Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,311 detections
Filters
Last updated
All Time
Detection languages
2,035
733
398
299
243
Contributors
1,048
740
503
372
239
Categories
20,456
11,839
5,876
5,155
4,865
4,311
Platforms
2,572
793
615
382
319
Products / Services
767
740
659
513
348
MITRE Techniques
2,350
917
848
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects suspicious command-line arguments indicative of potential credential access attempts (cmdkey /list), or execution of hidden processes (excluding Java applications), or communication with a known malicious domain (staybud.dpdns.org).
Time-series correlation detecting Pass-The-Hash authentication behavior immediately following the extraction of LSASS memory.
Detects automated programmatic token refreshes (BAV2ROPC) originating from Railway IP space. This rule specifically looks for sign-in logs in Azure Active Directory where the UserAgent contains 'BAV2ROPC' and the IPAddress falls within known Railway PaaS IP ranges.
Detects the deletion of a phishing-resistant authentication method (like FIDO2 security key or passkey) followed by the registration of a weaker authentication method (like a phone authentication method or software OATH token) for the same account. This pattern indicates a potential downgrade attack on an account's authentication security.
Detects new app installations, expansions of OAuth scopes, or the addition of collaborators to Slack applications. These activities can indicate an adversary attempting to gain persistent access, escalate privileges, or exfiltrate data from Slack by leveraging malicious or compromised applications.
Detects MFA factor activation, device enrollment, and password resets originating from residential/commercial proxy infrastructure, often associated with threat groups like BlackFile/UNC6671/Cordial Spider.
Detects anomalous activity associated with Amazon Q processes, including unauthorized access to SSH agent binaries, attempts to read SSH configuration files or keys in ~/.ssh/, and suspicious outbound network connections over port 22, potentially indicating lateral movement.
Detects attempts to invoke 'sudo' for privilege escalation or enumeration from non-interactive contexts such as scripts, scripting language interpreters, or web/application service processes. It also identifies 'sudo -l' or '--list' commands used for privilege enumeration.
Detects the creation or modification of '.amazonq.mcp.json' files associated with the Model Context Protocol (MCP) in VS Code or similar IDE environments, alongside the subsequent spawning of shell interpreters (bash, sh, cmd, powershell, python, npx) from these IDE processes. The rule further flags these events as 'HIGH' priority if the command line references sensitive patterns like AWS credentials or SSH/AWS paths, suggesting potential credential harvesting or unauthorized post-exploitation activity originating from the IDE environment.
Detects instances where the Amazon Q language server or VS Code extension host spawns suspicious child processes, such as shells, interpreters (python, bash, powershell), or utilities commonly used to query or extract AWS cloud credentials.
This rule detects suspicious activities involving AWS CLI or curl commands spawned from IDE-related processes (amazonq-language-server, Code.exe). It monitors for command patterns indicating credential discovery (aws sts get-caller-identity) or data exfiltration (curl POST requests), and correlates these with unusual CloudTrail GetCallerIdentity events occurring from non-AWS source IP addresses.
Detects Vidar Stealer scanning the memory of a forked browser process for the Chromium KeyRing 32-byte pattern using NtReadVirtualMemory and NtQueryVirtualMemory to locate the v20_master_key across MEM_COMMIT and MEM_PRIVATE regions. This behavior is indicative of an information stealer attempting to exfiltrate sensitive browser data.
This rule detects suspicious activities related to SSH credential theft and lateral movement on Linux systems. It monitors for interactive shells or utilities like cat, python, and bash accessing common SSH configuration files (~/.ssh/id_rsa, authorized_keys, etc.), as well as automated SSH/SCP sessions using suspicious configurations (BatchMode=yes, StrictHostKeyChecking=no) or specific malicious payloads.
Detects command line activity indicative of an attempt to access or extract browser-related files such as 'Cookies' or 'Local State', which are commonly associated with session theft or credential harvesting from major web browsers like Chrome, Firefox, Edge, and Safari.
Detects the Lambsys cryptominer malware performing SSH credential harvesting by accessing user SSH keys (known_hosts, authorized_keys, id_rsa) with unauthorized processes, staging these files in temporary or hidden directories, and subsequently initiating outbound SSH connections for lateral movement, all correlated by process group ID.
Detects process executions containing sensitive keywords related to trust, certificates, and multi-factor authentication (e.g., 'mfa', '2fa', 'otp') that are not initiated by standard trusted system processes (services.exe, wininit.exe, smss.exe). This pattern is often indicative of credential manipulation, certificate harvesting, or tampering with authentication mechanisms.
This rule detects shell reconnaissance activities associated with the TeamPCP threat group. Specifically, it looks for commands that parse '/var/log/auth.log' for successful logins or execute 'env | grep AWS_' to find AWS credentials. This behavior is indicative of an attacker attempting to gather authentication information or cloud credentials from a compromised system.
This rule correlates the execution of the VS Code CLI ('code.exe') with the output redirection of a command prompt ('cmd.exe') to a temporary text file. This behavior is indicative of an attempt to scrape authentication codes, potentially for phishing or credential theft, specifically targeting the 'tunnel' functionality of VS Code.
Detects access, copying, or creation of files within common cryptocurrency wallet directories, as well as registry lookups related to Bitcoin data directories. This behavior is often indicative of info-stealing malware or an adversary attempting to exfiltrate digital currency assets from a compromised host.
This rule detects successful OAuth sign-ins originating from a residential proxy IP address, correlated with a successful identity logon event for the same user. This pattern can indicate an adversary using residential proxies to bypass geo-restrictions or blend in with legitimate user traffic while attempting to access accounts via OAuth.
This rule monitors for security alerts related to Azure AI services, specifically detecting credential theft attempts and LLM jailbreak attempts that have been blocked or detected by Azure's built-in content filtering mechanisms.
Page 107 of 206