being lowered.
ClawdBot C2 Network Communication
Cortex XDR
Detects network connections to known malicious ClawdBot command and control (C2) infrastructure based on specific IP addresses and hostnames.
Detects network connections or DNS queries to known malicious domains identified as being used for Cobalt Strike C2, data exfiltration, and secondary payload delivery during the Notepad++ supply chain attack. This rule specifically targets the domains 'cdncheck.it.com', 'safe-dns.it.com', 'self-dns.it.com', 'api.wiresguard.com', 'api.skycloudcenter.com', and 'temp.sh'.
This rule detects large volumes of outbound network traffic originating from Azure Kubernetes Service (AKS) clusters to external destinations over non-standard ports. It specifically looks for traffic allowed by Palo Alto firewalls, excluding common ports like 80 and 443, and flags transfers exceeding a defined data threshold (e.g., 100MB). This behavior can indicate data exfiltration attempts where adversaries use alternative protocols to bypass standard monitoring.
Detects the use of curl.exe to upload files to the temp.sh service while simultaneously passing the resulting temp.sh URL within the User-Agent string to a C2 server. This specific exfiltration and beaconing TTP was observed in the Notepad++ supply chain attack.
Detects the use of curl.exe to upload data to the anonymous file-sharing service temp.sh. This technique has been observed being used by threat actors for reconnaissance data exfiltration, notably after gaining initial access through a compromised Notepad++ updater.
Detects a behavioral sequence where an AI agent runtime (e.g., Node.js, Python) spawns a shell to execute a web request utility like curl or wget. This pattern is a strong indicator of automated data exfiltration, often resulting from a successful prompt injection attack that instructs the agent to steal and send data to an attacker-controlled server.
Detects instances where an AI agent process (e.g., Moltbot, ClawdBot) performs a web search or HTTP request containing suspicious internal identifiers (like API keys or project names) as URL parameters. This behavior is a hallmark of 'search-and-leak' exfiltration tactics, often triggered by indirect prompt injection.
This detection identifies when a user or service principal executes a command inside an AKS pod ('kubectl exec') and then, using the same identity, accesses data in a sensitive Azure Blob Storage container within a short time frame. This pattern can indicate an attacker, having gained initial access to the Kubernetes API, is using a pod as a pivot point to discover and exfiltrate sensitive data.
This rule detects behaviors associated with HoneyMyte post-exploitation scripts. Specifically, it looks for `curl.exe` or `curl` being used to download executables or files into 'Libraries' or 'Public' directories. It also identifies executables named `getlogindata.exe` or `getlogindataedge.exe` when their command line arguments contain 'Login Data' or 'Local State', indicating browser credential theft. Additionally, it detects `powershell.exe` or `cmd.exe` command lines that include keywords related to HoneyMyte's exfiltration methods (e.g., 'pixeldrain', 'PIXELDRAIN', '113.23.212', 'log.dat', 'nbtscan').
Detects when an Azure Kubernetes Service (AKS) worker node initiates an outbound connection to a public IP address over a non-standard or unexpected port. This could indicate data exfiltration using custom tools or protocols.
Detects various activities associated with the ShadowHS fileless Linux post-exploitation framework, including fileless execution, specific command-line patterns, covert exfiltration, and connections to known C2 infrastructure.
Detects techniques used by the INC Ransomware Group, including the execution of their RainINC payload from C:\PerfLogs and the abuse of a renamed Restic binary for data exfiltration.
Page 90 of 124