Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,440
11,814
5,871
5,145
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
This rule detects the use of common command-line utilities (grep, find, bash, sh, awk) to search for sensitive files, such as SSH keys, configuration files containing credentials, or password-related patterns. The rule includes exclusions for common administrative, security, and backup tools that might legitimately perform such scans.
This rule detects the use of common command-line utilities (grep, find, bash, sh, awk) to search for sensitive files, such as SSH keys, configuration files containing credentials, or password-related patterns. The rule includes exclusions for common administrative, security, and backup tools that might legitimately perform such scans.
Detects unauthorized processes accessing sensitive web browser files (login data, cookies, local state) from suspicious or non-standard paths. This is a common behavioral pattern for infostealers attempting to exfiltrate user credentials and browser session tokens.
Detects unauthorized processes attempting to access browser credential database files such as Login Data for Chromium-based browsers or logins.json and key4.db for Firefox. The rule filters out known browser processes to isolate potential credential harvesting or exfiltration activity.
Detects unauthorized processes attempting to access sensitive web browser files (login data, cookies, configuration) located in Chrome or Firefox profile directories. The detection excludes known browser-related processes and system processes, focusing on third-party or potentially malicious utilities that could be used to harvest credentials stored in these local files.
Detects unauthorized processes attempting to access sensitive browser credential storage files belonging to Google Chrome (Login Data) and Mozilla Firefox (key4.db, logins.json). This behavior is indicative of credential harvesting often performed by infostealers like BabylonRAT.
Detects instances where a non-browser process attempts to read sensitive credential store files (e.g., 'Login Data', 'logins.json', 'key4.db') belonging to Google Chrome or Mozilla Firefox. This activity is indicative of credential harvesting often performed by malware.
Detects unauthorized access to sensitive browser credential files (e.g., Chrome 'Login Data', Firefox 'logins.json' and 'key4.db') by processes other than legitimate browser executables. This behavior is indicative of credential harvesting attacks, such as those performed by BabylonRAT.
This rule detects processes or file operations attempting to interact with the Docker daemon socket ('/var/run/docker.sock') by non-standard or unauthorized binaries. Accessing the Docker socket from a container can allow an attacker to escape to the host, manipulate other containers, or perform privileged actions on the Docker daemon.
Detects instances where browser processes or related credential files are accessed or targeted by process termination (e.g., taskkill.exe) followed by attempts to access sensitive files like Login Data, logins.json, or key4.db. This pattern is indicative of credential theft from web browsers.
Detects instances where browser processes or related credential files are accessed or targeted by process termination (e.g., taskkill.exe) followed by attempts to access sensitive files like Login Data, logins.json, or key4.db. This pattern is indicative of credential theft from web browsers.
Detects instances where an Artifactory process or user accesses highly sensitive configuration files (system.yaml, join.key) or API endpoints containing configuration data, followed closely (within 15 minutes) by an outbound network connection to a non-standard or external destination. This pattern is indicative of a potential credential theft attempt targeting the Artifactory join key, which is used to authenticate Artifactory nodes in a cluster, followed by potential data exfiltration or C2 communication using these credentials.
Detects high-volume filesystem activity (exceeding 300 operations in 5 minutes) initiated by 'claude-code' or 'claude' processes. This behavior may indicate an autonomous, patched, or jailbroken AI coding assistant performing mass file operations or reconnaissance without user confirmation.
Detects high-volume filesystem activity (exceeding 300 operations in 5 minutes) initiated by 'claude-code' or 'claude' processes. This behavior may indicate an autonomous, patched, or jailbroken AI coding assistant performing mass file operations or reconnaissance without user confirmation.
Detects attempts to access sensitive files like environment variables (.env), cloud provider credentials (AWS/Azure), or Terraform state files via a web server interface, specifically targeting Vite development server deployments.
Detects Node.js or Electron processes executing from suspicious paths (e.g., Temp, Roaming) while interacting with web browser credential files or executing commands consistent with automated credential dumping tools.
Detects unauthorized processes accessing sensitive web browser files (login data, cookies, local state) from suspicious or non-standard paths. This is a common behavioral pattern for infostealers attempting to exfiltrate user credentials and browser session tokens.
This rule detects potential bulk data exfiltration by monitoring for high volumes of file access events (FileAccessed, FileRead, FileModified) originating from the 'doc_helper.aspx' file-management web shell. It summarizes activity by device and user account, flagging instances where over 100 unique files are touched within a short timeframe, which is indicative of automated collection and exfiltration activities.
Detects processes that access sensitive browser credential or cookie files (e.g., Login Data, Cookies) followed by network activity within a 10-minute window, which is a common behavior pattern of information-stealing malware such as Amatera or ACR Stealer.
Detects unauthorized processes (e.g., cmd.exe, powershell.exe, node.exe) accessing sensitive web browser files like 'Login Data' or 'Cookies' in common browser directories. This behavior is indicative of credential theft or data exfiltration attempts.
This rule detects unauthorized or suspicious access to sensitive configuration and credential files (e.g., .aws, .azure, .ssh) by specific DLP (Data Loss Prevention) or automation scripts, and identifies subsequent attempts to expose environment variables or sensitive tokens within process command lines.
Page 25 of 76