Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,311 detections
Filters
Last updated
All Time
Detection languages
2,035
733
398
299
243
Contributors
1,048
740
503
372
239
Categories
20,456
11,839
5,876
5,155
4,865
4,311
Platforms
2,572
793
615
382
319
Products / Services
767
740
659
513
348
MITRE Techniques
2,350
917
848
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects unauthorized access to sensitive developer credential files and browser credential stores, typical of the IronWorm Rust-based infostealer. The rule monitors processes that are not known developer or browser tools as they read paths associated with AWS, SSH, Kubernetes, Docker, browser login data, and cryptocurrency wallets.
Detects instances where 'node.exe' accesses browser extension LevelDB directories for Chrome, Edge, or Brave, or executes with suspicious command-line arguments such as 'protocal.cjs', 'NodePackages', or 'nvmconf'. This behavior can indicate attempts to exfiltrate sensitive browser data or establish persistence, potentially associated with supply chain attacks or backdoors.
Detects potential Pass-the-Hash (PtH) activity by identifying NTLM Type 3 logons where the account domain originates from outside the local or known corporate domain. The rule specifically excludes system-related accounts such as ANONYMOUS LOGON, WORKGROUP, and NT AUTHORITY, focusing on attempts to authenticate against internal resources using potentially forged or captured credentials.
Detects the execution of portable Impacket tools ('mini_imp'), including psexec.py, secretsdump.py, and ntlmrelayx.py. This activity is indicative of potential credential harvesting, remote service execution, or NTLM relay attacks, as observed in the MexicanMafia 'Operation Escaneo' campaign.
This rule correlates a sequence of suspicious activities on a single host within a 24-hour window, indicating a multi-stage intrusion typically associated with ransomware campaigns. The detection chain includes initial credential harvesting (using tools like Impacket, BloodHound, or potential agent drops), followed by defense dismantlement (deleting shadow copies, terminating security processes, and disabling the firewall), and ending with system auditing/recovery sabotage.
Detects instances where a node or node.exe process accesses common shell history files (such as .bash_history, .zsh_history, etc.). This behavior is often associated with unauthorized access to command history, which may contain sensitive information like credentials or configuration details.
Detects instances where a Node.js process accesses, modifies, or creates files within web browser extension directories. This behavior is indicative of unauthorized access to sensitive browser data, such as extension configurations, authentication tokens, or stored secrets.
Detects the execution of known forensic imaging tools (FTK Imager or AD Imager) or commands interacting with the Active Directory database (ntds.dit). This behavior is characteristic of unauthorized attempts to extract credential hashes from the NTDS.dit file for offline cracking.
Detects the execution of known forensic imaging tools (FTK Imager or AD Imager) or commands interacting with the Active Directory database (ntds.dit). This behavior is characteristic of unauthorized attempts to extract credential hashes from the NTDS.dit file for offline cracking.
This rule detects processes other than standard web browsers (Chrome, Edge, Brave) attempting to access sensitive directories within Chrome extension user data paths, such as IndexedDB, Local Storage, or Sync Data. Such activity is often indicative of credential or session cookie theft by malicious scripts or malware.
This rule detects potentially malicious activity within Linux environments or containers where a single user context concurrently performs credential hunting (via environment variable dumping or accessing .env files) and terminates processes associated with known cryptocurrency miners or competing malicious actors. This behavior is highly indicative of a cryptojacking infection or a malicious actor clearing out existing resource-hijacking threats.
Detects instances where Node.js or NPM processes (or their parent processes) access sensitive files such as SSH private keys, AWS credentials, environment files, or configuration files containing secrets. This behavior is often associated with infostealers or malicious scripts exfiltrating credentials from developer environments.
Detects instances where a node.exe process accesses files located within directories associated with popular browser-based cryptocurrency wallets. This pattern is commonly observed in infostealer malware campaigns that target wallet seeds, keys, and browser credentials stored in extension local storage or browser profile paths.
Detects node.exe processes accessing sensitive AWS configuration files (credentials, config), .npmrc files, or suspicious data parsing utilities, indicative of the Polymarket Trap npm infostealer attempting to exfiltrate cloud credentials and tokens from developer workstations.
Detects node.exe (Node.js runtime) process initiating file read operations on sensitive files such as SSH keys, AWS credentials, Docker configuration files, GPG keyrings, or package manager configuration files (npmrc/pypirc). This behavior is characteristic of malicious npm packages or infostealers attempting to exfiltrate developer credentials, as observed in the Polymarket Trap supply chain campaign.
Detects unauthorized access or modification attempts to cryptocurrency wallet files (specifically MetaMask and Phantom browser extensions) by non-browser processes. This behavior is indicative of credential theft or wallet exfiltration by malicious software.
Detects malicious activity associated with npm supply chain compromise, including execution of known malicious npm lifecycle scripts, DNS queries to suspected C2 domains, and unauthorized access to sensitive developer credential files (such as .npmrc, .aws/credentials, and SSH keys) by Node.js processes.
Detects instances where JavaScript runtime processes (node, npm) execute specific peer-related or verification scripts and subsequently access sensitive system files or directories, such as SSH configurations, AWS credentials, or browser data, within a 5-minute window.
This rule detects non-standard processes (not identified as common web browsers) accessing browser extension configuration files associated with cryptocurrency wallets (MetaMask or Coinbase Wallet). The rule triggers when a process performs file I/O on multiple distinct extension configuration paths, and the initiating process is associated with build-time or package management tools like Node.js, npm, or Git, which may indicate malicious activity related to supply chain attacks or credential theft from browser storage.
Detects the execution of the TruffleHog tool, which is used for scanning Git repositories and codebases to discover exposed sensitive information, such as API keys and passwords. The rule monitors process execution command lines and filters out common CI/CD and automation service accounts to identify potentially malicious or unauthorized use of the tool on endpoints.
This rule detects when processes other than standard web browsers (Chrome, Edge, Firefox, Brave, Opera) attempt to read sensitive browser data files such as 'Login Data', 'Cookies', or 'Web Data'. These files contain stored credentials and session information, and unauthorized access is a common technique used by credential-stealing malware to exfiltrate sensitive user information.
Page 95 of 206