Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,440
11,814
5,871
5,145
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
Detects read access to cryptocurrency wallet files and application directories (including Electrum, Exodus, Atomic, and generic wallet.dat files) by non-wallet associated processes. This behavior is consistent with credential harvesting activities by info-stealing malware such as StealC.
Detects unauthorized file access to browser extension directories and credential stores (History, Login Data) by a suspicious Node.js process named 'protocal.cjs'. This activity is characteristic of the 'easy-day-js' supply chain compromise, where a malicious backdoor attempts to exfiltrate browser-stored credentials and history from Chrome, Edge, and Brave browsers.
Detects unauthorized processes attempting to read sensitive application data directories (specifically for Telegram and Discord) on macOS. This behavior is indicative of infostealer malware, such as AMOS (Atomic macOS Stealer), attempting to exfiltrate session tokens and account information.
Detects the loading of .NET assemblies (DLL, OCX, EXE) from user-writable directories such as AppData\Local\Temp or AppData\Roaming by processes that are not standard .NET development tools. This behavior is often associated with malware loaders, such as OXLOADER, that perform module stomping or use steganographic techniques to execute malicious code in memory via AppDomain.Load.
This rule detects file access or modification events targeting '.env' files, which often store environment variables and sensitive configuration data (such as API keys and credentials). The detection specifically focuses on file paths associated with CI/CD build agents, runners, or workspace directories (e.g., github, gitlab, jenkins, build, runner), where such credentials are high-value targets for attackers seeking to escalate access or pivot within an environment.
Detects the loading or access of specific DLLs (Optimax.dll or System Optimizer Ultimate.dll) by processes originating from user-writable directories (AppData or Temp), which is characteristic of the TuglaInsaatci campaign utilizing steganographic techniques to deploy Remcos RAT.
This rule detects file access or modification events targeting '.env' files, which often store environment variables and sensitive configuration data (such as API keys and credentials). The detection specifically focuses on file paths associated with CI/CD build agents, runners, or workspace directories (e.g., github, gitlab, jenkins, build, runner), where such credentials are high-value targets for attackers seeking to escalate access or pivot within an environment.
Analyzes HTTP network events to detect the Komari agent executing HTTP POST requests with large data payloads, indicating data exfiltration. This rule specifically looks for HTTP POST requests combined with recent file access events for common archive file types (zip, rar, 7z, db) on the same device and by the same initiating process.
This rule detects a single process attempting to access credential-related files (e.g., browser login data, FTP client configurations) and/or registry keys (e.g., PuTTY, WinSCP sessions) from at least two different application types within a 60-second window. This behavior is indicative of an attacker attempting to rapidly harvest credentials from various sources on a compromised endpoint.
Detects file access events where the powrprof.dll file is accessed within the Avast Software installation directory. This pattern may be indicative of DLL hijacking or unauthorized file interaction targeting components within the Avast security product structure.
This rule detects attempts by non-browser processes to access sensitive files that commonly contain credentials, such as browser login data (Chrome, Firefox) or the Windows Security Account Manager (SAM) database. This activity could indicate credential dumping or information theft.
This rule detects the loading of a machine learning model (e.g., Pickle, PyTorch, or Hugging Face model files) via Python, immediately followed by the creation of a Windows Executable (PE) or Shared Object (.so) file on disk by the same initiating process. This behavior is indicative of an embedded stage-2 loader within a malicious model file, often seen in backdoored Large Language Models (LLMs). The time correlation between the model loading and the file drop is set to 45 seconds to identify immediate post-load execution.
This rule detects suspicious activity involving Node.js or Bun runtimes, specifically focusing on the access of sensitive configuration files (e.g., .npmrc, .aws/credentials, .ssh, .kube/config) or the execution of commands containing keywords associated with credential harvesting and automated data collection scripts.
Detects rapid access (three or more distinct files within a 60-second window) to sensitive files typically containing credentials or configuration data (e.g., SSH keys, AWS credentials, environment files, container configurations). This pattern is often associated with credential dumping or reconnaissance activity by an adversary attempting to harvest secrets.
Detects instances where 'node' or 'bun' runtime processes access multiple sensitive developer configuration or credential files (e.g., .ssh, .aws/credentials, .npmrc, .kube/config). This behavior is indicative of potential credential theft or reconnaissance activities by an adversary attempting to leverage developer environments.
Detects instances where the node.exe process attempts to read SSH configuration files or private key files (id_rsa, id_ed25519, etc.). This behavior is often associated with malicious packages or compromised scripts attempting to exfiltrate SSH credentials from the local file system. The rule includes exclusions for common node package manager installation paths and processes that appear to be performing legitimate package management or post-installation tasks.
Detects instances where node.exe processes attempt to access sensitive configuration files, specifically AWS credential or configuration files, or .env files associated with common package installation or session management operations. This behavior may indicate an attempt to exfiltrate credentials from a developer or build environment.
Detects suspicious processes accessing, reading, or deleting browser credential stores (like 'Login Data', 'cookies.sqlite'). The rule specifically monitors for patterns where non-browser processes interact with these files, particularly when both file read and deletion actions are observed, which is a technique used by Remcos RAT to wipe existing sessions and force re-authentication for harvesting.
Detects the node.exe process attempting to read shell history files (.bash_history, .zsh_history, etc.), which are common targets for credential harvesting by malicious npm packages. This behavior is associated with the Polymarket Trap campaign involving Miasma and MYRA infostealers.
Detects node.exe processes attempting to access sensitive browser credential databases, such as cookies, login data, or key databases. This pattern is indicative of infostealer malware, specifically those associated with the Polymarket Trap supply-chain campaign, which abuse node.js processes to exfiltrate browser data.
Detects a single process reading both SSH private keys and various developer-sensitive configuration or credential files (e.g., .aws/credentials, .npmrc, .pypirc) on a single host. This behavior is consistent with infostealer activity, such as the Miasma JavaScript infostealer used in supply chain campaigns, aiming to harvest credentials from developer workstations.
Page 56 of 76