Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,440
11,814
5,871
5,145
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
This rule detects instances of the 'node.exe' process accessing file system paths associated with common browser-based cryptocurrency wallet extensions (such as MetaMask, Phantom, Coinbase Wallet, etc.). This behavior is highly suspicious as it indicates a potential attempt to steal local wallet data or seed phrases.
This rule detects when a Node.js process accesses sensitive files associated with cryptocurrency wallets (e.g., MetaMask, Phantom, Coinbase Wallet) or browser extension storage directories. This behavior is highly indicative of information-stealing malware attempting to extract private keys, wallet configuration files, or sensitive browser session data.
This rule detects processes such as Node.js, npm, or Python accessing sensitive command-line history files including .bash_history, .zsh_history, .fish_history, or ConsoleHost_history.txt. Accessing these files, which often contain credentials or command execution history, is a common indicator of credential harvesting or post-exploitation reconnaissance.
This rule detects a high volume of failed object access attempts (EventID 4674) by a single user on a specific computer within a one-hour window. This could indicate an adversary attempting to discover or access sensitive resources, potentially as part of privilege escalation or data exfiltration efforts.
Detects instances where processes other than legitimate browser-related binaries access sensitive SQLite database files (Login Data and Cookies) associated with Google Chrome or Microsoft Edge. This activity is a common indicator of credential theft by malicious tools or scripts attempting to extract stored passwords or session cookies.
Detects unauthorized processes attempting to access browser cookie storage files, which are commonly targeted by infostealer malware to extract session cookies for services like Jira and Atlassian SSO. Extracting these tokens allows attackers to bypass multi-factor authentication (MFA) and gain unauthorized access to accounts.
Detects anomalous activity associated with information stealing malware, including unauthorized access to browser credential files (Login Data, Cookies), remote thread injection into browser processes, outbound connections to the Telegram API by non-browser processes, and rapid bulk access to multiple sensitive credential or crypto wallet files.
Detects anomalous post-compromise activity associated with Browser-in-the-Browser (BitB) attacks or general credential theft. Specifically, it monitors for browser processes spawning suspicious child processes (e.g., cmd.exe, powershell.exe, mshta.exe) that are typically used for payload delivery, and unauthorized access to browser-stored credential files (e.g., 'Login Data') by non-browser processes.
Detects GreenBlood ransomware or similar threats accessing Outlook PST/OST/EML/MSG email files from non-Outlook processes, potentially indicating data theft for double extortion. The rule specifically looks for file read, access, or creation actions on these email file types within common Outlook or user data folders, excluding legitimate processes that typically interact with these files.
Detects instances where 'node.exe' accesses browser extension LevelDB directories (associated with cryptocurrency wallets in Chrome, Edge, or Brave) or executes with suspicious command-line arguments such as 'protocal.cjs', 'NodePackages', or 'nvmconf'. This behavior is indicative of potential malware attempting to exfiltrate sensitive browser data or execute malicious code.
Detects unauthorized processes, other than established web browsers, attempting to read, access, or copy sensitive browser data files (such as 'Login Data', 'cookies.sqlite', or 'key4.db') that store user credentials, cookies, and web history.
Detects activity associated with a specific phishing campaign distributing 'Distribution Settlement Agreement' PDF lures. The rule monitors for file creation or execution of files matching this naming pattern, as well as network connection attempts to domains identified as related to the threat actors: 'gasparinutrition.com' and 'gappssmtp.com'.
Detects anomalous activity associated with the 'SmartWindow' browser exploitation technique, specifically: Firefox communicating with the local SmartWindow PoC C2 API on port 8765, Firefox spawning unexpected child processes, or unauthorized processes accessing Firefox's 'places.sqlite' database to harvest browsing history or private session data.
Detects processes attempting to read or open sensitive SSH files (keys and configuration) that are not recognized as legitimate SSH-related utilities (e.g., ssh, sshd, rsync, git). This behavior is often indicative of credential harvesting or unauthorized reconnaissance of authentication artifacts.
Detects Python processes attempting to read sensitive credential files (Login Data, Cookies, logins.json, key4.db) from Chrome, Firefox, and Edge directories. This behavior is indicative of the InvisibleFerret infostealer, which targets browser-stored credentials on compromised developer workstations.
Detects Python-based processes accessing sensitive local cryptocurrency wallet files and directories, including MetaMask extension storage, Exodus wallet, and Bitcoin wallet files, which are known targets of the InvisibleFerret infostealer.
Detects Python or Node.js processes reading sensitive SSH private key files (id_rsa, id_ed25519) followed by an outbound network connection within a one-minute window. This behavior is indicative of credential theft and exfiltration, such as that observed in the InvisibleFerret campaign.
Detects access or modification of cloud provider credential and configuration files by common script interpreters or code editors (python, node, vscode), which may indicate credential theft or misuse by an adversary.
Detects Python scripts, launched by code.exe or node.exe (common IDE-related processes), accessing SSH private key files (id_rsa, id_ed25519, id_ecdsa) followed by an outbound network connection within 60 seconds. This behavior is indicative of credential theft and potential exfiltration or lateral movement.
Detects instances where scripting processes (Python, Node.js) accessed SSH key files or configuration files and subsequently initiated an outbound network connection within 60 seconds, which may indicate potential exfiltration of credentials or unauthorized access.
Detects processes accessing credential store paths across browsers, FTP clients, email, SSH, and IM clients in a pattern consistent with Pony (Fareit/Siplog) modular credential grabber walking well-known AppData credential store locations. The rule specifically looks for non-browser/non-client processes accessing multiple credential-related files in common application data directories.
Page 50 of 76