# Detection & Response Rules **URL:** https://community.limacharlie.com/c/community-exchange/detection-response-rules/8.md [Latest](https://community.limacharlie.com/latest.md) · [Categories](https://community.limacharlie.com/categories.md) · [Tags](https://community.limacharlie.com/tags.md) --- ## [About the Detection & Response Rules category](https://community.limacharlie.com/t/about-the-detection-response-rules-category/18)
**Author:** [@eric\_capuano](https://community.limacharlie.com/u/eric_capuano)\ **Replies:** 0\ **Last updated:** [February 14, 2025, 3:48am UTC](https://community.limacharlie.com/t/about-the-detection-response-rules-category/18 "2025-02-14T03:48:51Z")
This category is dedicated to all things Detection & Response. Share your custom D&R rules, detection logic, incident response playbooks, and automation rules. Learn from others and contribute to the community’s collec… --- ## [Detection for Data Exfil from Host](https://community.limacharlie.com/t/detection-for-data-exfil-from-host/474)
**Author:** [@joshlemon](https://community.limacharlie.com/u/joshlemon)\ **Replies:** 2\ **Last updated:** [September 5, 2025, 11:35pm UTC](https://community.limacharlie.com/t/detection-for-data-exfil-from-host/474 "2025-09-05T23:35:32Z")
Does anyone know if there is a way to detect traffic outbound from a host, without having to collect PCAP? I’d like to set up a rule that can detect high volumes of outbound data (ideally to an external IP) from specifi… --- ## [Detecting Suspicious LSASS Access + Template String Example](https://community.limacharlie.com/t/detecting-suspicious-lsass-access-template-string-example/71)
**Author:** [@eric\_capuano](https://community.limacharlie.com/u/eric_capuano)\ **Replies:** 1\ **Last updated:** [July 22, 2025, 2:37pm UTC](https://community.limacharlie.com/t/detecting-suspicious-lsass-access-template-string-example/71 "2025-07-22T14:37:03Z")
Rule Description This rule is meant to provide an example of using a template in a report name (see Respond block below) to extract key fields from within the event that triggered the detection. Read more about template… --- ## [Outside Business Hours Logon Detection](https://community.limacharlie.com/t/outside-business-hours-logon-detection/105)
**Author:** [@eric\_capuano](https://community.limacharlie.com/u/eric_capuano)\ **Replies:** 4\ **Last updated:** [March 27, 2025, 6:17pm UTC](https://community.limacharlie.com/t/outside-business-hours-logon-detection/105 "2025-03-27T18:17:31Z")
Rule Description This rule detects interactive logons outside of specified “business hours” using a regular expression pattern against the WEL UTC creation time of the event. Be sure to adjust the pattern for the correc… --- ## [Detecting Unauthorized Removable Media](https://community.limacharlie.com/t/detecting-unauthorized-removable-media/106)
**Author:** [@eric\_capuano](https://community.limacharlie.com/u/eric_capuano)\ **Replies:** 0\ **Last updated:** [March 7, 2025, 9:37pm UTC](https://community.limacharlie.com/t/detecting-unauthorized-removable-media/106 "2025-03-07T21:37:09Z")
Rule Description Detect Non-Approved removable media on Windows devices, with support for volume name exclusions. Detect event: VOLUME\_MOUNT op: and rules: - op: is path: event/DEVICE\_TYPE value: "REMOVABLE"… --- ## [Obfuscation in CLI arguments](https://community.limacharlie.com/t/obfuscation-in-cli-arguments/20)
**Author:** [@eric\_capuano](https://community.limacharlie.com/u/eric_capuano)\ **Replies:** 0\ **Last updated:** [February 14, 2025, 5:42am UTC](https://community.limacharlie.com/t/obfuscation-in-cli-arguments/20 "2025-02-14T05:42:14Z")
Rule Description Looks for possible obfuscations in command line args (n^e^t u^s^er) Detect event: NEW\_PROCESS op: matches path: event/COMMAND\_LINE re: (?:\[a-zA-Z\]\\^)+\[a-zA-Z\] Respond - action: report name: Possib… --- ## [Automating Artifact Collection Upon Waking Sleeper Agents](https://community.limacharlie.com/t/automating-artifact-collection-upon-waking-sleeper-agents/21)
**Author:** [@eric\_capuano](https://community.limacharlie.com/u/eric_capuano)\ **Replies:** 0\ **Last updated:** [February 14, 2025, 6:24am UTC](https://community.limacharlie.com/t/automating-artifact-collection-upon-waking-sleeper-agents/21 "2025-02-14T06:24:09Z")
Rule Description This rule is designed for SLEEPER MODE deployments, where all agents are put to sleep and are only awakened in an IR scenario. It can easily be expanded upon to grab additional artifacts or even to init…