Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,440
11,814
5,871
5,145
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
Detects unauthorized processes attempting to access sensitive Mozilla Firefox profile files such as cookies.sqlite, places.sqlite, and permissions.sqlite. These files contain sensitive information including cookies, history, and permission settings. Access by processes other than the legitimate Firefox executable may indicate credential theft, data exfiltration, or reconnaissance activities.
Detects file operations (open, read, write, rename) involving common sensitive credential files (e.g., .kdbx password databases, .ovpn and .pcf configuration files, .pem, and .ssh directory contents) by processes not authorized to interact with these files.
Detects unauthorized processes attempting to access sensitive browser files, including Login Data (passwords) and Network/Cookies databases for Chrome, Edge, and Firefox. These files are primary targets for credential dumping and session hijacking.
Detects anomalous, high-volume file access or download activity in Microsoft SharePoint Online or OneDrive for Business originating from a 'python-httpx' user agent. This pattern often indicates automated data collection or exfiltration attempts using programmatic tools.
Detects a specific attack chain attributed to ClosedQuorum, involving LSASS memory dumping, subsequent access to browser-based credential stores or cryptocurrency wallet files, and finally staging the stolen data in C:\Windows\Temp\ within a short time window.
Detects a specific attack chain attributed to ClosedQuorum, involving LSASS memory dumping, subsequent access to browser-based credential stores or cryptocurrency wallet files, and finally staging the stolen data in C:\Windows\Temp\ within a short time window.
Detects a specific attack chain attributed to ClosedQuorum, involving LSASS memory dumping, subsequent access to browser-based credential stores or cryptocurrency wallet files, and finally staging the stolen data in C:\Windows\Temp\ within a short time window.
Detects suspicious file create or write operations within the domain SYSVOL Policies directory. This pattern is commonly associated with attackers attempting to deploy malicious payloads, such as ransom notes or configuration changes, via Group Policy Objects (GPO). The rule monitors Windows Event ID 4663 to identify unauthorized modification attempts by non-system accounts.
Detects access to sensitive browser credential storage files (Login Data, key4.db, logins.json) by unauthorized processes. This behavior is indicative of credential theft, where an adversary attempts to extract stored passwords from browser profiles.
Detects access to sensitive browser credential storage files (Login Data, key4.db, logins.json) by unauthorized processes. This behavior is indicative of credential theft, where an adversary attempts to extract stored passwords from browser profiles.
Detects high-volume file/directory enumeration behavior by the PlugX side-loaded process GRrte.exe, consistent with PlugX's use of FindFirstFileW/FindNextFileW/FindFirstFileExW for file and directory discovery (T1083).
Detects post-infection data harvesting behavior associated with PureLogs Stealer. The rule monitors specific LOLBins (.NET binaries) and suspected masqueraded payloads (e.g., syscall.exe) as they attempt to access browser credential, cookie, or web data files from Google Chrome, Microsoft Edge, and Mozilla Firefox. It also tracks the creation of these suspicious processes when invoked by scripting interpreters like PowerShell, wscript, or cscript.
Detects the creation of a Volume Shadow Copy followed by an attempt to access or copy sensitive files, specifically the NTDS.dit database or the SYSTEM registry hive, from that shadow copy. This behavior is indicative of an attempt to perform offline credential theft.
Detects Node.js or ProfileQuickHost processes performing file operations (read, write, rename) on sensitive browser directories, such as 'Local Extension Settings' or wallet-related folders. This pattern is commonly observed in credential-stealing malware attempting to extract browser-stored secrets or cryptocurrency wallet data.
Detects access to sensitive cryptocurrency wallet files (wallet.dat, seed phrases, keys) or the execution of Python processes from sensitive or commonly exploited directories (AppData, tmp, Public folders) associated with known malicious naming conventions (sys_service).
Enumerates installed Chrome extensions, cross-references against public blocklists, and flags suspicious permissions.
Detects high-volume filesystem activity (exceeding 300 operations in 5 minutes) initiated by 'claude-code' or 'claude' processes. This behavior may indicate an autonomous, patched, or jailbroken AI coding assistant performing mass file operations or reconnaissance without user confirmation.
Detects the creation of a Volume Shadow Copy followed by an attempt to access or copy the Active Directory database file (ntds.dit) from the shadow copy. This pattern is commonly used by adversaries to perform offline credential dumping.
Detects high-volume file access or download activity by a single user in SharePoint or OneDrive over a 15-minute window. This behavior is indicative of bulk cloud data exfiltration often associated with extortion campaigns.
This rule detects potentially unauthorized access or downloading of files from SharePoint and OneDrive, as well as specific MailItemsAccessed events associated with known exfiltration toolkit patterns within Microsoft 365. It flags individual events matching these criteria as a baseline for identifying suspicious data access behaviors.
This rule detects potential credential theft by monitoring for file access (creation, modification, or renaming) to common web browser sensitive files (Login Data or Cookies) followed by an outbound network connection from the same process within a 10-minute window. This behavior often indicates an adversary attempting to exfiltrate browser-stored credentials or session cookies.
Page 16 of 76