Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,443
11,831
5,875
5,151
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects the execution of mimikatz.exe or the usage of the sekurlsa::logonpasswords command, both of which are indicative of attempts to extract sensitive credentials from LSASS memory.
Detects unauthorized access to browser-based credential storage files (such as Login Data and cookies) by processes other than recognized browser executables. This behavior is indicative of credential theft or dumping attempts, often performed by malicious software to exfiltrate saved passwords and session cookies.
This rule monitors for processes attempting to enumerate sensitive environment variables related to cloud services (AWS) and AI platforms (Anthropic), or access specific configuration and credential files (e.g., .aws/credentials, .config/anthropic). It specifically correlates these behaviors with potentially suspicious parent processes like bash, node, or python interpreters, which may indicate an AI agent or a reverse shell performing reconnaissance or credential exfiltration.
Detects unauthorized or suspicious attempts to access the memory space of the Local Security Authority Subsystem Service (LSASS) process. The detection logic looks for specific access masks typically used by Mimikatz (0x1010 and 0x1fffff) or execution attempts from binaries renamed to mimic common Mimikatz naming conventions (g.com, hs.com, dump.com). This is intended to identify credential dumping activities.
Detects two distinct suspicious patterns indicative of OAuth consent abuse and browser-based credential theft. The first pattern identifies non-Microsoft script interpreters or binaries initiating network connections to Microsoft's OAuth endpoints. The second pattern identifies unauthorized processes attempting to access or modify sensitive browser data files (e.g., 'Login Data', 'Cookies') which are typically reserved for browser-specific processes.
Detects unauthorized processes attempting to read sensitive browser credential files (Login Data, Cookies, Web Data) from Chrome, Edge, and similar browsers, which is a common post-compromise technique used by infostealer malware to exfiltrate session cookies and stored credentials.
This rule detects shell commands (bash, sh, zsh) initiated by AI-agent or development-related processes (e.g., Python, Claude Desktop, openclaw) that target sensitive macOS paths associated with credentials, SSH keys, crypto wallets, and browser cookies, a technique characteristic of the Atomic Stealer (AMOS) malware.
Detects network connections attempting to access Kubernetes API endpoints related to secrets. This could indicate an adversary trying to enumerate or exfiltrate sensitive credentials from a Kubernetes cluster.
Detects indicators of SSH-based lateral movement and credential access, including suspicious SSH command-line flags (e.g., BatchMode, StrictHostKeyChecking), manual enumeration of SSH keys via ssh-add, inspection of agent socket variables, and unauthorized access to critical SSH configuration and identity files by non-standard processes.
Detects Python processes spawned from development tools (Node.js, VS Code, Cursor) that perform suspicious file access to browser credential stores (e.g., Login Data, cookies.sqlite) and subsequently initiate significant outbound network POST requests, characteristic of browser-based credential harvesting and exfiltration.
Detects potential credential harvesting attempts by monitoring for the usage of Windows credential management tools (cmdkey.exe and vaultcmd.exe) and the loading of sensitive DLLs (vaultcli.dll, dpapi.dll) by non-Microsoft signed processes, which is commonly used to access stored credentials in the Windows Vault or by DPAPI-protected stores.
This rule detects attempts to extract credentials from FortiGate devices by targeting specific management API endpoints. It looks for HTTP GET requests to '/api/v2/cmdb/' followed by paths like 'system/admin', 'vpn.ssl.settings', or 'user/local', which are known to contain sensitive configuration or user data. This activity is associated with the 'FortiBleed' campaign and CVE-2026-24858.
This rule detects processes running from suspicious temporary directories (e.g., AppData, Windows Temp) that load 'user32.dll' and subsequently create or write to log files in user or application directories. This behavior is highly indicative of keylogging, where malware hooks input functions via user32.dll and stores captured data in local log files for later exfiltration.
Detects suspicious activities originating from SimpleHelp remote support processes, including the spawning of unauthorized child processes, execution of potentially malicious JavaScript loaders (e.g., TaskWeaver-related), and access to sensitive browser-based credential or configuration files often targeted by infostealers like Djinn Stealer.
Detects anomalous or unauthorized processes accessing sensitive AI configuration files, SSH configurations, version control files, and shell history within a short time window. The rule flags instances where non-standard or unexpected applications exhibit broad or high-frequency access to these files, which are common targets for credential harvesting or exfiltration by adversaries.
Detects evidence of Djinn Stealer malware activity, including unauthorized access to web browser credential stores, suspicious child process creation by the SimpleHelp RMM daemon, and network communication with a known command-and-control server (96.126.130.126:58942) using a specific telemetry client user agent.
Detects unauthorized processes, such as TaskWeaver implants or scripts (node.exe, wscript.exe, cscript.exe) running from non-standard directories (e.g., %TEMP%, %APPDATA%), attempting to access web browser credential databases. This behavior is indicative of post-exploitation credential harvesting, specifically linked to Djinn Stealer activity following CVE-2026-48558 exploits.
This rule detects potential AS-REP Roasting activity by monitoring for a single source IP address requesting Kerberos TGTs (Event ID 4768) for multiple distinct user accounts within a 10-minute window. This behavior often indicates an attacker attempting to identify and harvest Kerberos pre-authentication hashes from accounts that do not require pre-authentication, which can then be cracked offline.
Detects instances where common scripting runtimes (Python, Node.js) or development-related parent processes (e.g., VS Code, npm) access sensitive cloud credential or configuration files (AWS, Google Cloud, Azure). This behavior may indicate an adversary or an unauthorized script attempting to exfiltrate or leverage stored cloud credentials from an developer workstation.
Detects access to 'wallet.dat' files (commonly associated with cryptocurrency wallets) by processes with misleading or suspicious names running from user AppData directories. This behavior is indicative of credential theft or malware attempting to exfiltrate digital assets.
Detects the creation of a 'BackupFiles' directory and the subsequent copying of sensitive browser artifacts (e.g., Login Data, Web Data, Local Storage) within Chrome or Edge user data paths. This activity is indicative of credential and session theft staging, specifically associated with the ToddyCat group's Umbrij malware preparation for browser exploitation.
Page 80 of 206