Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,437
11,828
5,871
5,150
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects evidence of the Rapuncel infostealer attempting to compromise Chrome or Edge browsers. The rule identifies suspicious image loads into browser processes linked to known malicious hashes or the creation of specific browser decryption log files used by the malware to defeat App-Bound encryption.
Detects evidence of the Rapuncel infostealer attempting to compromise Chrome or Edge browsers. The rule identifies suspicious image loads into browser processes linked to known malicious hashes or the creation of specific browser decryption log files used by the malware to defeat App-Bound encryption.
Detects suspicious account management activities, such as password resets or MFA re-enrollment, performed by an operator on a high-privileged or administrator account outside of typical business hours (06:00-20:00). This behavior is often indicative of help-desk impersonation or credential takeover attempts targeting Identity Provider (IdP) administrative roles.
Detects the use of legitimate data transfer utilities (s5cmd, rclone) configured to exfiltrate sensitive document types (.doc, .pdf, .sql, etc.) to S3-compatible cloud storage. The rule correlates this activity with recent access to files containing sensitive credentials or configuration data, a pattern observed in double-extortion campaigns.
Detects the use of legitimate data transfer utilities (s5cmd, rclone) configured to exfiltrate sensitive document types (.doc, .pdf, .sql, etc.) to S3-compatible cloud storage. The rule correlates this activity with recent access to files containing sensitive credentials or configuration data, a pattern observed in double-extortion campaigns.
Detects an suspicious progression of activities originating from identified AI assistant/agent processes. The rule monitors for a chain of behaviors occurring within a 15-minute window: execution of an AI agent/tool, followed by host discovery (network/system enumeration), access to sensitive local credential files, archival of data, and outbound network communication to common file-sharing/exfiltration platforms.
Detects an suspicious progression of activities originating from identified AI assistant/agent processes. The rule monitors for a chain of behaviors occurring within a 15-minute window: execution of an AI agent/tool, followed by host discovery (network/system enumeration), access to sensitive local credential files, archival of data, and outbound network communication to common file-sharing/exfiltration platforms.
Detects anomalous, rapid enumeration of system, network, process, and software configuration settings by AI coding assistant processes (e.g., Claude, Cursor, ChatGPT). This behavior often signifies an AI agent being coerced or configured to perform environment discovery or credential gathering, indicating potential compromise or abuse of the LLM-integrated development environment.
Detects AI coding assistants and LLM agent frameworks attempting to access, read, or export sensitive credential files, registry hives, or application secrets. The rule monitors both file system operations on known secret locations and process execution patterns indicative of credential dumping or API token retrieval by these tools.
Detects outbound HTTP POST requests to a URI path '/google.php' containing suspicious parameters 'do=login&user=' and '&pass='. This pattern is indicative of credential exfiltration activities commonly associated with the FlowerStorm campaign.
Detects suspicious process command lines that access sensitive cryptocurrency wallet data files or registry keys associated with wallet applications, which is a common behavior of information-stealing malware.
Detects the execution of known browser credential harvesting tools (WebBrowserPassView, WebBrowserBookmarksView, or WS_Password variants) from ScreenConnect temporary directories. This behavior often indicates post-compromise activity where an adversary uses an existing Remote Monitoring and Management (RMM) session to extract credentials from browsers.
Detects the execution of known browser credential harvesting tools (WebBrowserPassView, WebBrowserBookmarksView, or WS_Password variants) from ScreenConnect temporary directories. This behavior often indicates post-compromise activity where an adversary uses an existing Remote Monitoring and Management (RMM) session to extract credentials from browsers.
Detects the execution of known browser credential harvesting tools (WebBrowserPassView, WebBrowserBookmarksView, or WS_Password variants) from ScreenConnect temporary directories. This behavior often indicates post-compromise activity where an adversary uses an existing Remote Monitoring and Management (RMM) session to extract credentials from browsers.
This rule detects a credential theft pattern where a browser process is forcefully terminated using taskkill, followed shortly by the creation of a 'wd_tmp.db' file in browser user data directories. This behavior is indicative of malware attempting to stage and exfiltrate browser credentials like cookies and login data.
Detects the behavior of LunexStealer targeting cryptocurrency wallets. The rule monitors for the enumeration of known crypto wallet files and browser-stored extension data, followed closely by the creation of a 'wallet.zip' archive by the same process, which is indicative of staged data collection for exfiltration.
Detects the behavior of LunexStealer targeting cryptocurrency wallets. The rule monitors for the enumeration of known crypto wallet files and browser-stored extension data, followed closely by the creation of a 'wallet.zip' archive by the same process, which is indicative of staged data collection for exfiltration.
Detects the ingestion of sensitive credentials (API keys, passwords, private keys) into a RAG (Retrieval-Augmented Generation) document store, followed by the retrieval of those credentials by an application agent, indicating potential credential harvesting within the LLM application pipeline.
Detects Active Directory Directory Replication Service (DRSUAPI) GetNCChanges requests originating from a principal or host that is not recognized as a Domain Controller. This behavior is indicative of unauthorized DCSync operations used to dump NTDS.dit hashes, a common technique for credential harvesting associated with ransomware actors like Qilin.
Detects a specific pattern of Windows API calls consistent with PIVOTPIPE C2 activity, involving process token impersonation (OpenProcessToken, DuplicateTokenEx, ImpersonateLoggedOnUser, or SetThreadToken) followed by a RevertToSelf call. The rule correlates these events within a single process, identifies artifacts related to PIVOTPIPE loader/payloads, and ensures the sequence completes within a short time window.
Detects two suspicious Kerberos activity patterns indicative of potential credential theft or reconnaissance: 1) A single account requesting tickets for multiple services or across multiple hosts in a short duration, which may indicate automated credential harvesting such as Kerberoasting; 2) The use of RC4 encryption (0x17) for Kerberos tickets, which is an older, weaker protocol and may indicate a forced downgrade attack to facilitate offline password cracking.
Page 25 of 206