Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
Detects outbound network connections to the Telegram API, a technique used by XWorm for command and control (C2) and data exfiltration. The rule specifically looks for connections to "api.telegram.org/bot" and "/sendMessage" paths, originating from suspicious processes like WmiPrvSE.exe or Soundman.exe, or from common user-writable locations.
Detects network connections to the 'webhook.site' domain, which is used as an exfiltration endpoint by the 'Shai-Halud' supply chain attack campaign. The risk score is elevated if the specific malicious URL path is observed.
This detection identifies potentially suspicious usage of Invoke-Sqlcmd PowerShell cmdlet, which can be used for database operations and potential data exfiltration. The detection looks for suspicious parameter combinations and query patterns that may indicate unauthorized database access, data theft, or malicious database operations. Threat actors may prefer using PowerShell Invoke-Sqlcmd over sqlcmd.exe as it provides a more flexible programmatic interface and can better evade detection.
The analytic detects headless browser activity accessing mockbin.org or mocky.io. It identifies processes with the "--headless" and "--disable-gpu" command line arguments, along with references to mockbin.org or mocky.io. This behavior is significant as headless browsers are often used for automated tasks, including malicious activities like web scraping or automated attacks. If confirmed malicious, this activity could indicate an attempt to bypass traditional browser security measures, potentially leading to data exfiltration or further exploitation of web applications.
Detects processes potentially related to XillenStealer making outbound network connections or DNS queries for telegram.org. This is indicative of command and control or data exfiltration activity.
Detects network traffic consistent with XWorm malware using the Telegram API for Command and Control (C2) or data exfiltration. This rule specifically looks for HTTP requests to 'api.telegram.org' with URL patterns indicative of sending messages or files via the Telegram Bot API (e.g., /bot<token>/sendMessage, /bot<token>/sendDocument, /bot<token>/sendPhoto).
KQL Query
This analytic detects the configuration of TFTP services on Cisco IOS devices that could be used to exfiltrate sensitive configuration files. Threat actors like Static Tundra have been observed configuring TFTP servers to make device configuration files accessible for exfiltration after gaining initial access. The detection specifically looks for commands that expose critical configuration files such as startup-config, running-config, and other sensitive system information through TFTP. This activity is particularly concerning as it may represent an attempt to steal credentials, network topology information, and other sensitive data stored in device configurations.
Base64 Website Access
YARA-L
Detects a user accessing multiple websites commonly used for Base64 encoding and decoding within a short time frame. This activity could be a precursor to data exfiltration or an attempt to obfuscate malicious commands.
This detection identifies execution of the file synchronization utility "rclone" with network activity, as captured by Cisco Network Visibility Module flow data. It specifically looks for `rclone.exe` or `rclone` commands with arguments indicative of data transfer to cloud storage providers (e.g., `copy`, `remote:`, `mega:`, `ftp:`) and suspicious flags (`--transfers`, `--ignore-existing`, `--auto-confirm`). Rclone is a legitimate tool but is frequently abused by threat actors for data exfiltration or cloud abuse.
Detects scenarios where an attacker downloads a payload by abusing BITS software. For more precise information, inspect "Bits-client" event log and search for ID 59 and 60.
Detects data exfiltration performed by the Vice Society ransomware gang using a custom built PowerShell script. More precisely, the script enumerates the volumes mounted on the system, then starts crawling the different directories before initiating the data exfiltration over HTTP by creating multiple different jobs. As PowerShell script block logs the script execution into multiple events, the detection aggregates the different log chunks using the ScriptBlockId and then ensure that at least 3 of the 4 detection strings are found.
This rule detects suspicious bulk file downloads from SharePoint by correlating successful sign-in events with subsequent file download activities. It specifically looks for sign-ins that are not from registered devices, followed by multiple file downloads (at least 3) within a short time window (up to 10 minutes) from the same IP address. The rule flags scenarios where a user downloads a significant number of unique files (at least 2) or has a high download count (5 or more), or a combination of moderate downloads (3 or more) within a very short duration (1 minute). This pattern can indicate data exfiltration attempts.
Detects the execution of specific SOQL (Salesforce Object Query Language) queries associated with the UNC6395 data theft campaign. The actor used these queries to enumerate and exfiltrate data from sensitive Salesforce objects.
Detects a sequence of commands on Cisco IOS devices used to capture network traffic, specifically targeting TACACS+ on TCP port 49, and then exfiltrate it. This technique, detailed in a CISA advisory on PRC state-sponsored actors, is used to harvest credentials from network traffic.
Detects the use of known malicious or suspicious User-Agent strings associated with the UNC6395 data theft campaign targeting Salesforce instances.
Detects scenarios where an attacker downloads a payload by abusing BITS software. For more precise information, inspect "Bits-client" event log and search for ID 59 and 60.
No description available.
Detects the malicious telemetry.js file used in the s1ngularity supply chain attack. This script harvests sensitive developer assets and exfiltrates them to attacker-controlled GitHub repositories.
Detects the export of critical Registry keys (SAM, SECURITY, SYSTEM) to a file using regedit.exe. This activity is often associated with credential dumping or exfiltration of sensitive system information.
Detects the use of common command-line archiving utilities to compress files with extensions commonly associated with digital certificates and private keys. This behavior can indicate the staging of stolen certificates for exfiltration.
Page 97 of 124