Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,440
11,814
5,871
5,145
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
Detects access, copying, or creation of files within common cryptocurrency wallet directories, as well as registry lookups related to Bitcoin data directories. This behavior is often indicative of info-stealing malware or an adversary attempting to exfiltrate digital currency assets from a compromised host.
Detects access, copying, or creation of files within common cryptocurrency wallet directories, as well as registry lookups related to Bitcoin data directories. This behavior is often indicative of info-stealing malware or an adversary attempting to exfiltrate digital currency assets from a compromised host.
Detects PowerShell script used to extract hidden payloads from BMP image files via RGB pixel channel parsing, as observed in multi-stage Remcos RAT loader campaign. This technique is often used to conceal malicious code within seemingly innocuous image files.
Detects read access to the Groups.xml file located in the SYSVOL share. This file is often used by Group Policy Preferences (GPP) to store credentials for local administrator accounts, which can be retrieved and decrypted by unauthorized users.
Detects unauthorized processes reading, copying, or renaming Kerberos ticket cache files (ccache) located in common temporary directories. This behavior is often associated with credential theft and potential Pass the Ticket attacks where adversaries attempt to extract session credentials to perform lateral movement or privilege escalation.
Detects sandbox evasion via sbiedll.dll presence check (T1497.001) followed by rapid process termination indicating the malware detected a sandbox and aborted execution, as observed in the FortiBleed steganographic loader campaign.
Detects suspicious activities within a Veeam backup environment, including unauthorized process spawning by Veeam services, LSASS memory access, destruction of backup catalogs or restore points via PowerShell, and unauthorized access to Veeam database files by non-Veeam processes.
This rule detects instances where 'python.exe' aggressively accesses files within '.ssh' directories. This behavior could indicate an attempt to harvest SSH keys, which are critical for secure remote access.
Detects a payload aggressively accessing browser credential stores (Login Data, Cookies, Web Data) in a rapid sequence, specifically when initiated by processes matching common VPN client names like GlobalProtect or AnyConnect. This behavior is indicative of infostealer activity, attempting to exfiltrate sensitive browser data.
Detects unauthorized processes attempting to access sensitive browser files such as 'Login Data', 'Cookies', and 'Web Data' files typically located in Chrome or Firefox user profiles. This behavior is indicative of credential theft or data exfiltration, as these files contain saved usernames, passwords, and session cookies.
Detects instances of wermgr.exe (Windows Error Reporting) interacting with Volume Shadow Copies or using specific Alternate Data Streams (WDFOO). This behavior is often associated with credential dumping tools (e.g., Mimikatz, SharpShadow) attempting to access sensitive files from shadow copies under the context of a non-system user, potentially indicating evasion techniques or credential harvesting.
This rule detects when processes other than legitimate browser-related binaries access Google Chrome's 'Login Data' or 'Local State' files. These files contain sensitive browser data, including stored credentials, and unauthorized access is a common indicator of credential theft or dumping attempts by malicious software.
Detects unauthorized attempts to place an exclusive byte-range lock on the wermgr.exe executable when accessed via Volume Shadow Copy (VSS) or temporary paths, which is characteristic of the RoguePlanet exploit. This technique is designed to stall Windows Defender's clean-up operations, creating a time-of-check to time-of-use (TOCTOU) race window for further exploitation.
Detects unauthorized processes attempting to read LevelDB or credential storage files belonging to common Electron-based applications (Discord, Signal, Slack, Teams, Telegram). This behavior is characteristic of info-stealer malware like Yuta or Glove Stealer that target browser and application-based session tokens.
This rule detects unauthorized read access to Chromium-based browser sensitive files (Login Data, Cookies, Web Data) by processes other than known browser executables. This behavior is indicative of credential theft or session hijacking, often observed in malware such as Atlas RAT, ValleyRAT, and SilentRunLoader.
This rule detects non-browser processes attempting to read sensitive files within Chromium-based browser profiles, such as 'Login Data', 'Cookies', and 'Web Data'. Such activity is highly indicative of credential theft or session token exfiltration by malicious software targeting stored browser secrets.
Detects BQT.exe attempting to access sensitive browser credential stores or staging credential files.
Detects indicators of the IronWorm malware performing self-propagation by abusing npm Trusted Publishing (OIDC) token exchange, executing suspicious npm publish commands, and unauthorized access to ~/.npmrc configuration files. The rule monitors for network requests to npm OIDC endpoints from non-standard processes, npm publish operations originating from non-interactive shell or script environments, and file access to credential files by suspicious parent processes.
Detects suspicious credential harvesting activities, specifically identifying processes performing a sweep of multiple sensitive configuration files (e.g., AWS, Kubernetes, SSH keys, npm, git) or processes accessing /proc/self/environ to enumerate environment variables for sensitive data.
Detects unauthorized processes (excluding known web browsers and system processes) attempting to access sensitive browser credential files (e.g., Login Data, key4.db) followed by a network connection to external IP addresses. This behavior is highly indicative of credential theft and subsequent exfiltration.
This rule detects unauthorized attempts by processes other than standard web browsers to access credential-related files, including browser login databases, Firefox key files, and known cryptocurrency wallet data files. These activities are indicative of credential harvesting or theft attempts by malicious software.
Page 54 of 76