Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,440
11,814
5,871
5,145
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
Detects anomalous AI-assisted activity where multiple processes (specifically AI developer tools) appear to be chaining operations by writing to and reading from shared local directories (e.g., 'handoff', 'artifacts') followed by network requests to known AI service APIs. This pattern may indicate automated task chaining or unauthorized exfiltration of context/code to AI platforms.
Detects AI coding assistants and LLM agent frameworks attempting to access, read, or export sensitive credential files, registry hives, or application secrets. The rule monitors both file system operations on known secret locations and process execution patterns indicative of credential dumping or API token retrieval by these tools.
Detects the behavior of LunexStealer targeting cryptocurrency wallets. The rule monitors for the enumeration of known crypto wallet files and browser-stored extension data, followed closely by the creation of a 'wallet.zip' archive by the same process, which is indicative of staged data collection for exfiltration.
Detects the behavior of LunexStealer targeting cryptocurrency wallets. The rule monitors for the enumeration of known crypto wallet files and browser-stored extension data, followed closely by the creation of a 'wallet.zip' archive by the same process, which is indicative of staged data collection for exfiltration.
Detects unauthorized processes accessing the 'ConsoleHost_history.txt' file across user profiles. This behavior is indicative of ransomware operators or malicious actors attempting to harvest stored credentials, tokens, or sensitive command-line history before performing lateral movement or privilege escalation.
Detects instances where common scripting or development language runtimes (Go, Node.js, WScript, CScript) access sensitive configuration or credential files, such as AWS credentials, Kubernetes configs, SSH keys, or environment files. This activity is often indicative of credential harvesting or unauthorized access to sensitive secrets by potentially malicious scripts or processes.
Detects a specific attack chain attributed to ClosedQuorum, involving LSASS memory dumping, subsequent access to browser-based credential stores or cryptocurrency wallet files, and finally staging the stolen data in C:\Windows\Temp\ within a short time window.
Detects the Sckit Go implant accessing sensitive local configuration and credential files, including SSH keys, cloud CLI tokens, and package manager credentials. The rule monitors for file read events initiated by processes identified as 'sckit' or processes with specific command line arguments.
Detects the Sckit Go implant accessing sensitive local configuration and credential files, including SSH keys, cloud CLI tokens, and package manager credentials. The rule monitors for file read events initiated by processes identified as 'sckit' or processes with specific command line arguments.
Detects the Sckit Go implant accessing sensitive local configuration and credential files, including SSH keys, cloud CLI tokens, and package manager credentials. The rule monitors for file read events initiated by processes identified as 'sckit' or processes with specific command line arguments.
Detects the Sckit Go implant accessing sensitive local configuration and credential files, including SSH keys, cloud CLI tokens, and package manager credentials. The rule monitors for file read events initiated by processes identified as 'sckit' or processes with specific command line arguments.
Detects potential insider threats or departing employees by correlating abnormal bulk data downloads from cloud repositories (SharePoint/OneDrive/Box/etc.) with subsequent sensitive data access and exfiltration signals. It uses baseline behavioral profiling, requires a threshold of sensitive file interactions, and mandates high-confidence exfiltration indicators (removable media usage, suspicious external domains, or multiple combined destination events) to reduce noise. Archive/staging activity is used as an optional confidence booster.
This rule detects when a user or service account accesses or downloads a high volume of files from SharePoint or OneDrive that match sensitive keywords such as 'password', 'secret', 'credential', or specific file extensions like '.pem', '.pfx', and '.env'. This behavior is indicative of an attempt to harvest credentials, API keys, or configuration secrets from cloud storage repositories.
Detects anomalous file access patterns by Semantic Kernel agent processes attempting to read sensitive host files such as SSH keys, configuration files, and credential stores. This activity is indicative of malicious use of agent file-transfer capabilities, potentially exploiting path traversal vulnerabilities or prompt injection to exfiltrate sensitive data from the host environment into the agent sandbox.
Detects anomalous file access patterns by Semantic Kernel agent processes attempting to read sensitive host files such as SSH keys, configuration files, and credential stores. This activity is indicative of malicious use of agent file-transfer capabilities, potentially exploiting path traversal vulnerabilities or prompt injection to exfiltrate sensitive data from the host environment into the agent sandbox.
Detects a sequence of events consistent with credential dumping of sensitive Windows registry hives (SAM, SYSTEM, SECURITY). The attack involves querying shadow copies using vssadmin, creating a symbolic link to the shadow copy volume via mklink, and copying the hive files from that location. Cleanup attempts using rmdir are also monitored.
This rule monitors for suspicious interactions with Android device drivers via the 'getevent' utility, often used to capture raw input, combined with unusual file access patterns involving 'locateValues.json' and potential data exfiltration attempts to specific internal API endpoints.
Detects unauthorized access to web browser credential stores (e.g., Login Data, Cookies) by non-browser processes, such as scripting engines (PowerShell, WScript) or common LOLBins (MSBuild, InstallUtil). This behavior is indicative of credential theft or data exfiltration attempts by malicious software, including stealers like PureLog.
Detects access to sensitive cryptocurrency wallet files (e.g., wallet.dat, keystore) by processes typically associated with LOLBins (Living-off-the-land Binaries) like PowerShell, MSBuild, or non-executable utilities. This activity is indicative of credential theft or data staging for exfiltration of cryptocurrency assets.
Detects anomalous, mass-access behavior targeting plaintext credential files, certificate stores, private keys, or password-manager databases located on general-purpose network shares. Such activity is often indicative of an adversary conducting discovery or collection of credentials for lateral movement and privilege escalation.
Detects instances where a process not associated with standard web browsers accesses, copies, or modifies sensitive browser files such as cookies, local storage, or session tokens. This behavior is highly indicative of information-stealer malware (e.g., Vidar, Lumma, RedLine) attempting to exfiltrate session data for account hijacking.
Page 10 of 76