Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,311 detections
Filters
Last updated
All Time
Detection languages
2,035
733
398
299
243
Contributors
1,048
740
503
372
239
Categories
20,456
11,839
5,876
5,155
4,865
4,311
Platforms
2,572
793
615
382
319
Products / Services
767
740
659
513
348
MITRE Techniques
2,350
917
848
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects the LokiBot information stealer by identifying its characteristic aPLib compressed payloads, specific C2 URI patterns, known C2 infrastructure, and credential theft routines targeting applications like 1Password, Keepass, and WinBox.
Detects anomalous activity associated with information stealing malware, including unauthorized access to browser credential files (Login Data, Cookies), remote thread injection into browser processes, outbound connections to the Telegram API by non-browser processes, and rapid bulk access to multiple sensitive credential or crypto wallet files.
Detects unauthorized processes attempting to access Outlook or Windows Messaging Subsystem profile registry keys. This behavior is indicative of infostealer malware, such as StealC, attempting to harvest stored email client credentials.
Detects execution of the macOS 'security' utility to harvest generic or internet passwords from the Keychain, a technique commonly associated with the AMOS (Atomic macOS Stealer) infostealer for credential theft.
Detects anomalous AWS API activity following a console login where the API calls originate from a different IP address within 10 minutes, potentially indicating the replay of stolen session tokens captured via Adversary-in-the-Middle (AiTM) techniques.
Detects Event 5136 where msDS-KeyCredentialLink is added to an AD object, indicative of Shadow Credentials abuse via Whisker/DSInternals. The rule filters out MSOL_ sync accounts and computer-to-computer self-writes to reduce false positives.
Detects anomalous post-compromise activity associated with Browser-in-the-Browser (BitB) attacks or general credential theft. Specifically, it monitors for browser processes spawning suspicious child processes (e.g., cmd.exe, powershell.exe, mshta.exe) that are typically used for payload delivery, and unauthorized access to browser-stored credential files (e.g., 'Login Data') by non-browser processes.
Detects modifications to the WDigest UseLogonCredential registry key, which enables the caching of plaintext credentials in LSASS memory. This is a common post-exploitation technique used to facilitate credential theft.
Detects the modification of the WDigest registry key 'UseLogonCredential' to 1. This configuration forces the Windows LSA process to store plaintext credentials in memory, significantly facilitating credential harvesting techniques such as those employed by Mimikatz.
Detects artifacts associated with the Remcos RAT keylogger, specifically the creation or modification of 'logs.dat' within 'AppData\Roaming\DT' and the registration of a 'WH_KEYBOARD_LL' hook via 'SetWindowsHookEx' API calls, which is indicative of keylogging functionality.
This rule detects suspicious sign-in patterns indicative of an EvilTokens-style Microsoft Device Code OAuth phishing attack. It identifies successful device code flow sign-ins where Multi-Factor Authentication (MFA) was not applied or satisfied, suggesting an adversary has bypassed MFA using a stolen device code. The rule aggregates these suspicious sign-ins by user, listing associated applications, IP addresses, and locations for analyst review.
Detects suspicious user agents associated with Tycoon2FA phishing-as-a-service (PHaaS) attacks, specifically targeting Microsoft 365 accounts via device code phishing. The rule identifies 'axios/1.13.x' (credential relay variant) and 'node/undici' (device code variant) user agents in Azure AD sign-in logs where the original transfer method is 'deviceCodeFlow', and the device is neither managed nor compliant, and the sign-in token protection status is unbound.
Detects instances where processes not associated with standard web browsers (e.g., node.exe) attempt to create, modify, or rename browser-related sensitive files, specifically cookie databases and DPAPI-protected Local State files. Such activity is often indicative of credential and session cookie theft.
Detects unauthorized processes, other than established web browsers, attempting to read, access, or copy sensitive browser data files (such as 'Login Data', 'cookies.sqlite', or 'key4.db') that store user credentials, cookies, and web history.
Detects Amadey loader executing its credential-theft plugin (cred.dll) via rundll32.exe with the Main export, triggered by Amadey backdoor command 0x15 after downloading cred.dll from the C2 /Plugins/ path.
Detects bash processes executing commands that combine AWS identity verification with outbound exfiltration using curl. The pattern specifically monitors for the use of 'aws sts get-caller-identity' followed by an immediate HTTP POST transmission of data (indicated by '-d @-'), which is characteristic of attackers exfiltrating captured cloud environment metadata or temporary credentials.
Detects instances where common development runtime processes (e.g., node, python, shells) spawn child processes whose command lines contain references to sensitive credential environment variables such as AWS access keys, GitHub tokens, or SSH authentication sockets. This behavior often indicates that a developer or an automated tool is insecurely passing credentials via command-line arguments to subprocesses.
Detects processes attempting to read or open sensitive SSH files (keys and configuration) that are not recognized as legitimate SSH-related utilities (e.g., ssh, sshd, rsync, git). This behavior is often indicative of credential harvesting or unauthorized reconnaissance of authentication artifacts.
Detects Python processes attempting to read sensitive credential files (Login Data, Cookies, logins.json, key4.db) from Chrome, Firefox, and Edge directories. This behavior is indicative of the InvisibleFerret infostealer, which targets browser-stored credentials on compromised developer workstations.
Detects Python-based processes accessing sensitive local cryptocurrency wallet files and directories, including MetaMask extension storage, Exodus wallet, and Bitcoin wallet files, which are known targets of the InvisibleFerret infostealer.
Detects Python or Node.js processes reading sensitive SSH private key files (id_rsa, id_ed25519) followed by an outbound network connection within a one-minute window. This behavior is indicative of credential theft and exfiltration, such as that observed in the InvisibleFerret campaign.
Page 99 of 206