Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,437
11,828
5,871
5,150
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects evidence of the SCKit supply chain worm within GitHub Actions CI pipelines. The rule identifies attempts to poison the build process by injecting a BASH_ENV path into GITHUB_ENV, which forces the execution of a malicious script (sckit-publish-bridge.sh) during subsequent shell steps. This script is designed to exfiltrate npm publishing credentials (NODE_AUTH_TOKEN) to external infrastructure. The detection logic covers both the injection mechanism and diagnostic output indicators from the bridge script.
Detects unauthorized attempts to access sensitive Veeam Backup and Replication credentials by querying the backend SQL database or directly accessing DPAPI Master Key files. This activity is indicative of an attacker attempting to decrypt backup credentials stored by the Veeam service.
Detects the execution of known NTLM Certificate Enrollment Service (CES) relay tools alongside subsequent outbound network connections to Active Directory Certificate Services (AD CS) CES enrollment endpoints. This behavioral pattern indicates an adversary attempting to relay NTLM authentication to an AD CS server to request a certificate, typically for privilege escalation or persistence.
Detects anomalous access to SharePoint or OneDrive by identities identified as bots, agents, or service principals. The rule specifically monitors for multiple file accesses where the file names suggest the presence of secrets, passwords, or API keys, which may indicate a compromised or malicious AI agent attempting to harvest credentials.
Detects Node.js or NPM process executions that reference Twilio-specific credential variables (ACCOUNT_SID, AUTH_TOKEN) within the command line, likely indicating an attempt to harvest these secrets from a developer environment.
Detects suspicious post-compromise activity associated with ALPHV/BlackCat affiliates. This rule monitors for anomalous Kerberos ticket requests (e.g., weak encryption types or TGS requests) closely followed by access to sensitive credential stores or tools on the same host, which is indicative of credential harvesting after a session hijacking or initial access event.
Detects the 'Credential Guard.exe' process (associated with AgtaBackup RAT) accessing sensitive browser files (Login Data, Cookies, History, Bookmarks) and subsequently exfiltrating data to a specific C2 endpoint.
Detects anomalous credential access behavior by identifying instances where a compromised explorer.exe process (injected with the Kothamine payload DLL MicrosoftEdgeUpdateCore.dll) accesses browser cookie stores and gaming credential files in quick succession.
Detects anomalous credential access behavior by identifying instances where a compromised explorer.exe process (injected with the Kothamine payload DLL MicrosoftEdgeUpdateCore.dll) accesses browser cookie stores and gaming credential files in quick succession.
Detects anomalous credential access behavior by identifying instances where a compromised explorer.exe process (injected with the Kothamine payload DLL MicrosoftEdgeUpdateCore.dll) accesses browser cookie stores and gaming credential files in quick succession.
Detects high-volume SSH authentication attempts originating from a single source IP targeting a server on port 22, indicating a potential brute force attack.
This rule detects unauthorized attempts to perform a DCSync attack by monitoring for Active Directory Event ID 4662. It triggers when an account that is not a recognized domain controller (which typically end with a '$' sign) successfully requests replication data using the Directory Replication Service (DRS) GetNCChanges rights. This behavior is a common indicator of credential dumping via tools like Mimikatz.
Detects the Sckit supply chain implant reading sensitive credential files from a user's home directory. The rule monitors processes spawned by Node.js or Python interpreters (the primary loaders for the Sckit worm) attempting to access high-value files like SSH keys, .npmrc, .pypirc, and various token storage files, indicating potential credential harvesting behavior.
This rule detects potential Kerberoasting activity by identifying an abnormal volume of RC4-encrypted Ticket Granting Service (TGS) requests (Event 4769) targeting service accounts, followed closely by a successful logon (Event 4624) from a previously dormant service account, suggesting the successful use of a cracked service ticket for unauthorized authentication.
Detects the creation of files containing AI provider API keys within the /root/.hermes/loot/ directory, consistent with credential harvesting behavior observed by the CARBONATO GH0ST agent.
Detects the deployment of the CARBONATO botnet's Hermes Agent within containerized environments. The rule identifies specific artifacts such as the 'SOUL.md' persona configuration, 'netd-svc' container references, and indicators of AI-focused credential theft (e.g., searching for OpenAI or Anthropic API keys) orchestrated by the GH0ST AI agent.
Detects the use of the 'getevent' utility on Android/Linux systems to monitor and capture raw input events from '/dev/input'. This technique is often used by mobile malware to perform keylogging by intercepting touch or physical keystroke event streams, bypassing standard application-level input handling.
The FileFix→StealC payload chain (Facebook-security-alert lure, Acronis/HivePro 2026 reporting) harvests browser-stored credentials, cookies, and session data as its primary objective.
The FileFix→StealC payload chain (Facebook-security-alert lure, Acronis/HivePro 2026 reporting) harvests browser-stored credentials, cookies, and session data as its primary objective.
Detects unauthorized processes attempting to read or copy sensitive browser data files (e.g., Cookies, Login Data, Local Storage) often targeted by info-stealing malware such as Vidar, LummaC2, or RedLine. The rule filters out legitimate browser-related processes and adds security context by requiring evidence of unsigned code, execution from suspicious locations (Temp/Downloads), or associated outbound network activity to reduce false positives.
Detects unauthorized processes attempting to read or copy sensitive browser data files (e.g., Cookies, Login Data, Local Storage) often targeted by info-stealing malware such as Vidar, LummaC2, or RedLine. The rule filters out legitimate browser-related processes and adds security context by requiring evidence of unsigned code, execution from suspicious locations (Temp/Downloads), or associated outbound network activity to reduce false positives.
Page 16 of 206