Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,440
11,814
5,871
5,145
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
Detects anomalous activity originating from PostgreSQL processes, including the spawning of shells (cmd, powershell, sh, bash), access to sensitive files (e.g., /etc/shadow, SSH keys), and file creation outside the standard PostgreSQL data directories, which is consistent with the abuse of SQL functionality like pg_read_file() or lo_export().
Detects attempts to access or create copies of the Active Directory 'ntds.dit' database or the Windows Security Account Manager (SAM) registry hive using unauthorized processes. Attackers often target these files to extract credential hashes from Domain Controllers or local systems.
Detects instances where an unprivileged user executes commands like 'ls -l' or 'stat' on the Parallels dispatcher Unix socket (/var/run/prl_disp_service.socket) specifically when it is world-writable (mode 0777). This behavior indicates an adversary attempting to verify if they can exploit the insecure socket permissions to interact with or hijack the Parallels dispatcher service.
Detects instances where an unprivileged user executes commands like 'ls -l' or 'stat' on the Parallels dispatcher Unix socket (/var/run/prl_disp_service.socket) specifically when it is world-writable (mode 0777). This behavior indicates an adversary attempting to verify if they can exploit the insecure socket permissions to interact with or hijack the Parallels dispatcher service.
Detects instances where an unprivileged user executes commands like 'ls -l' or 'stat' on the Parallels dispatcher Unix socket (/var/run/prl_disp_service.socket) specifically when it is world-writable (mode 0777). This behavior indicates an adversary attempting to verify if they can exploit the insecure socket permissions to interact with or hijack the Parallels dispatcher service.
This rule detects the process 'ShieldCrash.exe' accessing or interacting with the Windows ELAM (Early Launch Anti-Malware) configuration directory. ELAM drivers are critical components for secure boot and early malware detection; unauthorized access or manipulation by unknown processes may indicate an attempt to tamper with security tools or evade endpoint protection.
This rule detects the process 'ShieldCrash.exe' accessing or interacting with the Windows ELAM (Early Launch Anti-Malware) configuration directory. ELAM drivers are critical components for secure boot and early malware detection; unauthorized access or manipulation by unknown processes may indicate an attempt to tamper with security tools or evade endpoint protection.
Detects rapid, bulk cloning or downloading of GitHub repositories containing sensitive data (e.g., consensus algorithms, PII, internal blocklists). This behavior is characteristic of unauthorized data exfiltration, specifically tracking activity involving suspicious OAuth token prefixes (gho_) and rapid high-volume access to sensitive organizational assets within a short timeframe.
Detects rapid, bulk cloning or downloading of GitHub repositories containing sensitive data (e.g., consensus algorithms, PII, internal blocklists). This behavior is characteristic of unauthorized data exfiltration, specifically tracking activity involving suspicious OAuth token prefixes (gho_) and rapid high-volume access to sensitive organizational assets within a short timeframe.
Detects rapid, bulk cloning or downloading of GitHub repositories containing sensitive data (e.g., consensus algorithms, PII, internal blocklists). This behavior is characteristic of unauthorized data exfiltration, specifically tracking activity involving suspicious OAuth token prefixes (gho_) and rapid high-volume access to sensitive organizational assets within a short timeframe.
Detects rapid, bulk cloning or downloading of GitHub repositories containing sensitive data (e.g., consensus algorithms, PII, internal blocklists). This behavior is characteristic of unauthorized data exfiltration, specifically tracking activity involving suspicious OAuth token prefixes (gho_) and rapid high-volume access to sensitive organizational assets within a short timeframe.
Detects attempts to access sensitive files like environment variables (.env), cloud provider credentials (AWS/Azure), or Terraform state files via a web server interface, specifically targeting Vite development server deployments.
This rule detects non-standard processes attempting to access sensitive web browser files (e.g., 'Login Data', 'Cookies', 'key4.db') that are typically only accessed by legitimate web browsers. It excludes known browser processes and trusted security or sync applications to identify potential credential theft attempts.
This rule detects non-standard processes attempting to access sensitive web browser files (e.g., 'Login Data', 'Cookies', 'key4.db') that are typically only accessed by legitimate web browsers. It excludes known browser processes and trusted security or sync applications to identify potential credential theft attempts.
Detects users accessing files across SharePoint, OneDrive, or Exchange over a sustained period of at least 6 hours, while maintaining a low-to-moderate frequency (1-999 events per hour). This behavioral pattern may indicate slow, automated data exfiltration or unauthorized reconnaissance of sensitive files while attempting to stay under traditional volume-based alerting thresholds.
Detects anomalous, high-frequency file access (100+ files within a 2-hour window) in Microsoft 365 (SharePoint or OneDrive) by users employing a Python-based HTTP client (python-httpx). This behavior is often indicative of automated data scraping, exfiltration, or bulk download activities performed by unauthorized scripts or compromised service accounts.
Detects file access or download operations performed by the python-httpx library within a specific cloud application context, which may indicate automated data retrieval or exfiltration attempts by scripts or custom tools.
Detects unauthorized processes attempting to read browser-stored sensitive files, such as 'Login Data' (credentials) and 'Cookies' (session tokens) for Google Chrome and Microsoft Edge. This activity is a common indicator of credential dumping by information stealers like StealC.
Detects unauthorized processes attempting to access sensitive browser files, specifically 'Login Data' (credentials) and 'Network/Cookies' databases for Google Chrome and Microsoft Edge. Legitimate browser processes and update services are explicitly excluded.
Detects instances where sensitive Active Directory database files (NTDS.DIT) are accessed, correlated with the execution of common system administration utilities (ntdsutil, vssadmin, diskshadow, esentutl) known to be leveraged by adversaries to create volume shadow copies or extract data for offline credential harvesting.
Detects processes other than the official Telegram desktop client accessing sensitive local data files ('key_datas', 'settingss', 'usertag') within the Telegram application directory. This activity is often associated with credential theft or session hijacking.
Page 23 of 76