Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,440
11,814
5,871
5,145
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
Detects a batch or PowerShell loader reading 'msedge.txt' from a writable path (Temp, AppData, Downloads, ProgramData) and treating its content as encoded executable data. This behavior is indicative of the Banana RAT malware.
Detects processes accessing credential store paths across browsers, FTP clients, email, SSH, and IM clients in a pattern consistent with Pony (Fareit/Siplog) modular credential grabber walking well-known AppData credential store locations. The rule specifically looks for file read or access actions on common credential files within typical application data directories, while excluding legitimate processes that would normally access these files.
Detects attempts to access SSH private keys (id_rsa, id_ed25519) or public keys (.pub files) by 'node' or 'python' processes. This activity could indicate an attacker attempting to collect SSH credentials for lateral movement or persistence.
Detects processes accessing credential store paths across browsers, FTP clients, email, SSH, and IM clients in a pattern consistent with Pony (Fareit/Siplog) modular credential grabber walking well-known AppData credential store locations. The rule specifically looks for file read or access events on common credential files within typical application data directories, while excluding legitimate browser and application processes.
This rule detects suspicious activity related to the Sapphire Sleet malware, specifically its technique of traversing Google Chrome or Brave profile directories to extract and compress Web3 wallet extensions. It correlates file access events on specific browser extension paths with process events where archiving tools like 'zip' or 'tar' are executed.
This rule detects malicious activity associated with the TONResolver RAT, which leverages node.exe to execute JavaScript payloads stored in AppData\Local\Nodejs. The rule monitors for multiple suspicious behaviors, including outbound C2 beaconing to known malicious domains, spawning of suspicious child processes (powershell.exe, cmd.exe, wscript.exe, cscript.exe), unauthorized access to browser-based credential stores (Login Data and Cookies), and establishment of persistence via Windows Registry Run keys.
Detects unauthorized processes attempting to access sensitive web browser files (Login Data, Local State, Cookies) and subsequently copying or staging these files to temporary directories (Windows Temp or AppData Temp) within a 5-minute window, a technique often used for credential harvesting.
Detects the correlation of a PowerShell process spawned by Explorer using a bypass execution policy, followed by a local Node.js process accessing web browser cookie files (Chrome, Edge, or Brave). This behavior is indicative of a potential credential theft attempt where an attacker uses PowerShell to prepare the environment and a helper process to extract browser session cookies.
Detects unauthorized processes attempting to read, modify, or create files within common browser credential locations (Chrome, Firefox, Edge, and Windows Credential Manager). Legitimate browser processes and their known signers are excluded, focusing on suspicious secondary processes or tools frequently utilized by infostealers like Lumma and RedLine to dump credentials.
Detects unauthorized access, creation, or modification of sensitive credential and token files (e.g., OAuth tokens, AWS credentials, gcloud tokens) in common user directories like AppData or .config by processes other than established browsers or legitimate cloud CLI tools. This behavior is indicative of credential theft or SaaS pivot attacks.
Detects unauthorized or non-standard processes attempting to create, modify, or access sensitive cloud configuration and credential files, such as AWS credentials, Azure CLI token caches, or GCP application default credentials. This behavior is indicative of potential credential theft or unauthorized access to cloud environment tokens.
Detects unauthorized access (File Creation, Modification, Rename, or Deletion) to common web browser cookie and credential storage files by non-browser processes. This behavior is a common indicator of information-stealing malware attempting to extract session cookies and credentials for later use.
Detects unauthorized processes reading, creating, or modifying sensitive files associated with local AI development tools and assistants (e.g., Claude, Codex, Gemini, Cline, Opencode, Kilo). This rule monitors for file operations outside of the known, legitimate AI tool processes, suggesting potential credential theft or configuration tampering by malicious software.
This rule detects unauthorized or suspicious processes attempting to access sensitive local browser extension data or known password manager vault files (e.g., .kdbx, vault.json, data.json). This behavior is characteristic of infostealer malware or credential-harvesting activities attempting to extract stored secrets.
Detects unauthorized mass access to AI development tool configuration files and credentials. The rule identifies processes reading sensitive files associated with tools such as Claude (mcp.json, projects), Codex (config.toml, sessions), Gemini (settings.json, .env), Cline, OpenCode, and Kilo.
This rule detects attempts by unsigned or suspicious processes (often residing in temporary directories) to access sensitive cryptocurrency wallet files such as 'wallet.dat', keystore JSON files, and files containing recovery seed phrases. This behavior is indicative of credential theft commonly associated with infostealer campaigns like DeepLoad and DeerStealer.
Detects UAC bypass activity associated with BeepRAT (Operation DragonClone) which involves modifying registry keys associated with auto-elevating Windows binaries (fodhelper, eventvwr, sdclt, ComputerDefaults), followed by the execution of these binaries and the subsequent loading of DLL/bin payloads from user-writable AppData directories. The rule also detects reads of the 'Creeper' registry key used for BeepRAT C2 configuration.
Detects the Djinn Stealer malware accessing sensitive configuration files and credential stores related to AI coding assistants (e.g., Claude, Codex, Gemini, Cline) and common development utilities (e.g., AWS, GKE, SSH) on Linux workstations. It also detects the creation of a 'linux-process-env.json' file, which is an artifact used by the stealer to exfiltrate environment variables harvested from process memory.
Detects behavior indicative of the InvisibleFerret information stealer, specifically focusing on Python execution spawned by development tools (VS Code/Node.js), unauthorized access to browser-based credential stores or local crypto wallets, and suspicious outbound network activity originating from Python processes spawned by development/automation tools.
This rule detects file-related events (creation, modification, deletion, or renaming) targeting common SSH private key files (id_rsa, id_ed25519, id_ecdsa) and host keys. It filters out expected processes like standard SSH clients and key generation tools, flagging potential unauthorized access or credential harvesting by other applications.
Detects instances where a process not associated with a known web browser attempts to read sensitive browser credential stores (such as Chrome Login Data, Edge Login Data, or Firefox key4.db/logins.json). This behavior is characteristic of infostealers attempting to extract saved browser credentials.
Page 58 of 76