Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,440
11,814
5,871
5,145
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
This rule monitors for suspicious activity often associated with credential or sensitive information discovery in development environments. It identifies: 1) Access to configuration files or directories related to AI-powered development tools (e.g., Cursor, Windsurf, Zed) which may store environment variables or API keys; 2) Network connections to common cloud instance metadata endpoints; and 3) Execution of command-line tools attempting to access AWS secrets or configuration management APIs (Secrets Manager, SSM).
Detects instances where the Node.js runtime environment (node.exe) accesses sensitive configuration, settings, or message control protocol (mcp) files within directories associated with common developer IDEs and text editors like Claude, Cursor, Windsurf, Zed, and VS Code. This activity may indicate an attempt to exfiltrate IDE configuration, API keys, or environment settings.
Detects attempts by non-browser processes to access sensitive Chromium-based browser files including Login Data, Cookies, and Web Data. This behavior is indicative of credential dumping or session cookie theft where unauthorized software attempts to extract browser-stored secrets.
Detects instances where a process other than the authorized password manager application (e.g., 1Password, Bitwarden, KeePass) attempts to create, modify, rename, or read sensitive database files associated with these password managers. This behavior may indicate an attempt to exfiltrate or compromise stored credentials.
Detects file access events for 'logAzure.txt', which is used by a specific implant to store RSA private keys for C2 payload decryption.
Detects unauthorized processes attempting to access sensitive credential database files (Login Data, key4.db, logins.json) used by Chromium-based browsers or Mozilla Firefox. This behavior is indicative of credential theft attempts, where malicious actors seek to extract saved passwords and cookies from the browser's local storage.
Detects anomalous, automated data exfiltration cycles in Microsoft 365 environments consistent with the Helix threat group. The rule identifies a pattern of successful sign-ins followed within 6 hours by new MFA registration, suspicious SharePoint enumeration, and a high-frequency, non-human-paced burst of file downloads.
Detects access to the Windows DPAPI master key storage directory located at '\Microsoft\Protect\' by processes other than standard system components (lsass.exe, svchost.exe, dllhost.exe). Accessing these files is a common technique used by adversaries to decrypt sensitive credentials stored on the system.
Detects access to the Windows DPAPI master key storage directory located at '\Microsoft\Protect\' by processes other than standard system components (lsass.exe, svchost.exe, dllhost.exe). Accessing these files is a common technique used by adversaries to decrypt sensitive credentials stored on the system.
Detects the LabubaRAT implant (masquerading as nvidia-sysruntime.exe) performing file system checks against Chrome, Firefox, Microsoft Edge, and Brave installation paths as part of its enumerate_browsers() host profiling routine.
Detects unauthorized processes attempting to access sensitive credential database files (Login Data, key4.db, logins.json) used by Chromium-based browsers or Mozilla Firefox. This behavior is indicative of credential theft attempts, where malicious actors seek to extract saved passwords and cookies from the browser's local storage.
Detects file access events for 'logAzure.txt', which is used by a specific implant to store RSA private keys for C2 payload decryption.
Detects file access or read operations performed against known password manager database files (1Password, Bitwarden). This activity may indicate an attempt to acquire credentials from local storage.
Detects instances where rundll32.exe, likely used by the TELEPUZ threat actor, performs a direct file read of ntdll.dll from standard Windows system directories. This behavior is indicative of an attempt to obtain an unhooked copy of ntdll.dll to overwrite the in-memory, hooked version, thereby evading security monitoring.
Detects the LabubaRAT implant (masquerading as nvidia-sysruntime.exe) performing file system checks against Chrome, Firefox, Microsoft Edge, and Brave installation paths as part of its enumerate_browsers() host profiling routine.
Detects processes attempting to read sensitive browser storage files, specifically 'Login Data' (passwords) and 'Cookies', located within common browser paths for Chrome, Firefox, and Safari on macOS or similar environments using Application Support/Library folders.
Detects the access or execution of Windows Library files (.library-ms) which can be leveraged as a vector for forced NTLM authentication (CVE-2025-24054). By placing a maliciously crafted library file on a system or network share, an attacker can cause the victim's machine to automatically authenticate to an external resource, potentially exposing user credentials for NTLM relay or cracking.
Detects potential anonymization attempts by identifying systems that connect to the Tor network check service followed closely by processes accessing local machine identifiers, such as machine-id or board serial numbers. This behavior may indicate an actor attempting to verify anonymity or fingerprint a host while routing traffic through Tor.
Detects file access events targeting sensitive browser files, specifically 'passwords.json' and 'cookies.json', located within the standard Chrome/browser application data directories. These files often contain stored credentials and session cookies, and unauthorized access is a common precursor to credential theft.
Detects unauthorized processes attempting to access sensitive credential database files (Login Data, key4.db, logins.json) used by Chromium-based browsers or Mozilla Firefox. This behavior is indicative of credential theft attempts, where malicious actors seek to extract saved passwords and cookies from the browser's local storage.
Detects unauthorized access attempts to session files and account credentials stored locally by Discord, Telegram, and Steam applications, a behavior consistent with the CastleStealer malware.
Page 36 of 76