Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,311 detections
Filters
Last updated
All Time
Detection languages
2,035
733
398
299
243
Contributors
1,048
740
503
372
239
Categories
20,456
11,839
5,876
5,155
4,865
4,311
Platforms
2,572
793
615
382
319
Products / Services
767
740
659
513
348
MITRE Techniques
2,350
917
848
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects access or modification of cloud provider credential and configuration files by common script interpreters or code editors (python, node, vscode), which may indicate credential theft or misuse by an adversary.
Detects Python scripts, launched by code.exe or node.exe (common IDE-related processes), accessing SSH private key files (id_rsa, id_ed25519, id_ecdsa) followed by an outbound network connection within 60 seconds. This behavior is indicative of credential theft and potential exfiltration or lateral movement.
Detects processes accessing credential store paths across browsers, FTP clients, email, SSH, and IM clients in a pattern consistent with Pony (Fareit/Siplog) modular credential grabber walking well-known AppData credential store locations. The rule specifically looks for non-browser/non-client processes accessing multiple credential-related files in common application data directories.
Detects attempts to list, read, create, update, or delete Kubernetes secrets via the Kubernetes API server. This activity can indicate an adversary attempting to gain access to sensitive information or manipulate the environment.
Slack Anomalous Activity Detected
Cortex XDR
This rule detects anomalous activity reported by Slack's internal anomaly detection system. This includes events such as impossible travel, new device access, suspicious IP changes, and other behavioral anomalies that could indicate a compromised account or unauthorized access to a Slack workspace.
Slack Anomalous Activity Detected
Cortex XDR
This rule detects anomalous activity reported by Slack's internal anomaly detection system. This includes events such as impossible travel, new device access, suspicious IP changes, and other behavioral anomalies that could indicate a compromised account or unauthorized access to a Slack workspace.
Detects an account granting offline access, mail, files, directory, or user impersonation permissions shortly after anomalous authentication. This rule is designed to identify potential persistence mechanisms established by adversaries leveraging OAuth applications, as seen in campaigns like Tycoon 2FA AITM.
Detects network connections from Node.js or Bun runtime processes to common cloud instance metadata service IPs (AWS, Azure, GCP) or to the default HashiCorp Vault port (8200). This activity can indicate credential access attempts, especially in the context of a supply chain attack where malicious code might be injected into a Node.js/Bun application to exfiltrate sensitive information or gain further access. The rule correlates network connection events with process execution events to identify the specific runtime responsible.
Detects registry key creation under the Windows SyncRootManager path (HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SyncRootManager) initiated by a process that is not a known legitimate cloud sync client. This technique is associated with CVE-2026-41091 (RedSun) for privilege escalation via Cloud Files sync root provider registration.
This rule detects attempts to register a new Authenticator app or phone number for multi-factor authentication (MFA) from an IP address that is not typically associated with the user's sign-in behavior. This could indicate a compromised account where an attacker is attempting to establish a new MFA method to maintain access.
This rule detects potential cleartext leakage of usernames and passwords over FTP (port 21) by identifying HTTP requests containing common credential-related keywords in the URL, while explicitly excluding HTTPS traffic. This could indicate sensitive information being transmitted insecurely.
This rule detects activities associated with CORS-based exploitation and session token harvesting, specifically targeting the creation or access of known exploit files (e.g., cors_exploit_poc.html) and the use of command-line tools (curl, wget, PowerShell) to interact with suspicious artifacts or session tokens (AMAUTHID/SAT).
Detects non-browser processes accessing sensitive browser data files (such as Login Data, Cookies, or key stores) followed by network activity to known suspicious, cryptocurrency, or potential malware-hosting domains. This behavior is indicative of credential theft and exfiltration by information-stealing malware.
Detects access, copying, or creation of files within common cryptocurrency wallet directories, as well as registry lookups related to Bitcoin data directories. This behavior is often indicative of info-stealing malware or an adversary attempting to exfiltrate digital currency assets from a compromised host.
Detects unauthorized access to sensitive credential and configuration files associated with AI development tools (Cursor, Claude, Gemini) and cloud providers (AWS, GCP) by the Miasma worm, which seeks to steal environment configuration and authentication data.
Detects anomalous credential exfiltration attempts by GitHub Actions runners. The rule monitors for runner child processes (printenv, env, set) attempting to access sensitive CI/CD variables, or networking tools (curl, wget) transmitting data to unauthorized external endpoints, consistent with Miasma worm behavior.
Detects potential Browser-in-the-Middle (AiTM) credential relay attacks where a user clicks a malicious phishing URL, followed shortly by a successful interactive sign-in from a different IP address and a previously unseen device.
Detects network connection attempts to the cloud Instance Metadata Service (IMDS) endpoint (169.254.169.254) initiated by processes that are not known cloud management agents or system utilities, which may indicate unauthorized credential or IAM role token theft.
Detects successful Device Code authentication followed immediately by a new device registration, a tactic used to extend access via PRT generation.
This rule detects when a non-administrative user grants an application high-privilege OAuth scopes (such as mail reading, file access, or directory management) within an Azure/Microsoft 365 environment. Such consent grants can be used by attackers to maintain persistence and bypass MFA by gaining delegated access to sensitive resources.
Detects unauthorized processes reading, copying, or renaming Kerberos ticket cache files (ccache) located in common temporary directories. This behavior is often associated with credential theft and potential Pass the Ticket attacks where adversaries attempt to extract session credentials to perform lateral movement or privilege escalation.
Page 100 of 206