Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,311 detections
Filters
Last updated
All Time
Detection languages
2,035
733
398
299
243
Contributors
1,048
740
503
372
239
Categories
20,456
11,839
5,876
5,155
4,865
4,311
Platforms
2,572
793
615
382
319
Products / Services
767
740
659
513
348
MITRE Techniques
2,350
917
848
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects when common web browsers (chrome.exe, msedge.exe, brave.exe, electron.exe) access local files that appear to contain sensitive credentials, secrets, tokens, or API keys based on file naming conventions and directory structures.
Detects when common web browsers (chrome.exe, msedge.exe, brave.exe, electron.exe) access local files that appear to contain sensitive credentials, secrets, tokens, or API keys based on file naming conventions and directory structures.
Detects read access to cryptocurrency wallet files and application directories (including Electrum, Exodus, Atomic, and generic wallet.dat files) by non-wallet associated processes. This behavior is consistent with credential harvesting activities by info-stealing malware such as StealC.
Detects unauthorized file access to browser extension directories and credential stores (History, Login Data) by a suspicious Node.js process named 'protocal.cjs'. This activity is characteristic of the 'easy-day-js' supply chain compromise, where a malicious backdoor attempts to exfiltrate browser-stored credentials and history from Chrome, Edge, and Brave browsers.
Detects unexpected network connections initiated by the Local Security Authority Subsystem Service (lsass.exe) to the localhost (127.0.0.1) on ports other than standard SMB ports (445 or 139). LSASS should typically only communicate locally via RPC or LPC for authentication services, and anomalous network activity from this process may indicate credential theft attempts, process injection, or unauthorized memory access activities.
Detects file operations (creation, modification, deletion, renaming) involving common SSH key files (id_rsa, id_ed25519) or files located within .ssh directories, initiated by processes typically associated with AI/LLM tools (chatgpt, perplexity, etc.) or generic process names. This may indicate an attempt to exfiltrate or manipulate authentication credentials by unauthorized applications.
Detects unauthorized processes attempting to read sensitive application data directories (specifically for Telegram and Discord) on macOS. This behavior is indicative of infostealer malware, such as AMOS (Atomic macOS Stealer), attempting to exfiltrate session tokens and account information.
Detects the use of osascript to spawn fake macOS system dialogs that mimic legitimate 'System Preferences' prompts to harvest user login passwords. This activity often involves AppleScript dialog commands combined with dscl authonly checks to validate the stolen credentials.
This rule detects file access or modification events targeting '.env' files, which often store environment variables and sensitive configuration data (such as API keys and credentials). The detection specifically focuses on file paths associated with CI/CD build agents, runners, or workspace directories (e.g., github, gitlab, jenkins, build, runner), where such credentials are high-value targets for attackers seeking to escalate access or pivot within an environment.
Detects instances where the Local Security Authority Subsystem Service (lsass.exe) initiates a network connection to the loopback address (127.0.0.1 or ::1), excluding standard SMB traffic (Port 445). Such behavior by LSASS is highly anomalous and may indicate exploitation attempts, such as memory dumping or credential harvesting techniques involving inter-process communication.
Detects command-line activity indicative of the PetitPotam exploit or general EFSRPC (Encrypting File System Remote Protocol) coercion attempts. Adversaries use these techniques to force a machine to authenticate against another system (e.g., a domain controller), typically as a precursor to NTLM relay attacks.
This rule detects file access or modification events targeting '.env' files, which often store environment variables and sensitive configuration data (such as API keys and credentials). The detection specifically focuses on file paths associated with CI/CD build agents, runners, or workspace directories (e.g., github, gitlab, jenkins, build, runner), where such credentials are high-value targets for attackers seeking to escalate access or pivot within an environment.
Detects the use of Azure VM Run Command to execute PowerShell scripts that attempt to retrieve workload identity tokens from the Azure Instance Metadata Service (IMDS) endpoint. This activity could indicate an attacker attempting to steal credentials or escalate privileges within the Azure environment.
Detects repeated RDP connection attempts to port 3389 from a single source within a short timeframe, characteristic of brute force or password spraying activity. The rule monitors for consecutive TLS ClientHello or MCS Connect-Initial packets.
Detects SMB authentication attempts using NTLM with a blank Lan Manager (LM) hash. This specific pattern is often associated with Pass-the-Hash attacks where tools inject malformed or blank hashes to initiate authentication, a common indicator of lateral movement attempts.
This rule detects multiple Network Level Authentication (NLA) negotiation attempts targeting port 3389 from a single source within a 60-second window, which is indicative of an RDP brute-force attack.
Detects cross-tenant service principal authentications that leverage blueprint-derived identities. This rule specifically looks for client_credentials grant types using client_assertion (JWT bearer) or client_secret targeting sensitive scopes like 'api://AzureADTokenExchange/.default' or 'AgentIdentity.CreateAsManager' from a foreign tenant service principal. This activity could indicate an attempt to establish persistence or gain unauthorized access across Azure AD tenants.
This rule detects suspicious attempts by non-browser processes to access Google Chrome's process memory or create threads within it. This behavior is often indicative of process injection techniques used by malware to hook into or extract data from the browser, potentially for credential theft or session hijacking. The rule specifically looks for API calls like OpenProcess, NtCreateProcessEx, CreateRemoteThread, NtReadVirtualMemory, and ReadProcessMemory targeting 'chrome.exe' by processes other than Chrome itself or its legitimate update/driver executables.
Detects Vidar Stealer attempting to access virtual memory of Chrome, Edge, or Brave processes to locate the v20_master_key, which is used to bypass Application-Bound Encryption. This rule also identifies suspicious browser process creations with specific command-line arguments that might indicate stealer activity.
Detects credential theft activity associated with VAPT (Vulnerability Assessment and Penetration Testing) frameworks, specifically looking for AI-generated payloads indicated by markers like 'VAPTb3gin', 'VAPTfin', and '__VAPTCMD__'. This rule also mentions 'SmartRAT' and 'Rokarolla' as key indicators, suggesting the use of specific tools or techniques often employed in such activities.
This rule detects when an application role assignment or delegated permission grant is successfully added to a service principal in Azure Active Directory, specifically looking for highly privileged permissions such as 'RoleManagement.ReadWrite.Directory', 'UserAuthenticationMethod.ReadWrite.All', 'UserAuthMethod-TAP.ReadWrite.All', or 'User.Read.All'. This could indicate an adversary attempting to gain elevated access or persistence within the Azure AD environment.
Page 111 of 206