Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,309 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
299
243
Contributors
1,048
740
503
372
239
Categories
20,445
11,833
5,875
5,151
4,864
4,309
Platforms
2,571
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,348
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects the Havoc Demon payload executing post-exploitation token manipulation APIs (DuplicateTokenEx) to escalate privileges to SYSTEM, specifically when the initiating process originates from the Downloads folder.
Detects accounts with first-time RDP logins to multiple systems (3 or more) within a short time window (30 minutes or less). This behavior is indicative of lateral movement, often seen after initial access via stolen VPN credentials, as observed with the Akira ransomware group.
Detects pythonw.exe accessing multiple distinct browser credential stores within a tight 2-minute window, indicative of information stealer behavior (e.g., Vidar stealer). The rule specifically looks for access to 'Login Data', 'Cookies', 'Web Data', and 'places.sqlite' files.
This rule detects when 'pythonw.exe' performs a high volume of distinct database file reads (5 or more) within a 3-minute window. This behavior is indicative of potential credential harvesting or data exfiltration by malicious Python scripts, as described in the referenced blog post about threat actors using AI hype in social engineering campaigns.
Detects patterns indicative of DPAPI key exfiltration, specifically looking for the strings 'Local State', 'CryptUnprotectData', '/Key', and 'access_token' within a file or process memory. This combination suggests an attempt to decrypt and exfiltrate credentials or tokens.
Detects OAuth token theft via malicious redirect URI manipulation
Detects access to .env files that may contain plaintext credentials
This rule detects suspicious activity involving the creation or update of managed identities and the assignment of highly privileged roles (Contributor, Owner, User Access Administrator) to them. It specifically looks for multiple such assignments within a one-hour window to managed identities associated with automation, runbook, or function resources, indicating potential privilege escalation or malicious access.
Detects the SSH worm component of the isp.sh dropper used in the CVE-2026-33017 Langflow cryptominer campaign. The worm enumerates local SSH private keys (id_rsa, id_ed25519, id_dsa), parses known_hosts, queries SSH_AUTH_SOCK for agent-loaded keys, and spreads via SSH and SCP with BatchMode=yes and StrictHostKeyChecking=no to avoid interactive prompts during lateral movement.
Detects a click originating from a legitimate email or marketing redirection service and ending on a page that requests enterprise credentials. This behavior is indicative of a phishing attempt where an adversary leverages trusted email services to redirect users to a credential harvesting site.
This rule detects repeated access attempts (read or write) to files or directories commonly associated with software build artifacts (e.g., 'build', 'release', 'artifact', 'bin', 'dist'). It specifically looks for Security Event ID 4656, which indicates a handle to an object was requested, and filters out common system accounts to focus on user-initiated access. A high number of access attempts (5 or more) within an hour by a non-system user to these sensitive object names could indicate an attempt to compromise or exfiltrate software supply chain components.
Detects successful user authentications originating from known malicious IP addresses associated with EvilToken infrastructure hosted on Railway.com. This indicates potential compromise via phishing or other credential theft methods.
This rule detects when a user successfully grants five or more OAuth2 permissions within a five-minute window, specifically looking for sensitive scopes such as 'Mail.Read', 'Calendar.Read', 'User.Read.All', or 'Directory.Read.All'. This behavior can indicate an adversary attempting to gain broad access to an organization's data through a compromised application or user account.
Detects rapid non-interactive sign-ins utilizing refresh tokens from known VPS hosting providers. This rule identifies a high volume of successful non-interactive sign-ins (more than 20 within a 10-minute window) from a single user and IP address, indicating potential abuse of refresh tokens, possibly from a compromised cloud VPS.
This rule detects unauthorized access, creation, or modification of browser-specific sensitive credential files (such as 'Login Data' or 'cookies.sqlite') by processes that are not recognized web browsers or trusted update services. This behavior is a common indicator of information-stealer malware attempting to harvest session cookies and stored credentials.
This rule detects command-line activity indicative of encryption key extraction or dumping. It looks for specific keywords like 'dumpkey', 'exportkey', 'savekey', 'keystore', and 'privkey' in the command line of processes such as 'servertool.exe', 'encrypt.exe', 'powershell.exe', and 'cmd.exe'. This activity is often associated with ransomware or other malicious software attempting to exfiltrate cryptographic keys.
Identifies successful device code authentication flows where the client application is masquerading as a Microsoft Office client. This technique is commonly used by Phishing-as-a-Service (PhaaS) kits like EvilTokens for account takeover, by tricking users into authenticating a malicious application through a device code flow.
This rule detects suspicious administrative activities in Azure AD, Microsoft Graph, SharePoint, Exchange, or Teams when performed by accounts that are not explicitly identified as 'admin' or 'service' accounts. It looks for a combination of at least 5 operations and 2 unique operation types within a 2-hour window, targeting group, application, or service principal related resources. This could indicate an attacker using compromised non-privileged accounts to perform administrative actions or escalate privileges.
Detects suspicious process execution patterns associated with the Miasma worm, which attempts to scrape GitHub Actions Runner.Worker process memory to extract masked secrets. This rule looks for specific command-line arguments used by memory dumping tools or scripts targeting the GitHub Actions Runner.Worker process, including `grep` for secret JSON structures, `python` targeting `/proc/pid/mem`, and specific shell pipeline combinations observed in Miasma payloads.
Detects automated API calls listing secrets via GitHub Actions with high pagination, indicating a script enumerating organizational secrets.
Detects unauthorized reading of the GitHub CLI hosts.yml file by processes other than standard development tools (gh, gh.exe, code). This activity could indicate an attempt to steal authenticated GitHub sessions, as the hosts.yml file contains sensitive GitHub authentication tokens.
Page 126 of 206