Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,440
11,814
5,871
5,145
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
Detects rapid or aggregate access to multiple sensitive credential or configuration files across various applications (e.g., AWS, Docker, Kubernetes, Crypto wallets, AI tools) within a short timeframe. This behavior is indicative of credential harvesting or post-compromise reconnaissance to steal secrets and keys.
Detects unauthorized access to browser credential databases, cloud configuration files, and developer secret stores by processes spawned from Node.js or npm. This behavior is indicative of IronWorm and similar infostealers exploiting malicious npm package preinstall hooks to harvest sensitive developer credentials.
Detects the node.exe process (npm lifecycle) accessing sensitive web browser credential databases (e.g., Login Data, Cookies, Web Data, and Firefox profiles). This activity is indicative of infostealer malware, such as Miasma or MYRA, which often leverages malicious npm packages to drop and execute SQLite-based credential exfiltration logic directly from disk.
Detects Node.js processes spawning from common command-line shells (npm, cmd, bash) and accessing sensitive credential directories, such as '.claude' or Docker 'config.json'. This behavior is indicative of credential theft or unauthorized access attempts often associated with malicious npm packages or supply chain attacks.
Detects unauthorized access to sensitive credential files (Docker, AWS, npm, PyPI, GCloud) by Node.js processes, specifically when those processes are triggered by common npm lifecycle scripts like preinstall, postinstall, or peer dependency scripts. This is a common pattern observed in supply chain attacks involving malicious npm packages.
Detects indicators of the BUMSRAKETE exploit targeting a FreeBSD kernel page-cache corruption vulnerability (CVE-2026-45257). The rule triggers on the execution of the exploit binary, creation of specific staging files in /tmp, unauthorized access to SUID binaries, configuration of kTLS socket options (TCP_RXTLS_ENABLE/TCP_TXTLS_ENABLE) by unprivileged users, and pre-exploit reconnaissance using sysctl.
Detects instances where node.js or npm processes access multiple sensitive configuration or credential files (such as .aws/credentials, .npmrc, .pypirc, .gitconfig, or docker configs) and subsequently perform DNS queries against known malicious or suspicious C2 domains.
Detects Node.js processes accessing common shell history files (e.g., .bash_history, .zsh_history, PowerShell history). Such behavior is often indicative of credential harvesting or post-exploitation reconnaissance activity, specifically where a Node.js runtime environment is being leveraged to read sensitive user activity logs.
This rule detects common web application processes (such as nginx, python, node, etc.) accessing the /proc/[pid]/environ file, which contains environment variables that may include sensitive information like credentials or configuration secrets. The rule correlates this access with subsequent external network connections initiated by the same process, which is highly indicative of data exfiltration after sensitive information has been retrieved.
Detects the use of the Windows Backup utility (wbadmin.exe) to initiate a backup targeting critical Active Directory or system configuration files (ntds.dit, SYSTEM, or SECURITY registry hives). This behavior is often associated with credential dumping, where adversaries attempt to extract the AD database by utilizing built-in Windows backup tools to create a copy that can then be exfiltrated or processed offline.
Detects anomalous network activity from browser renderer subprocesses (chrome.exe/msedge.exe) correlated with concurrent file system access to sensitive browser credential stores (Login Data/Cookies). The rule identifies high-frequency outbound connections following or occurring during access to these files, which is a common indicator of credential exfiltration performed by malicious browser extensions or injected scripts.
Detects clipboard access operations (Read/Write) initiated by common web browsers (Chrome, Edge, Brave, Electron-based apps) when running with specific command-line arguments typically associated with renderer or extension processes. This can indicate malicious code or browser extensions attempting to monitor or steal sensitive clipboard content.
Detects web application processes (such as nginx, gunicorn, uvicorn, python, node, or java) attempting to read sensitive information from /proc/self, specifically /proc/self/environ, /proc/self/cmdline, or /proc/self/maps. This behavior is indicative of a Local File Read (LFR) vulnerability exploitation, which an attacker may use to exfiltrate environment variables containing secrets or Cloud Run service account credentials.
Detects various techniques used by an attacker to escape a container environment or gain unauthorized access to host-level resources. This includes the execution of namespace manipulation tools (nsenter, unshare, chroot), unauthorized access to the docker.sock Unix socket, mounting of host filesystems from within a container, and direct attempts to access the host's /proc/1 namespace files.
This rule detects suspicious SMB traffic targeting raw disk volumes (e.g., PhysicalDrive, C:) or sensitive Windows files such as NTDS.dit and SYSTEM hive files. This behavior is indicative of credential dumping attempts, often performed using tools like secretsdump.py or Invoke-NinjaCopy, which bypass standard file system access controls to exfiltrate critical system credentials.
Detects access to sensitive cache or HTTP storage directories associated with the macOS 'Script Editor' application. Attackers may interact with these paths to persist scripts, modify application behavior, or stage data for exfiltration/execution.
Detects instances where 'Script Editor' or processes containing 'Maccy' in their command line access specific timezone files in /usr/share/zoneinfo. This behavior is indicative of potential environment checks for virtualization or sandbox detection, as attackers may attempt to identify or spoof the system's timezone to evade security analysis.
This rule detects attempts to acquire Windows credentials by accessing critical registry hives (SAM, SYSTEM, SECURITY) or their shadow copies. It looks for the use of 'reg save' to export hives, as well as direct file access to these hives or their shadow copy variations by non-standard system processes.
Detects reconnaissance activities where known binary analysis tools or scripts scan the AnyDesk 9.7.6 runtime binary for specific PE markers (e.g., COM interface IDs, adprinterpipe string) associated with a known LPE vulnerability. This behavior indicates an attacker is fingerprinting the application to prepare for exploitation.
Detects when the node.js runtime process accesses Docker configuration files, which may contain sensitive authentication credentials or registry settings. This behavior is atypical for standard node.js applications and could indicate credential theft or unauthorized container environment interaction.
Detects techniques associated with Golden SAML attacks, including the use of Mimikatz for ADFS token-signing certificate extraction, the execution of AADInternals PowerShell cmdlets for SAML token forgery, and unauthorized access to the ADFS configuration database (AdfsConfiguration.mdf).
Page 42 of 76