Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,440
11,814
5,871
5,145
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
Detects the creation or execution of suspicious LNK files masquerading as legitimate AnyDesk or N-able RMM configuration files (e.g., ApplianceConfig.lnk, ServerConfig.lnk) and unauthorized access to AnyDesk service or user configuration files (anydesk_svc.conf, anydesk_usr.conf). This behavior is associated with MexicanMafia's 'Operation Escaneo' for establishing persistent, low-visibility remote access.
Detects non-browser processes accessing sensitive browser data files (such as Login Data, Cookies, or key stores) followed by network activity to known suspicious, cryptocurrency, or potential malware-hosting domains. This behavior is indicative of credential theft and exfiltration by information-stealing malware.
Detects access, copying, or creation of files within common cryptocurrency wallet directories, as well as registry lookups related to Bitcoin data directories. This behavior is often indicative of info-stealing malware or an adversary attempting to exfiltrate digital currency assets from a compromised host.
Detects execution of sensitive administrative binaries (rm, chmod, chown) targeting critical system files or directories, or direct interaction with sensitive system files and configuration logs which may indicate unauthorized data access or evidence tampering.
Detects unauthorized attempts to extract the Active Directory database (NTDS.dit) for credential harvesting. The rule monitors for common administrative tools like ntdsutil.exe and vssadmin.exe being used to create shadow copies or extract the NTDS database, as well as direct file manipulation of ntds.dit. This activity is often associated with post-exploitation credential dumping techniques.
This rule detects potentially malicious activities on Linux systems involving the creation of new accounts or access to sensitive files like /etc/passwd and /etc/shadow using or referencing the string 'troot'. This pattern is often associated with adversary attempts to create backdoored accounts or perform offline password cracking by manipulating or dumping authentication files.
Detects unauthorized access to sensitive credential and configuration files associated with AI development tools (Cursor, Claude, Gemini) and cloud providers (AWS, GCP) by the Miasma worm, which seeks to steal environment configuration and authentication data.
Detects the 'Adblock for YouTube' browser extension (specific ID cmedhionkhpnakcndndgjdbohmhepckk) performing suspicious file system operations related to the injection of remotely-fetched scriptlets into the browser's MAIN world. This activity is indicative of an attempt to bypass browser security boundaries to access session cookies, local/session storage, and login form data.
Detects potential container breakout attempts on Windows systems by monitoring for the launch of privileged containers with sensitive host paths mounted, the execution of host-level processes directly spawned by container runtime binaries (docker.exe, containerd.exe), and direct access to sensitive host filesystems (e.g., C:\windows, C:\etc, C:\programdata) by container runtimes.
Detects unauthorized processes reading, copying, or renaming Kerberos ticket cache files (ccache) located in common temporary directories. This behavior is often associated with credential theft and potential Pass the Ticket attacks where adversaries attempt to extract session credentials to perform lateral movement or privilege escalation.
This rule detects potential credential harvesting activity associated with the Hannibal Stealer. It looks for non-standard processes (processes other than the browsers themselves) that access sensitive browser credential stores (like 'Login Data', 'cookies.sqlite', or 'key4.db') and correlate these file access events with the loading of 'bcrypt.dll' or 'CefSharp.BrowsersSubprocess.dll', which are often used for decryption or browser automation/sub-processes during credential theft.
This rule detects when non-FileZilla processes attempt to read or access sensitive FileZilla configuration files, specifically 'recentservers.xml' or 'sitemanager.xml', which are known to store plain-text credentials for site connections. This behavior is indicative of credential harvesting.
Detects unauthorized access to Chrome and Firefox browser credential (Login Data, logins.json, key4.db) and cookie database files on macOS by non-browser processes, commonly observed in credential theft campaigns like ClickFix.
Detects a process performing a file access check for 'sbiedll.dll' (indicative of a Sandboxie presence check) followed by the immediate termination of the same process within a 2-minute window. This behavior is highly characteristic of malware attempting to detect if it is being analyzed in a sandbox environment and aborting execution accordingly.
Correlates the reading of sensitive local files (id_rsa, .env, config.json) followed by an immediate POST request to an LLM API (specifically api.openai.com), indicating data theft via prompt injection or automated analysis.
This rule detects potential exploitation of the PHP StreamBucket SOAP RCE vulnerability (CVE-2026-55199). It monitors for characteristic post-exploitation behaviors, including the spawning of unexpected shell or system utility processes, access to sensitive memory mapping files (/proc/self/maps or /proc/self/mem) for ASLR defeat, creation of specific RCE marker files (e.g., /tmp/php857_rce_*.txt), and anomalous outbound network connections following SOAP request activity.
This rule detects suspicious file read or access events on common cryptocurrency wallet application folders (Electrum, Coinbase, Exodus), specific wallet files (wallet.dat), or browser extension folders associated with MetaMask. The rule specifically excludes legitimate access by the wallet applications themselves or common browsers to reduce false positives, indicating that an unauthorized process might be attempting to access sensitive cryptocurrency data.
This rule detects attempts by non-browser processes to access sensitive browser files such as 'Login Data', 'Cookies', 'Web Data', 'logins.json', 'cookies.sqlite', 'formhistory.sqlite', and 'places.sqlite'. These files often contain credentials, session tokens, and browsing history. Legitimate browser processes are excluded from this detection to reduce false positives. This activity could indicate an attempt to steal user credentials or session information.
Detects rapid access (three or more distinct files within a 60-second window) to sensitive files typically containing credentials or configuration data (e.g., SSH keys, AWS credentials, environment files, container configurations). This pattern is often associated with credential dumping or reconnaissance activity by an adversary attempting to harvest secrets.
Detects the use of 'docker cp' to copy files to or from sensitive host paths, such as cron, password files, SSH keys, or system directories, which often indicates attempts to escape container isolation or establish persistence on the host.
This rule detects non-browser processes attempting to access sensitive local files associated with common web browsers (Google Chrome, Microsoft Edge, and Mozilla Firefox). Specifically, it monitors for file events involving login databases, cookies, and key storage files by processes other than legitimate browser executables, which is a common technique used by credential-stealing malware.
Page 51 of 76