Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,440
11,814
5,871
5,145
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
Detects unauthorized processes (e.g., cmd.exe, powershell.exe, node.exe) accessing sensitive web browser files like 'Login Data' or 'Cookies' in common browser directories. This behavior is indicative of credential theft or data exfiltration attempts.
Detects rapid enumeration of sensitive system information files (CPU info, command line, device ID, node data) by processes executing from transient or commonly abused directories like /tmp, /var/tmp, or /dev/shm, as well as processes identified with specific malware naming patterns. This behavior often indicates an initial discovery phase by a threat actor or automated malicious agent.
Detects rapid enumeration of sensitive system information files (CPU info, command line, device ID, node data) by processes executing from transient or commonly abused directories like /tmp, /var/tmp, or /dev/shm, as well as processes identified with specific malware naming patterns. This behavior often indicates an initial discovery phase by a threat actor or automated malicious agent.
Detects rapid enumeration of sensitive system information files (CPU info, command line, device ID, node data) by processes executing from transient or commonly abused directories like /tmp, /var/tmp, or /dev/shm, as well as processes identified with specific malware naming patterns. This behavior often indicates an initial discovery phase by a threat actor or automated malicious agent.
Detects access to Firefox profile database files (cookies.sqlite, places.sqlite, permissions.sqlite) by suspicious processes that are masquerading as legitimate system maintenance or update utilities. This rule specifically targets known masquerading process names (UpdateAssistant.exe, AppUpdateHelper.exe, SysMaintenance.exe) while excluding the legitimate firefox.exe process and its installation directory.
Detects unauthorized processes accessing sensitive web browser files (login data, cookies, local state) from suspicious or non-standard paths. This is a common behavioral pattern for infostealers attempting to exfiltrate user credentials and browser session tokens.
This rule detects potential bulk data exfiltration by monitoring for high volumes of file access events (FileAccessed, FileRead, FileModified) originating from the 'doc_helper.aspx' file-management web shell. It summarizes activity by device and user account, flagging instances where over 100 unique files are touched within a short timeframe, which is indicative of automated collection and exfiltration activities.
Detects direct file access attempts to critical Windows registry hive files (SAM, SECURITY, SYSTEM, SOFTWARE) on disk. These files contain sensitive system and credential information, and direct access is frequently used by adversaries to perform offline credential dumping.
This rule detects potentially unauthorized access or attempts to copy sensitive SSH keys (e.g., id_rsa, id_ed25519) by command-line utilities (such as cat, cp, tar, scp, or curl) or when triggered by automation-related process names like 'terraform'. It monitors both process command lines and file events to identify staging or exfiltration activities.
This rule detects potentially unauthorized access or attempts to copy sensitive SSH keys (e.g., id_rsa, id_ed25519) by command-line utilities (such as cat, cp, tar, scp, or curl) or when triggered by automation-related process names like 'terraform'. It monitors both process command lines and file events to identify staging or exfiltration activities.
This rule detects potentially unauthorized access or attempts to copy sensitive SSH keys (e.g., id_rsa, id_ed25519) by command-line utilities (such as cat, cp, tar, scp, or curl) or when triggered by automation-related process names like 'terraform'. It monitors both process command lines and file events to identify staging or exfiltration activities.
This rule detects activity associated with the exploitation of PaperCut vulnerabilities. It looks for connections to known malicious IP addresses, the presence of specific credential harvesting tools, reconnaissance commands (whoami, tasklist) executed by the PaperCut application (pc-app.exe), suspicious PowerShell downloads of AnyDesk, and unauthorized access to PaperCut configuration files or log files containing known exploit strings.
This rule detects activity associated with the exploitation of PaperCut vulnerabilities. It looks for connections to known malicious IP addresses, the presence of specific credential harvesting tools, reconnaissance commands (whoami, tasklist) executed by the PaperCut application (pc-app.exe), suspicious PowerShell downloads of AnyDesk, and unauthorized access to PaperCut configuration files or log files containing known exploit strings.
This rule detects activity associated with the exploitation of PaperCut vulnerabilities. It looks for connections to known malicious IP addresses, the presence of specific credential harvesting tools, reconnaissance commands (whoami, tasklist) executed by the PaperCut application (pc-app.exe), suspicious PowerShell downloads of AnyDesk, and unauthorized access to PaperCut configuration files or log files containing known exploit strings.
Detects unauthorized processes (e.g., cmd.exe, powershell.exe, node.exe) accessing sensitive web browser files like 'Login Data' or 'Cookies' in common browser directories. This behavior is indicative of credential theft or data exfiltration attempts.
Detects attempts to access or create copies of the Active Directory 'ntds.dit' database or the Windows Security Account Manager (SAM) registry hive using unauthorized processes. Attackers often target these files to extract credential hashes from Domain Controllers or local systems.
Detects attempts to access or create copies of the Active Directory 'ntds.dit' database or the Windows Security Account Manager (SAM) registry hive using unauthorized processes. Attackers often target these files to extract credential hashes from Domain Controllers or local systems.
Detects attempts to access or create copies of the Active Directory 'ntds.dit' database or the Windows Security Account Manager (SAM) registry hive using unauthorized processes. Attackers often target these files to extract credential hashes from Domain Controllers or local systems.
This rule detects processes accessing '/proc/self/status' to read the 'TracerPID' field. Malware often uses this technique to detect if it is being debugged or traced by security analysis tools, allowing the process to terminate or change behavior to avoid analysis.
This rule detects two suspicious patterns: 1) DLL sideloading of 'libcef.dll' by processes like 'ClaudeDesktop.exe' or JetBrains-related tools when executed from non-standard directories like 'Downloads', 'Temp', or 'AppData'. 2) Unauthorized access to common browser credential storage files (e.g., 'Login Data', 'Cookies') by processes other than standard browsers.
Detects processes that access sensitive browser credential or cookie files (e.g., Login Data, Cookies) followed by network activity within a 10-minute window, which is a common behavior pattern of information-stealing malware such as Amatera or ACR Stealer.
Page 28 of 76