Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,440
11,814
5,871
5,145
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
Detects potential Remus infostealer activity by monitoring unauthorized processes accessing AI agent credential directories (Claude, Cursor, OpenCode, Codex) or cryptocurrency wallet files, specifically when combined with .lnk shortcut file access behavior.
Detects potential Remus infostealer activity by monitoring unauthorized processes accessing AI agent credential directories (Claude, Cursor, OpenCode, Codex) or cryptocurrency wallet files, specifically when combined with .lnk shortcut file access behavior.
Detects suspicious processes accessing cryptocurrency wallet data files or web browser extension storage folders associated with popular crypto wallets. This behavior is indicative of credential theft or wallet data exfiltration by malware targeting digital assets.
This rule detects unauthorized access attempts by non-browser processes to specific browser extension storage directories. It focuses on directories associated with password managers, 2FA authenticators, and cryptocurrency wallets, as well as core browser credential files (e.g., Login Data, Cookies, logins.json). This behavior is characteristic of info-stealer malware, such as the Remus infostealer, attempting to exfiltrate sensitive data stored by browsers.
Detects a multi-stage, automated attack chain performed by AI-based development agents (e.g., Claude, Copilot, Cursor). The rule correlates process discovery, credential access, file collection (staging), and exfiltration over web services within a tight 15-minute window, identifying potential autonomous exploitation and data exfiltration. Covered T1046, T1552.001, T1078, T1005, T1567
Detects access to sensitive files (KeePass databases, SSH private keys, and VPN configurations) by processes other than their designated applications. This behavior indicates potential credential harvesting or configuration exfiltration by unauthorized processes.
Detects the loading of rstrtmgr.dll by processes other than explorer.exe. Adversaries, particularly ransomware, utilize the Windows Restart Manager API (RmStartSession, RmRegisterResources, RmShutdown) to identify and forcibly terminate processes that hold file handles to files they intend to encrypt, thereby bypassing file-in-use locks.
This rule detects potentially unauthorized access to Microsoft Graph API resources (Mail or Files) following a device-code authentication event for the same user. It identifies scenarios where a previously unknown application client performs read operations within 24 hours of a device-code login, which is characteristic of 'ARToken' or 'EvilProxy' type device-code phishing and session proxy attacks.
Detects the Comet browser process, typically associated with AI-agent operations, accessing sensitive browser profile files (e.g., History, Bookmarks, Login Data, Cookies) followed by outbound network communication within a 15-minute window, excluding known legitimate paths.
Detects the MovieReaper payload behavior where a specific file manager process masquerading as a legitimate system utility (msedge.exe) performs mass file enumeration or access followed by suspicious outbound network connections, indicative of data staging and exfiltration.
Detects anomalous high-volume file access or download activity in Microsoft 365 (SharePoint or OneDrive) by a single user within a 15-minute window, which may indicate bulk data exfiltration.
Detects anomalous high-volume file access or download activity in Microsoft 365 (SharePoint or OneDrive) by a single user within a 15-minute window, which may indicate bulk data exfiltration.
This rule detects non-standard processes attempting to access sensitive web browser files (e.g., 'Login Data', 'Cookies', 'key4.db') that are typically only accessed by legitimate web browsers. It excludes known browser processes and trusted security or sync applications to identify potential credential theft attempts.
This rule detects non-standard processes attempting to access sensitive web browser files (e.g., 'Login Data', 'Cookies', 'key4.db') that are typically only accessed by legitimate web browsers. It excludes known browser processes and trusted security or sync applications to identify potential credential theft attempts.
This rule detects non-browser processes attempting to access sensitive web browser credential files, such as 'Login Data', 'logins.json', and 'key4.db'. Such activity is highly characteristic of credential-stealing malware (including BabylonRAT) attempting to exfiltrate stored passwords or session data from Google Chrome or Mozilla Firefox profiles.
Detects unauthorized processes attempting to access browser credential database files such as Login Data for Chromium-based browsers or logins.json and key4.db for Firefox. The rule filters out known browser processes to isolate potential credential harvesting or exfiltration activity.
Detects instances where an unprivileged user executes commands like 'ls -l' or 'stat' on the Parallels dispatcher Unix socket (/var/run/prl_disp_service.socket) specifically when it is world-writable (mode 0777). This behavior indicates an adversary attempting to verify if they can exploit the insecure socket permissions to interact with or hijack the Parallels dispatcher service.
Detects instances where a service principal or entity identified as an AI agent, bot, or assistant accesses files in SharePoint or OneDrive that are likely to contain sensitive credentials, secrets, or configuration files (e.g., .pem, .pfx, .env, id_rsa).
Detects instances where browser processes (chrome.exe or comet.exe) access multiple files in sensitive or unexpected directories (e.g., System32, /etc/, Documents) without an associated user click event. This activity often indicates potential malicious scripts or automated data collection running within the context of a browser process.
Detects unauthorized access to sensitive browser files, specifically 'Login Data' (passwords) and 'Cookies', by processes other than authorized browser binaries (Chrome or Edge). This is a common indicator of credential harvesting or session hijacking attempts by malware or malicious actors.
This rule detects suspicious process injection activity directed at Chrome or Edge browser processes, followed immediately by file access to sensitive browser data files like 'Login Data' or 'Cookies'. This pattern is indicative of an adversary attempting to steal credentials or session cookies from a user's web browser memory and disk storage.
Page 19 of 76