Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,440
11,814
5,871
5,145
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
This rule detects suspicious activity related to accessing or dumping the NTDS.dit file, which contains Active Directory credential information. It looks for process creation events involving tools commonly used for NTDS.dit extraction (e.g., ntdsutil, secretsdump), file access events on NTDS.dit paths, and privilege use (SeBackupPrivilege, SeRestorePrivilege, SeDebugPrivilege) often associated with credential dumping.
Detects the unauthorized use of 'wbadmin.exe' to initiate a backup of Active Directory components (like 'ntds.dit' or the SYSTEM registry hive) when executed from common command-line interpreters (cmd.exe, powershell.exe). The rule correlates this backup activity with subsequent direct file access to sensitive AD database or registry files by processes other than standard system services (e.g., ntds.exe, lsass.exe), often indicative of credential dumping or exfiltration.
Detects non-Steam processes accessing Steam configuration files (e.g., config.vdf, loginusers.vdf, ssfn files) and reading Steam-related registry keys. This behavior is indicative of infostealer malware attempting to hijack Steam sessions or exfiltrate account configuration data.
Detects unauthorized processes (those not identified as standard web browsers) accessing browser profile directories (Local Storage or IndexedDB) associated with major AI platforms such as OpenAI, ChatGPT, Anthropic, and Copilot. This behavior is indicative of credential theft or session token exfiltration from local browser storage.
Detects unauthorized processes accessing sensitive Google Chrome credential files (Login Data and Cookies) typically stored in the AppData local folder. This behavior is characteristic of information stealers and trojans like ModeloRAT, Backdoor.Mistic, StealC, and Amadey, which attempt to exfiltrate stored browser passwords and session cookies.
This rule detects the DRAYN malware performing environment reconnaissance and sandbox evasion. It monitors for file access to the 'vmbusr.sys' driver, which is commonly used to identify virtual machine environments, followed by the execution of PowerShell commands to retrieve the system's UUID via Win32_ComputerSystem, a technique used for host fingerprinting.
This rule detects when processes other than known web browsers (Chrome, Firefox, Edge, Opera) attempt to access sensitive browser-related files such as 'Login Data', 'Cookies', and database files. It specifically flags instances where the accessing process or its parent process originates from 'C:\ProgramData' or where the parent process is 'powershell.exe', which is a common pattern for malicious credential access tools.
Detects a process that is not a standard office, browser, or system application accessing a high volume of document files (doc, docx, pdf, xlsx, xls, pptx, txt, odt) within user directories over a short time window. This behavior is indicative of potential automated file collection or data staging by unauthorized processes.
Detects suspicious access to browser credential stores (Google Chrome, Microsoft Edge, Mozilla Firefox, Brave) by non-browser processes within a short time frame (2 hours) after a FortiClient VPN logon event. This activity is consistent with information stealer malware, such as LummaC2, Phantom Stealer, Aurora Stealer, Luca Stealer, and Formbook, often observed in post-compromise phases of campaigns like FortiBleed.
Detects a network-connected Linux process exhibiting beaconing behavior (high-frequency external connections) that is subsequently correlated with unauthorized file access to sensitive Linux configuration files (/etc/passwd, /etc/shadow, or authorized_keys). This rule filters out common system processes and standard management binaries, targeting suspicious command-and-control activity combined with credential theft.
Detects anomalous processes targeting modern AI developer credential files and configuration files for tools like Claude, Gemini, and Cursor, a behavior exhibited by IronWorm.
This rule detects suspicious activity where a process attempts to access browser credential files (e.g., login data, cookies) shortly after a VPN logon event on the same device and by the same user. This could indicate an attacker attempting to steal credentials after gaining initial access or establishing a VPN connection.
Detects unauthorized processes attempting to access sensitive browser files such as 'Login Data', 'Cookies', or 'Web Data' in Google Chrome, Microsoft Edge, or Brave. These files contain stored credentials and session information that are frequent targets for credential theft malware and post-exploitation activity.
Detects unauthorized processes attempting to access sensitive browser files such as 'Login Data', 'Cookies', or 'Web Data' in Google Chrome, Microsoft Edge, or Brave. These files contain stored credentials and session information that are frequent targets for credential theft malware and post-exploitation activity.
Detects reading of /etc/shadow file for offline password cracking
Detects activity associated with the Lightlife RAT, which involves PowerShell scripts accessing cryptocurrency wallet browser extension directories, staging data using archive utilities, and exfiltrating collected data to external destinations like the Telegram Bot API.
Detects the unauthorized access of sensitive files (browser data, SSH keys, AWS credentials) followed by the creation of archives using common utilities (7zip, tar, zip) by processes spawned within npm/node.exe/powershell/wscript/chost.exe postinstall execution chains. This behavior is associated with credential theft and data staging for exfiltration, notably seen in campaigns like Operation Friday Harvest.
Detects malicious behavior attributed to the Miasma/TonRAT malware, specifically targeting node.js or bun.exe runtime environments. The rule identifies suspicious network connections to command and control (C2) domains, access to sensitive developer credential files (e.g., .npmrc, .aws/credentials), execution of identified credential-harvesting functions in process command lines, and the execution of specific suspicious preinstall scripts.
Detects unauthorized or suspicious access to sensitive files (AWS credentials, config, or SSH private keys) by processes spawned as children of common Integrated Development Environments (IDEs) or language runtimes. This pattern is characteristic of exploit chains like CVE-2026-12957, where malicious workspace configurations trigger automatic server execution, inheriting developer environment access to sensitive credential stores.
USB worm and loader leveraging living-off-the-land binaries
Detects instances where an unusual process (not a standard image viewer or web browser) reads a .png file and subsequently triggers a new process within a 5-minute window. This behavior is indicative of potential steganographic exploitation or hiding malicious code within image files, where a hidden payload is read and then executed.
Page 47 of 76