Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,311 detections
Filters
Last updated
All Time
Detection languages
2,035
733
398
299
243
Contributors
1,048
740
503
372
239
Categories
20,456
11,839
5,876
5,155
4,865
4,311
Platforms
2,572
793
615
382
319
Products / Services
767
740
659
513
348
MITRE Techniques
2,350
917
848
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects instances where a Node.js process accesses sensitive shell history files (e.g., .bash_history, .zsh_history) or the PowerShell PSReadLine history file (ConsoleHost_history.txt). Such activity may indicate an attempt by a malicious script or attacker to harvest credentials or commands stored in shell history.
Detects node.exe or node process accessing sensitive SSH private key files or configuration files. This behavior is indicative of unauthorized credential harvesting by malicious npm packages or infostealer malware like Miasma/MYRA attempting to exfiltrate developer secrets.
Detects instances where a Node.js process accesses or interacts with common web browser credential files, such as 'Login Data', 'Cookies', or 'key4.db'. This behavior is characteristic of credential-stealing malware or unauthorized collection scripts targeting browser-stored data.
Detects Node.js processes (node, npm, npx) accessing or modifying '.npmrc.bak' or '.npmrc' files located within 'node_modules' directories. This activity is indicative of credential theft, specifically targeting potentially active npm authentication tokens that might have been inadvertently backed up or exposed within project directories.
This rule detects potential brute force attacks against Active Directory accounts by identifying multiple failed login attempts (EventID 4625) from the same IP address to the same account within a short time frame (10 failed attempts within 10 minutes).
This rule detects a high volume of access attempts (10 or more within an hour) by a single user to sensitive system directories such as 'Admin' or 'System32'. This behavior could indicate an adversary performing file and directory discovery, attempting to access sensitive files, or staging for further malicious activity.
Detects Node.js processes accessing sensitive configuration files such as .npmrc (npm authentication tokens) or .docker/config.json (docker registry credentials). This rule filters for activity within npm lifecycle script contexts (e.g., preinstall, postinstall hooks), which is a common technique used in software supply chain attacks to exfiltrate credentials.
Detects Node.js processes (node, npm) attempting to access sensitive files typically associated with web browser extensions, cryptocurrency wallets, or stored secrets. This activity is indicative of credential theft or data exfiltration attempts.
Detects instances where a node.exe process accesses common configuration, credential, or authentication files. Adversaries may leverage Node.js scripts or malicious applications to exfiltrate sensitive data such as SSH keys, AWS credentials, Docker configurations, or git configurations.
Detects node.js processes accessing sensitive configuration files, SSH keys, browser login databases, and other credential stores. This activity is indicative of malicious transitive dependencies within the npm ecosystem attempting to exfiltrate credentials during module initialization, even when top-level install scripts are restricted.
Detects instances where processes other than legitimate browser-related binaries access sensitive SQLite database files (Login Data and Cookies) associated with Google Chrome or Microsoft Edge. This activity is a common indicator of credential theft by malicious tools or scripts attempting to extract stored passwords or session cookies.
This rule detects potential clipboard data theft by monitoring Windows Sysmon Event ID 10 for process access events involving clipboard-related APIs (OpenClipboard, GetClipboardData) by untrusted processes, and PowerShell Script Block Logging (Event ID 4104) for the use of Get-Clipboard cmdlets. This identifies attempts by non-standard or unauthorized processes to access sensitive information copied by a user.
Detects instances where processes other than legitimate browser-related binaries access sensitive SQLite database files (Login Data and Cookies) associated with Google Chrome or Microsoft Edge. This activity is a common indicator of credential theft by malicious tools or scripts attempting to extract stored passwords or session cookies.
Detects instances where processes other than legitimate browser-related binaries access sensitive SQLite database files (Login Data and Cookies) associated with Google Chrome or Microsoft Edge. This activity is a common indicator of credential theft by malicious tools or scripts attempting to extract stored passwords or session cookies.
Detects a successful self-service password reset for a privileged or high-value account when the initiating context does not match an approved helpdesk workflow. This could indicate an attacker attempting to gain access to an account by resetting its password without proper authorization.
This rule detects infostealer activity involving desktop screenshot capture and clipboard monitoring, which are common tactics used by the StealC infostealer family to harvest sensitive information. The detection triggers when known StealC binaries execute or when native Windows utilities like the Snipping Tool or PSR are launched by suspicious parent processes associated with this malware.
Detects node.js processes spawned from npm postinstall hooks accessing developer credential files including .gitconfig, .npmrc, and GitHub CLI token files, consistent with the Operation Friday Harvest infostealer campaign targeting Claude Code, GitHub CLI, and npm tokens via malicious npm packages.
This rule detects activities related to Operation Escaneo, specifically focusing on the creation, modification, or access to cleartext credential harvesting files (e.g., vpn-passwords.txt) and the execution of associated Python scripts (forti_login2.py, forti_login3.py) used for credential staging and extraction on FortiGate systems.
This rule detects when non-FileZilla processes attempt to read or access sensitive FileZilla configuration files, specifically 'recentservers.xml' or 'sitemanager.xml', which are known to store plain-text credentials for site connections. This behavior is indicative of credential harvesting.
This rule detects the execution of common Active Directory enumeration and exploitation tools, specifically Impacket (secretsdump, getuserspns, ntlmrelayx) and BloodHound/SharpHound, by monitoring Windows Sysmon process creation events for known file names and command-line arguments.
This rule detects suspicious SAP RFC (Remote Function Call) activity, including the execution of OS commands via SXPG_CALL_SYSTEM, usage of custom ZREDTEAM command interfaces, and the presence of scripts or indicators related to SAP credential extraction (e.g., password hash access).
Page 113 of 206