Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,440
11,814
5,871
5,145
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
Detects file system operations targeting common user directories and specific file extensions (.bak, .backup, .locked) often associated with data exfiltration, staging, or ransomware activity.
Detects unauthorized access to Chrome and Microsoft Edge login data files. This behavior is indicative of credential theft, frequently observed in info-stealer malware such as Stealer/1.0, which attempts to extract stored browser credentials for exfiltration.
This rule detects processes accessing '/proc/self/status' to read the 'TracerPID' field. Malware often uses this technique to detect if it is being debugged or traced by security analysis tools, allowing the process to terminate or change behavior to avoid analysis.
This rule detects processes accessing '/proc/self/status' to read the 'TracerPID' field. Malware often uses this technique to detect if it is being debugged or traced by security analysis tools, allowing the process to terminate or change behavior to avoid analysis.
This rule detects processes accessing '/proc/self/status' to read the 'TracerPID' field. Malware often uses this technique to detect if it is being debugged or traced by security analysis tools, allowing the process to terminate or change behavior to avoid analysis.
This rule detects file-based activity associated with a tool named 'gh-token-monitor', which is likely used for the monitoring or exfiltration of GitHub access tokens from a compromised host. The rule monitors for the creation or presence of specific scripts, configuration files, and directory paths associated with this activity, including files related to a 'claude' configuration.
This rule detects potential bulk data exfiltration by monitoring for high volumes of file access events (FileAccessed, FileRead, FileModified) originating from the 'doc_helper.aspx' file-management web shell. It summarizes activity by device and user account, flagging instances where over 100 unique files are touched within a short timeframe, which is indicative of automated collection and exfiltration activities.
Detects access attempts to sensitive files such as xmlrpc.php, .htaccess, wp-config.php, /etc/shadow.
This rule detects instances where a PDF file located in the Outlook temporary internet cache is opened or accessed, followed shortly (within 3 minutes) by a network request from the device to a Google Sites URL. This behavior is indicative of a phishing attack where an email attachment redirects the user to a malicious site for credential harvesting or malware delivery.
This rule detects instances where a PDF file located in the Outlook temporary internet cache is opened or accessed, followed shortly (within 3 minutes) by a network request from the device to a Google Sites URL. This behavior is indicative of a phishing attack where an email attachment redirects the user to a malicious site for credential harvesting or malware delivery.
This rule detects suspicious activity involving common web browser credential files (Cookies, Login Data) being read, created, modified, or renamed by processes associated with iCloud synchronization paths on macOS. This behavior is indicative of potentially malicious processes attempting to exfiltrate browser-stored session information or credentials.
Detects Node.js or Electron processes executing from suspicious paths (e.g., Temp, Roaming) while interacting with web browser credential files or executing commands consistent with automated credential dumping tools.
Detects unauthorized processes attempting to read sensitive browser credential and session data (e.g., 'Login Data', 'Cookies', 'Local State', 'cookies.sqlite', 'logins.json') located in common browser profile paths. This behavior is highly indicative of information-stealing malware attempting to extract saved passwords and session cookies for account hijacking and 2FA/SSO bypass.
This rule detects common command-line utilities (cat, bash, sh, python, grep) being used to access the '/proc/1/environ' file. This file contains environment variables for the PID 1 process (typically the init system), which may include sensitive information such as credentials, configuration paths, or system secrets.
This rule detects potential bulk data exfiltration by monitoring for high volumes of file access events (FileAccessed, FileRead, FileModified) originating from the 'doc_helper.aspx' file-management web shell. It summarizes activity by device and user account, flagging instances where over 100 unique files are touched within a short timeframe, which is indicative of automated collection and exfiltration activities.
Detects access attempts to application/error/debug log files.
Detects unauthorized or suspicious access attempts to common backup, database dump, or archive files via the Caddy web server, identified by specific file extensions in the requested URL.
SynkLoader PhishLocker Behavior
Cortex XDR
Detects indicators of the PhishLocker credential harvester, specifically the loading of fake Microsoft Visual C++ runtime DLLs from non-standard (user-writable) paths and unauthorized access to Windows lock screen images by Python-based processes.
This rule detects suspicious activity involving common web browser credential files (Cookies, Login Data) being read, created, modified, or renamed by processes associated with iCloud synchronization paths on macOS. This behavior is indicative of potentially malicious processes attempting to exfiltrate browser-stored session information or credentials.
Detects unauthorized, non-browser processes accessing sensitive Chromium-based browser credential files (e.g., 'Local State', 'Login Data', 'Cookies') followed by suspicious outbound network connections. This pattern is characteristic of credential-stealing malware (infostealers) like Amatera, Lumma, and Remus.
This rule detects suspicious activity involving common web browser credential files (Cookies, Login Data) being read, created, modified, or renamed by processes associated with iCloud synchronization paths on macOS. This behavior is indicative of potentially malicious processes attempting to exfiltrate browser-stored session information or credentials.
Page 31 of 76