Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,311 detections
Filters
Last updated
All Time
Detection languages
2,035
733
398
299
243
Contributors
1,048
740
503
372
239
Categories
20,453
11,838
5,876
5,154
4,865
4,311
Platforms
2,572
793
615
382
319
Products / Services
767
740
659
513
348
MITRE Techniques
2,350
917
848
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects unauthorized non-browser processes attempting to access sensitive credential and session cookie files associated with major web browsers such as Chrome, Edge, and Firefox. This behavior is indicative of credential harvesting techniques often utilized by infostealer malware, including variants of the Millenium RAT, to extract stored passwords and session tokens.
Detects attempts by unsigned processes to read or modify sensitive web browser credential files (Login Data or logins.json) typically used by Google Chrome, Microsoft Edge, and Mozilla Firefox. This behavior is indicative of credential dumping or information stealing activities by unauthorized or malicious software.
Detects the CastleLoader Python process rapidly scraping Chromium SQLite databases (Login Data, Cookies) to steal stored credentials and session cookies. The rule identifies Python processes accessing multiple browser credential/session databases within a one-minute window.
This rule detects network events where a device attempts to access the Kubernetes API '/api/v1/namespaces/*/secrets' endpoint. This activity could indicate an attempt to enumerate or exfiltrate sensitive information (secrets) stored within Kubernetes, potentially by an attacker who has gained initial access to a pod or compromised a service account.
Detects suspicious child process activity originating from common IDEs or AI language server processes that indicates AWS credential exfiltration. The rule monitors for command-line patterns indicative of credential dumping or exfiltration, such as the use of AWS CLI commands, curl, or npx with the Model Context Protocol (MCP) in conjunction with attempts to access sensitive environment variables or redirect output.
Detects unauthorized processes (Python, Node.js) accessing sensitive files such as browser login data, cookie stores, wallet files, and SSH/AWS keys, which are common indicators of credential theft and data exfiltration.
Detects anomalous activity associated with information stealing malware, including unauthorized access to browser credential files (Login Data, Cookies), remote thread injection into browser processes, outbound connections to the Telegram API by non-browser processes, and rapid bulk access to multiple sensitive credential or crypto wallet files.
Detects instances where Python or Node.js processes access common cloud provider credential files (e.g., AWS, GCP, Azure). This behavior is often associated with infostealer campaigns, such as the 'Contagious Interview' campaign, where adversaries attempt to harvest stored cloud credentials for further compromise.
Detects instances where scripting or development processes (e.g., node.exe, python.exe, code.exe) access sensitive SSH private key files or PEM files, followed by an immediate outbound network connection to a non-private IP address within 60 seconds. This activity is indicative of credential exfiltration or unauthorized use of stolen keys.
This rule detects scenarios where development tools such as VS Code (Code.exe) or npm spawn multiple child processes of Python or Node.js interpreters within a short time window, followed by those same interpreters accessing sensitive credential files (e.g., SSH keys, browser login data, or cloud configuration files). This pattern is indicative of a developer workstation compromise or a supply chain attack involving malicious code execution.
Detects the execution of Rubeus or Mimikatz with command-line arguments indicative of Kerberos attacks such as Pass the Ticket (PtT) or Golden Ticket generation. This rule specifically looks for keywords like 'rubeus ptt', 'kerberos::ptt', 'kerberos::golden', and 'mimikatz kerberos' in process command lines.
Detects a network-connected Linux process exhibiting beaconing behavior (high-frequency external connections) that is subsequently correlated with unauthorized file access to sensitive Linux configuration files (/etc/passwd, /etc/shadow, or authorized_keys). This rule filters out common system processes and standard management binaries, targeting suspicious command-and-control activity combined with credential theft.
Detects access to cached domain credentials in the SECURITY registry hive
This rule detects potentially malicious activity involving the CredentialUIBroker.exe process or the use of SetWindowsHookEx API calls. These behaviors are often associated with attempts to intercept user input or dump credentials from system processes.
Identifies geographic impossible travel where the device code was requested in one country and successfully authenticated from another within minutes. This rule looks for a single AccountUpn having activity from two or more distinct locations within a 10-minute window.
This rule detects persistent Microsoft 365 access established by an attacker using OAuth refresh tokens, typically following a device_code phishing attack. It correlates three key events: initial device_code sign-ins from non-compliant or non-managed devices, the subsequent consent to a new OAuth application (likely attacker-controlled) from the same user and within a short timeframe, and finally, Microsoft Graph mail API access originating from that newly registered application. This sequence indicates an adversary has successfully phished a user, gained consent for a malicious application, and is now using it to access the user's mailbox data.
This rule detects potential MFA bypass via stolen session cookies by identifying successful single-factor authentications from new or unmanaged/non-compliant devices, especially when originating from a new geographical location for the user or exhibiting medium/high sign-in risk. It correlates impossible travel, new device, and lack of MDM/EDR compliance signals.
This rule detects the use of 'sshpass' in conjunction with specific command-line arguments that indicate automated SSH logins. It specifically looks for the presence of '/sshpass/' and '/StrictHostKeyChecking=no/' in the command line, combined with common administrative account names like 'psoft', 'oracle', or 'linuxadm'. This activity is often associated with lateral movement techniques, as observed in attacks like those by ShinyHunters targeting Oracle/PeopleSoft environments.
This rule detects attempts by common scripting or utility processes (like osascript, curl, zsh, bash, sh, python) to access sensitive macOS files, specifically targeting browser data (Chrome, Brave, Firefox) and keychain files. This activity could indicate an attacker attempting to exfiltrate credentials, session tokens, or other sensitive user data.
This rule detects HTTP POST requests containing common credential field names directed at files ending in .php (such as login.php, result.php, or index.php), which is highly characteristic of phishing kits used to harvest credentials.
Detects anomalous credential access behavior in Azure Key Vault where a single identity performs more than 20 secret, key, or certificate read/list operations within a 5-minute window. This behavior is indicative of potential unauthorized reconnaissance or exfiltration of secrets stored in Key Vaults, excluding known automation service principals.
Page 90 of 206