Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,440
11,814
5,871
5,145
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
This rule detects file-related events (creation, modification, deletion, or renaming) targeting common SSH private key files (id_rsa, id_ed25519, id_ecdsa) and host keys. It filters out expected processes like standard SSH clients and key generation tools, flagging potential unauthorized access or credential harvesting by other applications.
Detects potential credential theft (e.g., InvisibleFerret/BeaverTail malware) where a node.js or python process, spawned as a child process of VS Code (Code.exe), attempts to read sensitive cloud credential files for AWS, Azure, or GCP.
This rule detects instances where Python interpreter processes (python.exe, python3.exe) access sensitive cryptocurrency wallet or keystore files. This behavior is indicative of unauthorized information collection or wallet stealer malware activity targeting local system assets.
This rule detects suspicious activities related to the exploitation of an insecure named pipe (ScriptLogic_Server_NamedPipe_9300) in Quest KACE Desktop Authority, identified as CVE-2025-67813. It covers three main branches: 1) Suspicious child processes (like command interpreters or scripting engines) spawned by Desktop Authority agents running as SYSTEM, indicating potential arbitrary code execution. 2) Access to the 'ScriptLogic_Server_NamedPipe' by processes other than the legitimate Desktop Authority agents, suggesting unauthorized interaction with the vulnerable named pipe. 3) Process injection or cross-process access attempts targeting Desktop Authority agent processes, which could be used to gain control or escalate privileges.
Detects Python or Node.js interpreter processes accessing sensitive files related to cryptocurrency wallets and browser extensions, a behavior consistent with information-stealer malware such as InvisibleFerret used in the Contagious Interview campaign.
Detects instances where common scripting engines such as node.exe, python.exe, or related variants access known web browser credential storage files (e.g., Login Data, Cookies, logins.json). This behavior is characteristic of info-stealing malware, notably identified in the BeaverTail and InvisibleFerret malware families used during the 'Contagious Interview' campaign to exfiltrate sensitive browser data.
This rule detects unauthorized or unexpected processes accessing sensitive local files containing cloud provider credentials, configuration, or environment variables. It identifies access to files such as .aws/credentials, .azure/accessTokens.json, .npmrc, and .env by processes that are not recognized cloud CLI tools. The rule prioritizes alerts involving developer-oriented applications like VS Code or Node.js, which may indicate credential theft or compromise of a developer's workstation environment.
Detects instances where common script interpreters (node.exe, python.exe, etc.) simultaneously access sensitive local credential files and establish outbound network connections to common web ports (80, 443, 8080, etc.), which is indicative of credential exfiltration behavior.
Detects cloud searches for credential, key, production, database, or confidential terms followed by access to matching files within OneDrive.
This rule detects the exfiltration of sensitive developer tokens (specifically .npmrc or .pypirc files) to public paste sites like Pastebin or GitHub Gists. It correlates network events where a process attempts to connect to these sites with file access events on the specified token files by the same process.
This rule detects the loading of a machine learning model (e.g., Pickle, PyTorch, or Hugging Face model files) via Python, immediately followed by the creation of a Windows Executable (PE) or Shared Object (.so) file on disk by the same initiating process. This behavior is indicative of an embedded stage-2 loader within a malicious model file, often seen in backdoored Large Language Models (LLMs). The time correlation between the model loading and the file drop is set to 45 seconds to identify immediate post-load execution.
Identifies a backdoored model's payload executing post-deserialization to read developer secrets (SSH keys, AWS credentials, NPM tokens) and exfiltrate them.
Detects a network beacon triggered strictly during model initialization. If a Python process loads a model file and immediately establishes an outbound TCP connection to an unknown IP, it indicates an embedded payload phoning home.
This rule detects a classic malicious model attack chain where a Python process reads a .pkl, .pt, or .bin model file, and immediately spawns an anomalous system shell or execution utility. This indicates potential Remote Code Execution (RCE) via deserialization vulnerabilities in machine learning models.
Detects the infostealer scraping .git-credentials or .git/config specifically targeting GitHub Personal Access Tokens (PATs). The rule identifies file access events where the file name is '.git-credentials' or 'config' within a folder path containing '.git', and the initiating process is 'python.exe'.
This rule monitors web browser processes (msedge.exe, chrome.exe) for two distinct behaviors: performing network connections to known command and control (C2) or exfiltration domains, and accessing sensitive browser files such as cookies, login data, or web data files.
Detects access to NTDS.dit for Active Directory credential dumping
This rule detects the presence of specific file names, paths, or command line arguments associated with a known penetration testing or exploit harness tool (libpwn). These artifacts are indicative of potential security testing or exploit activity on the host.
This rule monitors for unauthorized access to the Google Chrome 'Login Data' database file by processes other than standard browser executables. It also detects the creation of known file artifacts associated with credential-stealing malware or RATs (e.g., 'chrome_logins_dump.txt' or 'gather.tar.gz'), which are indicative of credential harvesting activities.
Detects unauthorized processes accessing the Google Chrome 'Login Data' SQLite database file or the creation of a 'chrome_logins_dump.txt' file, which are indicators of potential credential theft activity often seen in RATs or information stealers.
This rule detects suspicious activities associated with the exploitation of AnyDesk, specifically targeting COM printer impersonation for privilege escalation and subsequent persistence. It monitors for: 1) AnyDesk or AnyDesk-runtime spawning suspicious child processes (e.g., cmd, powershell, sc), 2) unauthorized processes accessing the 'adprinterpipe' named pipe used for privilege escalation, and 3) the creation of new Windows services originating from the AnyDesk process chain.
Page 59 of 76