Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,443
11,831
5,875
5,151
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
This rule monitors Azure Key Vault operations, specifically focusing on unauthorized or excessive retrieval of secrets, keys, or certificates. It triggers when a specific user or service principal makes 10 or more requests for unique assets within a 10-minute window, which may indicate automated discovery, mass exfiltration, or a brute-force attempt to harvest credentials stored within the vault.
Detects a Google Workspace OAuth application grant and application-specific password issuance occurring within 30 minutes of a suspicious/AiTM-flagged sign-in, indicating Gmail account takeover.
Detects potential credential theft attempts targeting macOS Keychain. It identifies the use of the 'security' utility with commands like 'dump-keychain' or 'find-generic-password' and monitors for unauthorized processes accessing files within the 'Library/Keychains' directory.
This rule detects potentially unauthorized access or memory dumping attempts against the Local Security Authority Subsystem Service (LSASS) process. It monitors for events where processes interact with LSASS or execute commands containing 'lsass.exe', 'MiniDump', or 'comsvcs.dll', while excluding known administrative and benign processes like Task Manager, Procdump, and Windows Error Reporting.
This rule detects instances where a process that is not a recognized web browser attempts to access sensitive files associated with browser credential stores, such as Login Data, Cookies, and web browser state files. Such activity is commonly associated with infostealer malware, which attempts to exfiltrate saved passwords, session cookies, and autofill information.
Detects credential and token harvesting behaviors associated with the ChainDrop/Shai-Hulud 2.0 npm worm, specifically targeting CI/CD environments. The rule monitors for unauthorized access to /proc/[pid]/mem to scrape memory for workflow secrets, extraction of OIDC environment variables, and suspicious invocation of the GitHub CLI (gh) to steal authentication tokens.
Generic rule content from file: Translated CQL Rule
Detects HTTP requests to known UNC6671 AiTM reverse-proxy phishing kit IPs on MFA/OTP interception URI paths (push-tap, duo-push, oauth2 2fa, community verify), indicating live MFA bypass.
Detects a shell/interpreter process spawned by a VS Code / VS Code-Insiders editor process that references CI marker environment variable names (GITHUB_, GITHUB_REPOSITORY, GITLAB_CI_, CI_PROJECT_PATH), matching how malicious Open VSX 'evil twin' extensions harvested CI/CD environment variables from GitHub, GitLab, and Azure DevOps runners.
Detects a potential account takeover scenario where a user receives a password reset notification email followed within 10 minutes by a non-SSO application password change from the same IP address. This sequence is characteristic of Adversary-in-the-Middle (AiTM) phishing or vishing campaigns where an attacker intercepts session tokens or uses social engineering to force a password reset and immediately secures the account for persistent access.
This rule detects unauthorized or suspicious access to SSH private key files (id_rsa, id_rsa.pub) located in .ssh directories by common scripting or application processes (python.exe, node.exe, Code.exe). This behavior is indicative of credential theft, where an adversary attempts to extract SSH keys to facilitate lateral movement or persistence.
This rule detects hosts exhibiting behavior consistent with an active ransomware or destructive attack in progress, by correlating five distinct attack-chain stages within a rolling 24-hour window: environment/AD enumeration, network share discovery, lateral movement via RDP, credential dumping, and backup/recovery destruction.
This rule detects potential credential theft activity where a process spawning a command-line interpreter (bash, sh, zsh) using 'curl' simultaneously accesses sensitive browser configuration or credential directories on MacOS, such as Chrome, Firefox, or Safari application support paths. This pattern is indicative of an adversary attempting to exfiltrate browser-stored secrets.
Detects process activity referencing GitHub Actions, GitLab CI, or Azure DevOps pipeline environment variable names (GITHUB_*, CI_*, GITHUB_ACTIONS, GITLAB_CI, Azure DevOps pipeline variables) consistent with a malicious extension harvesting CI/CD runner environment variables.
This rule detects macOS infostealer activity, such as AMOS, MacSync, or SHub, by identifying suspicious, correlated access to sensitive credential stores including the macOS Keychain, web browser credential databases (Chrome), SSH keys, and cryptocurrency wallet configuration files. It uses a combination of path/command-line strings and generic indicators of credential harvesting behavior.
This rule detects PowerShell execution patterns indicative of fileless information stealer activity. It searches for specific command-line flags often associated with obfuscated or hidden script execution (e.g., -EncodedCommand, -nop -w hidden, IEX) combined with attempts to access or target sensitive files and tokens (e.g., Cookies, Login Data, msal.cache, AAD.BrokerPlugin) common in Microsoft 365 and browser-based credential theft.
This rule detects potentially malicious activity against accounts classified as having a high blast radius. It correlates three stages of behavior: observed failed authentication attempts (brute force) against a high-blast-radius account, a password reset for that same account, and a subsequent successful logon outside of standard business hours (using Logon Types 3 or 10). The rule uses a password reset event as the mandatory anchor and flags suspicious sequences of events leading up to or following this change.
This rule detects potentially unauthorized access or memory dumping attempts against the Local Security Authority Subsystem Service (LSASS) process. It monitors for events where processes interact with LSASS or execute commands containing 'lsass.exe', 'MiniDump', or 'comsvcs.dll', while excluding known administrative and benign processes like Task Manager, Procdump, and Windows Error Reporting.
This rule detects potential credential stuffing or brute force attacks against a SonicWall VPN device. It identifies scenarios where a single source IP experiences multiple failed authentication attempts within a 15-minute window, followed by at least one successful authentication on the same destination host.
This rule detects unauthorized or suspicious file access, modification, or creation events targeting sensitive web browser data files, including login credentials, saved passwords, and browser cookies. These files are prime targets for information-stealing malware attempting to harvest sessions or authentication data.
Detects the creation of an LSASS memory dump file (lsass*.dmp) initiated by Task Manager (taskmgr.exe) within Temp or user directories. This behavior often indicates an adversary or unauthorized user leveraging the Task Manager 'Create dump file' feature to dump process memory for credential harvesting.
Page 64 of 206