Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,440
11,814
5,871
5,145
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
Detects the use of package management or file integrity monitoring tools (rpm, dpkg, debsums, aide, inotifywait) to verify or interact with critical SSH/PAM configuration files, or the use of inotifywait to monitor SSH configuration access. This behavior may indicate an adversary attempting to verify compromised configurations, check for the presence of backdoors, or monitor security modifications.
This rule detects potentially malicious web requests attempting to access sensitive local system files, environment variables, or application source code within a cloud-hosted application environment. The detection logic focuses on URI patterns indicative of Local File Inclusion (LFI) attempts targeting proc filesystem nodes, credential configuration files, or application source bundles.
Detects instances where the Active Directory domain database file (ntds.dit) is accessed by processes other than known legitimate tools such as lsass.exe or ntdsutil.exe. This activity is a strong indicator of credential dumping attempts to extract Active Directory hashes.
This rule detects potential unauthorized access to web browser data files (such as Login Data, Cookies, or History) by processes other than the legitimate browser applications. It also identifies process command-line arguments often used by malicious tools to access browser data or bypass protections, which is a common indicator of credential theft from browsers.
Detects unauthorized access to Windows Credential Manager files, TokenBroker OAuth cache files, or the loading of crypt32.dll from suspicious, user-writable directories (e.g., Temp, Downloads, Desktop) by non-Microsoft or non-system processes. This activity is indicative of credential theft, session hijacking, or attempts to abuse the Windows Data Protection API (DPAPI) to decrypt sensitive local secrets.
This rule detects when users access or download suspicious file types (specifically .xlsm, .docm, or .ics) from Microsoft SharePoint, Teams, or Exchange, where the filenames contain keywords associated with common phishing lures such as credentials, invoices, payroll, or password resets. This monitors for indicators of potential spearphishing attempts involving malicious documents or calendar invites within the M365 environment.
This rule detects potential supply chain compromise in Node.js projects by monitoring for the execution of known malicious npm package install/preinstall/postinstall scripts. It identifies unauthorized access to sensitive developer credential files (such as .ssh, .git-credentials, and .npmrc) and suspicious network outbound connections associated with identified malicious package scopes.
Detects node.exe (often associated with malicious npm package runtimes) accessing local credential store files such as KeePass, 1Password, and Bitwarden. This activity is indicative of infostealer payloads (e.g., Miasma/MYRA) targeting developer workstations to exfiltrate sensitive credential databases.
This rule monitors for the Node.js process (node.exe or node) accessing common sensitive configuration files, SSH keys, cloud credentials, or environment files such as .ssh/id_rsa, .aws/credentials, .npmrc, and .docker/config.json. Such activity is often indicative of an adversary attempting to perform credential theft or environment discovery after gaining initial access via a compromised Node.js application.
Detects node.exe or npm processes accessing directory paths associated with popular browser cryptocurrency wallet extensions, a behavior indicative of the Miasma infostealer used in supply chain attacks.
Detects Node.js or npm processes accessing sensitive developer configuration and credential files. This rule is designed to identify malicious supply chain activity, specifically matching patterns where npm postinstall scripts or malicious node modules attempt to exfiltrate files such as .gitconfig, SSH keys, cloud credentials, and tokens from a developer workstation.
Detects unauthorized access to sensitive cryptographic files, such as SSH private keys, GPG secret keys, or Windows certificate store files, by unauthorized or anomalous processes (specifically node/npm or processes within /tmp). This is followed by potential outbound exfiltration via an external network connection or the mass access of multiple sensitive files within a short timeframe.
Detects anomalous or suspicious behavior from Microsoft 365 Copilot agents, plugins, or sessions. This includes bulk access to files containing sensitive keywords, unauthorized export or sharing of sensitivity-labeled documents, and high-volume Microsoft Graph API read activity targeting sensitive paths in SharePoint or OneDrive.
Detects unauthorized processes attempting to access sensitive local browser files (credential stores, cookies, and local state databases) associated with Chrome, Edge, Brave, Chromium, and Firefox. Such access is a primary indicator of infostealer malware attempting to harvest saved credentials and session cookies from a victim's machine.
Detects unauthorized access to sensitive browser credential files (Login Data, Cookies, logins.json) by processes other than standard browsers or known security products. This activity is a common indicator of credential harvesting by infostealer malware families aiming to compromise saved passwords and session cookies.
Detects attempts to access browser credential stores or LSASS process memory by unexpected processes. This rule identifies suspicious file access patterns to browser login data files (Chrome, Edge, Firefox, Brave) by non-browser executables, as well as unauthorized access to LSASS process memory via Sysmon Event ID 10 or Windows Security Event 4656 by non-system processes. These activities are indicative of credential dumping or theft.
This rule detects unauthorized processes attempting to access sensitive web browser files (such as Login Data, Cookies, and Web Data) which store credentials, sessions, and history. It monitors file access events specifically targeting Chrome, Edge, and Firefox profiles, while excluding expected legitimate browser process names.
Detects attempts by explorer.exe to access browser credential and cookie files from common web browsers (Chrome, Edge, Firefox). This activity is highly suspicious as explorer.exe is not typically involved in legitimate access to these sensitive files, suggesting potential credential theft or reconnaissance.
Detects unauthorized processes attempting to access sensitive browser credential stores, such as Login Data, Cookies, or Local State, typically targeted by the Millenium RAT (DotStealer component) to harvest credentials and bypass Chromium App-Bound encryption.
Detects a specific AMSI bypass technique associated with Operation DragonReturn, where the process patches amsi.dll memory using VirtualProtect after dynamically locating the function with GetModuleHandleA and GetProcAddress.
Detects unauthorized processes reading or opening files located within the data directories of Discord or Telegram Desktop. These directories often store sensitive user data, including session tokens and local databases, which are common targets for info-stealing malware.
Page 45 of 76