Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,440
11,814
5,871
5,145
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
Detects high-volume, sustained or burst-like access, download, or deletion activity by a single user across SharePoint, OneDrive, or Exchange services. This behavior is indicative of potential data staging, exfiltration, or bulk malicious activity by a compromised account or insider.
Detects unauthorized access to Discord's Local Storage leveldb files, a technique commonly used by malware like LxBaseRAT to extract Discord authentication tokens.
Detects instances where browser processes or related credential files are accessed or targeted by process termination (e.g., taskkill.exe) followed by attempts to access sensitive files like Login Data, logins.json, or key4.db. This pattern is indicative of credential theft from web browsers.
Detects high-volume filesystem activity (exceeding 300 operations in 5 minutes) initiated by 'claude-code' or 'claude' processes. This behavior may indicate an autonomous, patched, or jailbroken AI coding assistant performing mass file operations or reconnaissance without user confirmation.
Detects high-volume filesystem activity (exceeding 300 operations in 5 minutes) initiated by 'claude-code' or 'claude' processes. This behavior may indicate an autonomous, patched, or jailbroken AI coding assistant performing mass file operations or reconnaissance without user confirmation.
This rule detects potentially malicious file access patterns by the executable 'comet.exe'. It alerts when this process accesses sensitive files or directories associated with credentials, configuration files, or sensitive browser data, while explicitly excluding benign locations such as Chrome data folders and temporary directories.
Detects instances where a process named 'comet.exe' (or 'comet') accesses sensitive file system locations such as Documents, Desktop, Pictures, or system directories like /etc/ or C:\Windows\. This rule excludes known-legitimate installation and application directories associated with Comet software to reduce noise.
Detects the creation of a 'manifest.json' file within a directory path containing 'Extensions' by common web browsers, followed by an immediate file access event from a non-standard browser location within one hour of the installation. This pattern is indicative of the installation of a potentially malicious or sideloaded browser extension followed by anomalous file activity.
Detects instances of the Comet AI agent (comet.exe) accessing files on the local filesystem outside of expected directories such as the browser's download directory, application profile, or temporary folder. This behavior is indicative of a compromised or malicious agent attempting to exfiltrate or interact with arbitrary local files.
Detects the 'Comet.exe' process, associated with the Perplexity Comet AI agent, accessing sensitive system files or configuration directories outside its expected scope. This pattern of file interaction is characteristic of unauthorized data collection or exfiltration attempts, specifically linked to the BragJack threat activity.
This rule detects the process 'ShieldCrash.exe' accessing or interacting with the Windows ELAM (Early Launch Anti-Malware) configuration directory. ELAM drivers are critical components for secure boot and early malware detection; unauthorized access or manipulation by unknown processes may indicate an attempt to tamper with security tools or evade endpoint protection.
Detects access to sensitive credential stores (KeePass databases, Firefox logins, SSH keys, VPN configuration files) by suspicious processes, specifically those associated with potential credential harvesting tools or unauthorized update binaries.
This rule detects potentially malicious activities aimed at credential harvesting and system recovery inhibition. It monitors for the execution of vssadmin.exe with arguments to list shadow copies (often a precursor to deletion) or references to DPAPI master keys in command lines. Additionally, it identifies unauthorized processes attempting to access sensitive browser-based credential files (e.g., Login Data, Cookies, key4.db) from standard browser installation paths, specifically excluding legitimate browser and update processes.
This rule detects potentially malicious activities aimed at credential harvesting and system recovery inhibition. It monitors for the execution of vssadmin.exe with arguments to list shadow copies (often a precursor to deletion) or references to DPAPI master keys in command lines. Additionally, it identifies unauthorized processes attempting to access sensitive browser-based credential files (e.g., Login Data, Cookies, key4.db) from standard browser installation paths, specifically excluding legitimate browser and update processes.
Detects unauthorized processes attempting to access sensitive browser data files, specifically 'Login Data' (passwords) and 'Cookies' for Google Chrome and Microsoft Edge. The rule excludes the browser applications themselves and their update processes to minimize noise.
Detects instances where an unprivileged user executes commands like 'ls -l' or 'stat' on the Parallels dispatcher Unix socket (/var/run/prl_disp_service.socket) specifically when it is world-writable (mode 0777). This behavior indicates an adversary attempting to verify if they can exploit the insecure socket permissions to interact with or hijack the Parallels dispatcher service.
Detects high-frequency file creation, opening, or modification events within the Windows AppData Local Temp directory. This behavior, often involving specific obfuscated file names or known malicious process names, is a common indicator of malware payload staging or execution patterns, such as those observed in AsyncRAT infections.
Detects processes attempting to read the ntdll.dll file directly from the disk, a technique commonly associated with EDR bypass attempts where adversaries map a fresh copy of the library to overwrite hooked syscall functions (e.g., NtAllocateVirtualMemory/NtWriteVirtualMemory) to evade detection. The rule excludes common, legitimate system processes that may legitimately access this file during startup or normal operation.
This rule detects cloud file access (Download, Accessed, or Sync) originating from a Python-based user-agent (python-httpx) associated with specific Microsoft 365 applications, flagged by either an uncommon ISP or an uncommon user-agent for that specific user. This behavior is indicative of potential automated data collection or exfiltration attempts using programmatic access against cloud storage services.
Detects high-volume or large-size file access, download, or preview activity originating from known anonymous proxy IP addresses. This behavior is indicative of potential data exfiltration or unauthorized scraping of sensitive documents from cloud storage.
This rule detects anomalous, high-volume file and email access events by a single user from a single IP address within the Microsoft 365 environment. The detection logic groups operations such as file downloads, file access, and mailbox item access, flagging instances where a user performs 100 or more such operations, which may indicate data exfiltration or compromised account activity.
Page 21 of 76