Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,440
11,814
5,871
5,145
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
Detects Node.js processes attempting to access sensitive files or environment variables associated with Claude AI (e.g., Anthropic API keys, .claude configuration files), which may indicate credential harvesting activity by malicious code.
Detects unauthorized processes attempting to read, modify, create, or rename browser sensitive data files such as 'Login Data' (passwords) and 'Cookies' for Google Chrome and Microsoft Edge. This activity is a common indicator of credential theft or session hijacking.
Detects instances where Chrome or Microsoft Edge web browsers access local sensitive credential storage files (e.g., Login Data, Web Data, Cookies) from unexpected file system paths, combined with external network traffic from the same process instance. This behavior is indicative of potential malicious browser extension abuse, DLL sideloading, or unauthorized browser instance execution for credential exfiltration.
This rule detects unauthorized access attempts to common cryptocurrency wallet data files and Telegram Desktop session information, a pattern of behavior consistent with the data collection phase of the Vidar information stealer.
Detects instances where the Windows Error Reporter (wermgr.exe) process attempts to open a handle to a Volume Shadow Copy (VSS) device. This behavior is anomalous as legitimate VSS operations are typically performed by dedicated system processes (e.g., vssvc.exe, diskshadow.exe), and such access by wermgr.exe may indicate an attempt to bypass file locks for credential dumping or sensitive data exfiltration.
Detects unauthorized processes, such as PyInstaller binaries or Python scripts, attempting to read LevelDB storage files used by popular messaging applications (Discord, Telegram, Signal, Slack, and Microsoft Teams) for session and authentication token extraction, a technique commonly associated with information stealers like Yuta or Glove Stealer.
Detects instances where non-browser or system maintenance processes attempt to access browser credential storage files, such as 'Login Data', 'key4.db', or 'logins.json'. The rule uses a self-join to correlate access to these sensitive files with access to the Windows DPAPI protection directories, often used to decrypt these credentials.
Detects attempts to access or copy the Active Directory domain database (NTDS.dit), which contains sensitive credential material. The rule monitors for the use of built-in administrative tools such as esentutl, ntdsutil, vssadmin, and wbadmin, as well as file copy utilities (robocopy, xcopy) when specifically targeting the NTDS directory or volume shadow copies containing the database file.
Detects Node.js processes accessing sensitive configuration and credential files such as AWS credentials, .npmrc tokens, SSH keys, and Docker configurations. This behavior is consistent with infostealer activity, including malicious supply chain attacks designed to harvest developer secrets from local filesystems.
Detects the SearchLeak (CVE-2026-42824) attack chain targeting M365 Copilot. The rule monitors for a three-stage sequence within 1 minute: (1) A user accessing a crafted Enterprise Search URL with an injected prompt in the query string; (2) Evidence of bulk data access (MailItemsAccessed or FileAccessed, 5+ events); and (3) An outbound HTTP request to a Bing image search endpoint containing exfiltrated data encoded within a long (>500 chars) 'imgurl' parameter, indicating a potential SSRF/CSP bypass exfiltration path.
This rule detects multiple unauthorized access attempts to files identified as machine learning models, weights, or checkpoints. It specifically looks for Security Event ID 4656 (Auditing of object access) where the object name contains keywords like 'model', 'weights', or 'checkpoint', and the access mask indicates unauthorized access attempts (0x0001 for ReadData or ListDirectory, 0x0002 for WriteData or AddFile). The rule then summarizes these attempts by user, computer, and hour, triggering an alert if 5 or more attempts are made within an hour.
Detects anomalous Python activity indicative of the InvisibleFerret backdoor, specifically focusing on instances where Python processes are spawned by developer tools (node.exe, code.exe, cursor.exe), access sensitive credential/wallet files, or initiate outbound network connections on common C2 ports.
Detects suspicious execution of Python or shell scripts (bash, zsh, sh) from paths associated with 'openclaw' or 'clawhub' that are interacting with sensitive data files, including browser credential stores (Chrome, Firefox, Edge, Brave), system keychains, and cryptocurrency wallet files.
Detects unauthorized access to sensitive developer artifacts, including Git credentials, GitHub CLI configurations, GitHub Desktop logs, and VS Code global storage files by suspicious processes (Node.js, Python, or VS Code executables) commonly leveraged in the 'Contagious Interview' campaign associated with the Lazarus Group for credential theft.
This rule detects node.js processes, typically initiated via npm or during package installation scripts, accessing sensitive Claude Code configuration or credential files. This behavior is indicative of a malicious supply chain attack where a compromised npm package attempts to exfiltrate developer authentication secrets.
This rule detects attempts to access the NTDS.dit file or the SYSTEM registry hive, indicated by Security Event ID 4656. Multiple access attempts within an hour are summarized by the subject user name.
This rule detects when users access or download suspicious file types (specifically .xlsm, .docm, or .ics) from Microsoft SharePoint, Teams, or Exchange, where the filenames contain keywords associated with common phishing lures such as credentials, invoices, payroll, or password resets. This monitors for indicators of potential spearphishing attempts involving malicious documents or calendar invites within the M365 environment.
Campaign converting compromised FortiGate firewalls into credential stealers
Detects rapid access (three or more distinct files within a 60-second window) to sensitive files typically containing credentials or configuration data (e.g., SSH keys, AWS credentials, environment files, container configurations). This pattern is often associated with credential dumping or reconnaissance activity by an adversary attempting to harvest secrets.
Detects unauthorized processes attempting to access 'wermgr.exe' via a Volume Shadow Copy Service (VSS) device path. This behavior is associated with the RoguePlanet exploit chain (CVE-2026-50656), which leverages VSS to bypass file system protections for TOCTOU (Time-of-Check to Time-of-Use) exploitation. Legitimate system and backup processes are excluded.
Detects a user-mode process attempting to set an opportunistic lock (oplock) on wermgr.exe within a Volume Shadow Copy (VSS) snapshot. This behavior is associated with the RoguePlanet exploit chain (CVE-2026-50656), which leverages VSS snapshots and file locking to trigger a TOCTOU race condition against the Microsoft Defender (MsMpEng.exe) scanner.
Page 39 of 76