Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,311 detections
Filters
Last updated
All Time
Detection languages
2,035
733
398
299
243
Contributors
1,048
740
503
372
239
Categories
20,456
11,839
5,876
5,155
4,865
4,311
Platforms
2,572
793
615
382
319
Products / Services
767
740
659
513
348
MITRE Techniques
2,350
917
848
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
This rule detects potential credential harvesting activity associated with the Hannibal Stealer. It looks for non-standard processes (processes other than the browsers themselves) that access sensitive browser credential stores (like 'Login Data', 'cookies.sqlite', or 'key4.db') and correlate these file access events with the loading of 'bcrypt.dll' or 'CefSharp.BrowsersSubprocess.dll', which are often used for decryption or browser automation/sub-processes during credential theft.
This rule detects when non-FileZilla processes attempt to read or access sensitive FileZilla configuration files, specifically 'recentservers.xml' or 'sitemanager.xml', which are known to store plain-text credentials for site connections. This behavior is indicative of credential harvesting.
Detects the use of the AWS CLI to extract Secrets Manager values and potentially STS tokens, writing them to local text files in the /tmp directory. This activity is indicative of an attacker attempting to exfiltrate credentials or sensitive information.
Detects potential clipboard harvesting behavior indicative of information stealers like StealC. The rule monitors for processes executing from suspicious, user-writable directories (e.g., AppData, Temp) that perform clipboard access operations while lacking typical interactive process characteristics.
Detects behavior indicative of the AMOS (Atomic macOS) infostealer, where a malicious process uses 'osascript' to display a fake System Preferences password prompt to the user and then attempts to validate the harvested credentials using 'dscl -authonly'.
Detects unauthorized access to Chrome and Firefox browser credential (Login Data, logins.json, key4.db) and cookie database files on macOS by non-browser processes, commonly observed in credential theft campaigns like ClickFix.
This rule detects potential adversary-in-the-middle (AiTM) activity targeting FortiGate firewalls, specifically looking for internal authentication traffic (LDAP, Kerberos, LDAPS, MS-SQL) originating from a firewall management IP. The rule triggers if there are 5 such connections within 60 seconds, indicating a possible listening post or attempt to intercept credentials.
Detects the use of the native Windows Backup utility (wbadmin.exe) to initiate a backup that specifically includes the Active Directory database file (ntds.dit). This behavior is characteristic of an attempt to perform offline Active Directory credential dumping by creating a backup of the database to an accessible location.
Detects execution of psql.exe with command line arguments containing 'VeeamBackup' and 'credentials', which may indicate an attempt to access or extract credentials from a PostgreSQL database associated with Veeam Backup software.
Detects unauthorized attempts to access or interact with the Veeam Backup database, including psql.exe direct queries, PowerShell scripts attempting to decrypt credentials using DPAPI, and encoded PowerShell commands launched from cmd.exe that target the Veeam environment.
Identifies unauthorized attempts to leverage ssh-add or access the SSH agent socket to dump or forward local developer identities.
Detects unauthorized changes to the admin or vmanage-admin user credentials on Cisco SD-WAN Manager. The rule monitors for 'usermod', 'passwd', or AAA password commit commands within the 'vmanage-admin' user context. It specifically identifies a 'change-and-revert' pattern, where the attacker changes a password to gain access and immediately reverts it to evade detection, elevating the risk to critical.
Detects potential unauthorized browser extension installations or debugging activities by monitoring process and network events related to popular web browsers.
Detects remote SMB access (Event ID 5145) to sensitive file paths where credentials are commonly stored, including DPAPI master keys, browser profiles, cloud provider configuration directories, and password manager data. This activity often indicates unauthorized credential discovery and staging during lateral movement or post-compromise reconnaissance.
Detects the use of 'osascript' to display credential prompts or 'dscl' with authentication-related arguments, which could indicate an attempt to phish user credentials or enumerate/create accounts on macOS systems.
Detects Vidar Stealer attempting to enumerate browser processes (chrome.exe, msedge.exe, brave.exe) using the CreateToolhelp32Snapshot API call, often followed by Process32First/Next, to target memory for data exfiltration. The rule looks for processes initiating these API calls that are not common system or legitimate debugging tools.
Detects sign-ins by Global Administrators using a Temporary Access Pass (TAP) to the Azure Portal. This activity is indicative of potential credential abuse, especially in cross-tenant scenarios, as TAP can bypass MFA. The rule identifies instances where a Global Administrator role is assigned or where a user with 'globaladmin' in their UPN signs in with a TAP.
This rule detects suspicious file read or access events on common cryptocurrency wallet application folders (Electrum, Coinbase, Exodus), specific wallet files (wallet.dat), or browser extension folders associated with MetaMask. The rule specifically excludes legitimate access by the wallet applications themselves or common browsers to reduce false positives, indicating that an unauthorized process might be attempting to access sensitive cryptocurrency data.
This rule detects attempts by non-browser processes to access sensitive browser files such as 'Login Data', 'Cookies', 'Web Data', 'logins.json', 'cookies.sqlite', 'formhistory.sqlite', and 'places.sqlite'. These files often contain credentials, session tokens, and browsing history. Legitimate browser processes are excluded from this detection to reduce false positives. This activity could indicate an attempt to steal user credentials or session information.
Detects attempts to access macOS Keychain items using 'osascript' executed from common shell processes. This activity can indicate an adversary attempting to steal credentials or other sensitive information stored in the Keychain.
Detects rapid access (three or more distinct files within a 60-second window) to sensitive files typically containing credentials or configuration data (e.g., SSH keys, AWS credentials, environment files, container configurations). This pattern is often associated with credential dumping or reconnaissance activity by an adversary attempting to harvest secrets.
Page 101 of 206