Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,440
11,814
5,871
5,145
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
This rule detects potential credential theft from web browsers (Edge/Chrome) by monitoring access to the 'Login Data' SQLite database file. It correlates file access events with subsequent outbound HTTPS connections to non-Microsoft and non-Google domains initiated by the same browser process within a 10-minute window, which is indicative of exfiltration of stolen browser credentials.
Detects unauthorized access to browser-based credential storage files (such as Login Data and cookies) by processes other than recognized browser executables. This behavior is indicative of credential theft or dumping attempts, often performed by malicious software to exfiltrate saved passwords and session cookies.
This rule monitors for processes attempting to enumerate sensitive environment variables related to cloud services (AWS) and AI platforms (Anthropic), or access specific configuration and credential files (e.g., .aws/credentials, .config/anthropic). It specifically correlates these behaviors with potentially suspicious parent processes like bash, node, or python interpreters, which may indicate an AI agent or a reverse shell performing reconnaissance or credential exfiltration.
Detects two distinct suspicious patterns indicative of OAuth consent abuse and browser-based credential theft. The first pattern identifies non-Microsoft script interpreters or binaries initiating network connections to Microsoft's OAuth endpoints. The second pattern identifies unauthorized processes attempting to access or modify sensitive browser data files (e.g., 'Login Data', 'Cookies') which are typically reserved for browser-specific processes.
Detects unauthorized processes attempting to read sensitive browser credential files (Login Data, Cookies, Web Data) from Chrome, Edge, and similar browsers, which is a common post-compromise technique used by infostealer malware to exfiltrate session cookies and stored credentials.
This rule detects shell commands (bash, sh, zsh) initiated by AI-agent or development-related processes (e.g., Python, Claude Desktop, openclaw) that target sensitive macOS paths associated with credentials, SSH keys, crypto wallets, and browser cookies, a technique characteristic of the Atomic Stealer (AMOS) malware.
Detects indicators of SSH-based lateral movement and credential access, including suspicious SSH command-line flags (e.g., BatchMode, StrictHostKeyChecking), manual enumeration of SSH keys via ssh-add, inspection of agent socket variables, and unauthorized access to critical SSH configuration and identity files by non-standard processes.
Detects Python processes spawned from development tools (Node.js, VS Code, Cursor) that perform suspicious file access to browser credential stores (e.g., Login Data, cookies.sqlite) and subsequently initiate significant outbound network POST requests, characteristic of browser-based credential harvesting and exfiltration.
Detects the Ghazwa spyware, attributed to APT36, querying sensitive Android system resources (CallLog and SMS Content Providers) from an application that is not a native dialer or messaging app. The rule further correlates this data access with subsequent outbound network activity, indicating potential data exfiltration.
Detects PHP processes reading both /proc/self/maps and /proc/self/mem within a short time window. This activity is indicative of an Address Space Layout Randomization (ASLR) bypass technique, specifically associated with exploits attempting to compute memory offsets for sensitive functions (e.g., zend_execute_internal, zif_system) to facilitate Remote Code Execution (RCE).
Detects suspicious activities originating from SimpleHelp remote support processes, including the spawning of unauthorized child processes, execution of potentially malicious JavaScript loaders (e.g., TaskWeaver-related), and access to sensitive browser-based credential or configuration files often targeted by infostealers like Djinn Stealer.
Detects anomalous or unauthorized processes accessing sensitive AI configuration files, SSH configurations, version control files, and shell history within a short time window. The rule flags instances where non-standard or unexpected applications exhibit broad or high-frequency access to these files, which are common targets for credential harvesting or exfiltration by adversaries.
Detects evidence of Djinn Stealer malware activity, including unauthorized access to web browser credential stores, suspicious child process creation by the SimpleHelp RMM daemon, and network communication with a known command-and-control server (96.126.130.126:58942) using a specific telemetry client user agent.
Detects unauthorized processes, such as TaskWeaver implants or scripts (node.exe, wscript.exe, cscript.exe) running from non-standard directories (e.g., %TEMP%, %APPDATA%), attempting to access web browser credential databases. This behavior is indicative of post-exploitation credential harvesting, specifically linked to Djinn Stealer activity following CVE-2026-48558 exploits.
Detects instances where common scripting runtimes (Python, Node.js) or development-related parent processes (e.g., VS Code, npm) access sensitive cloud credential or configuration files (AWS, Google Cloud, Azure). This behavior may indicate an adversary or an unauthorized script attempting to exfiltrate or leverage stored cloud credentials from an developer workstation.
This rule detects suspicious activities originating from Python processes spawned by development tools like VS Code, Node.js, or npm. It flags potential credential access when such processes attempt to read sensitive files (e.g., browser profiles, SSH keys, cloud configuration files) or perform suspicious network communication to external, non-standard ports, which may indicate data exfiltration or command-and-control behavior.
Detects access to 'wallet.dat' files (commonly associated with cryptocurrency wallets) by processes with misleading or suspicious names running from user AppData directories. This behavior is indicative of credential theft or malware attempting to exfiltrate digital assets.
This rule detects potential privilege escalation activity associated with the abuse of CTFMON related objects (named pipes, symlinks, junctions) which may be used in conjunction with high-privilege operations (like SeDebugPrivilege or SeImpersonatePrivilege) to elevate access to SYSTEM. It correlates access events for CTF objects by processes (other than the legitimate ctfmon.exe) with subsequent sensitive privilege assignments within a short time window.
This rule detects various methods used to extract credentials protected by the Windows Data Protection API (DPAPI). It covers multiple vectors, including Mimikatz DPAPI module usage, unauthorized loading of the dpapi.dll library, suspicious access to browser or WiFi credential stores, and cross-process memory access to the LSASS process to extract DPAPI master keys.
Detects unauthorized processes attempting to access sensitive browser files such as 'Login Data', 'Cookies', and 'Web Data' files typically located in Chrome or Firefox user profiles. This behavior is indicative of credential theft or data exfiltration, as these files contain saved usernames, passwords, and session cookies.
This rule monitors for a combination of suspicious behaviors including C2 network activity to known malicious IPs, potential credential theft targeting browser data files, suspicious library loading (such as keyloggers or potential sideloading) from temp or appdata directories, and beaconing activity using non-standard or suspicious processes. The rule calculates a risk score based on the number and type of indicators observed on a single host.
Page 41 of 76