Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,311 detections
Filters
Last updated
All Time
Detection languages
2,035
733
398
299
243
Contributors
1,048
740
503
372
239
Categories
20,456
11,839
5,876
5,155
4,865
4,311
Platforms
2,572
793
615
382
319
Products / Services
767
740
659
513
348
MITRE Techniques
2,350
917
848
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects Node.js processes executing command-line arguments related to the collection of sensitive configuration files, credentials, and identity tokens from systems, such as Git configurations, SSH keys, NPM credentials, and Docker tokens. This behavior is indicative of an automated reconnaissance or credential harvesting phase in an attack.
This rule detects cross-process memory access events (Sysmon Event ID 10) where a process attempts to hook into keyboard-related Windows API functions such as SetWindowsHookEx, GetKeyState, or GetAsyncKeyState. It further filters for processes executing from suspicious locations (Temp, AppData, ProgramData) or those that are unsigned/unverified, which are common indicators of malicious keylogging or spyware activity.
This rule detects instances where a Node.js process accesses sensitive files associated with web browsers (e.g., Login Data, Cookies) or SSH keys (e.g., id_rsa). This behavior is often indicative of credential theft or unauthorized data collection, where an adversary uses legitimate tooling like Node.js to stage or exfiltrate sensitive local files.
This rule detects suspicious attempts to access macOS Keychain credentials using the 'security' command-line utility or 'osascript'. It specifically looks for 'security' commands attempting to find generic or internet passwords, unlock keychains, or target browser-specific safe storage keys (Chrome, Brave, Microsoft Edge). It also flags 'osascript' processes accessing Keychain paths. The rule excludes legitimate system and browser processes to reduce false positives.
Detects instances where a process not associated with standard SSH operations (e.g., ssh, scp, git) accesses SSH private key files, followed by an outbound network connection to a non-private IP address within a 5-minute window. This behavior is indicative of credential theft and subsequent exfiltration of sensitive SSH keys, often associated with infostealer malware.
Detects instances where a process not associated with standard SSH operations (e.g., ssh, scp, git) accesses SSH private key files, followed by an outbound network connection to a non-private IP address within a 5-minute window. This behavior is indicative of credential theft and subsequent exfiltration of sensitive SSH keys, often associated with infostealer malware.
This rule detects a process initiated by Node.js or NPM performing a DNS lookup for known malicious domains while simultaneously accessing sensitive local files such as SSH keys, AWS credentials, browser cookies, browser login data, or bash history. This pattern is indicative of a post-compromise activity where an adversary leverages a JavaScript runtime to perform credential theft and communicate with C2 infrastructure.
This rule detects when a Node.js process accesses sensitive files associated with SSH configurations, private keys, or package manager credentials (such as .npmrc or .pypirc). Such behavior is highly unusual for legitimate web application processes and may indicate an attacker attempting to steal credentials or secrets from a compromised system.
This rule detects multiple failed logon attempts (more than 5 within a 5-minute window) for user accounts from a single IP address. This behavior is indicative of a brute-force attack or password guessing attempt against user accounts.
This rule detects multiple attempts by a user account to perform a Directory Synchronization (DirSync) operation, which is a common indicator of a DCSync attack. The rule specifically looks for Event ID 4662 with properties containing 'DS-DirSync' or '131072', filters for user accounts, excludes known service accounts, and triggers if there are 5 or more attempts from the same account and computer.
This rule detects potential AS-REP Roasting activities by monitoring process creations for the Rubeus toolset (using the asreproast command) and PowerShell scripts executing commands related to AS-REP Roasting (Get-ASREPHash or asreproast). This technique is used by adversaries to extract Kerberos TGTs for accounts with Kerberos pre-authentication disabled, allowing for offline password cracking.
This rule monitors process-related logs for specific XGU-prefixed function strings related to access token manipulation and lateral movement, such as token stealing, impersonation, and privilege/UID gathering. The detection looks for these indicators within command line and additional process metadata.
Detects the presence of strings associated with the SPECTRALVIPER backdoor in process command lines. These strings correspond to RTTI class names and methods related to its XGU::Feature token theft and impersonation capabilities, specifically targeting functionality for lateral movement and credential manipulation.
Detects sign-ins from additional IP ranges associated with Kali365 infrastructure and proxies, which could indicate token replay attacks or other unauthorized access attempts.
Detects AstarionRAT's infostealing capability rapidly accessing multiple Chromium and Firefox SQLite databases to steal credentials and cookies.
This rule detects processes accessing registry keys associated with common cryptocurrency wallets (e.g., Electrum, Exodus, MetaMask, Ledger) that are not the legitimate wallet applications themselves. This behavior is indicative of unauthorized attempts to extract sensitive wallet information, such as configuration, seeds, or keys, stored in the Windows Registry.
Detects access to sensitive GCP credential-related files or the presence of credential-related environment variables/secrets in command lines and network request bodies. This pattern is often associated with the theft of service account keys or environment-based cloud credentials, frequently seen in serverless or containerized environments.
This rule detects unauthorized or suspicious write operations to Linux Pluggable Authentication Modules (PAM) configuration files or shared libraries. PAM controls authentication for various system services; unauthorized modification of these files is a common technique used by attackers to establish backdoors, bypass authentication mechanisms, or harvest credentials. The rule excludes common system package management utilities to reduce noise.
Detects when common web browsers (chrome.exe, msedge.exe, brave.exe, electron.exe) access local files that appear to contain sensitive credentials, secrets, tokens, or API keys based on file naming conventions and directory structures.
Detects NTLM-authenticated network logons (Logon Type 3) originating from loopback IP addresses (127.0.0.1, ::1, or 0.0.0.0). This behavior is often associated with NTLM relay attacks or credential reflection bypass techniques where an adversary forces a local service to authenticate to itself to gain unauthorized access.
Detects instances where privileged system processes such as lsass.exe or svchost.exe attempt a network connection to the local loopback address on ports other than standard SMB ports (445, 139). This pattern is indicative of potential coercion or relay attacks, specifically targeting the authentication mechanisms of these services to an attacker-controlled SMB server.
Page 110 of 206