Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,440
11,814
5,871
5,145
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
Detects unauthorized processes accessing the Google Chrome 'Login Data' SQLite database file or the creation of a 'chrome_logins_dump.txt' file, which are indicators of potential credential theft activity often seen in RATs or information stealers.
This rule detects a scenario where an AI agent (Python or Node.js based) reads a corporate document (PDF, DOCX, TXT, MD) and subsequently spawns a command shell (cmd.exe, powershell.exe, sh, bash) within a 30-second window. This behavior indicates a potential indirect Remote Code Execution (RCE) where a prompt-injected payload from a poisoned document was executed by the AI agent.
Detects the execution of commands that parse the /etc/hosts file for PeopleSoft-related node names (WEB, APP, csprd). This activity is indicative of an adversary attempting to discover internal application and web servers, potentially for lateral movement. Threat actors like ShinyHunters have used this technique.
This rule detects when a non-Outlook process running as SYSTEM accesses or creates PST or OST mailbox data files. The logic specifically excludes legitimate Outlook, searchindexer, or searchprotocolhost activity to focus on suspicious mailbox collection sequences.
Detects access or modification attempts to KeePass (.kdbx) password database files by processes other than authorized KeePass applications. This behavior often indicates an attempt to exfiltrate or crack credential stores.
Detects unauthorized access to web browser sensitive files, including credential stores, cookies, and local state files, by processes other than standard browsers or their update mechanisms. This rule also flags access to specific staging directories or archive files associated with known malicious activity.
Detects a process rapidly accessing multiple target credential stores (Login Data, Cookies, Web Data, places.sqlite) within a short time frame (1 minute). This behavior is indicative of credential stealer malware like Vidar attempting to exfiltrate sensitive browser data.
Detects unauthorized access to sensitive browser files, such as login databases, cookies, and encryption keys (e.g., key4.db, Login Data), from Chromium and Firefox-based browsers by processes other than the browsers themselves. The rule requires multiple distinct credential files to be accessed to minimize false positives.
Detects unauthorized processes attempting to read KeePass database files (.kdbx) or VPN configuration files (.ovpn, .vpn) from user directories. This behavior is consistent with the GIFTEDCROOK stealer and UAC-0226 activity, aimed at harvesting credentials from password managers and VPN clients.
Detects obfuscated PowerShell command lines executing code from a staging file located at C:\ProgramData\WC3. The rule targets execution patterns where Get-Content is used in conjunction with Invoke-Expression (IEX) to reflectively load a PE file, leveraging native NT API resolution via Microsoft.Win32.UnsafeNativeMethods, consistent with activity attributed to the UAC-0226 GIFTEDCROOK campaign.
Detects unauthorized access to browser credential and sensitive configuration files (e.g., Login Data, cookies, key4.db) by processes that are not legitimate web browsers. The rule specifically accounts for known GIFTEDCROOK browser-stealing behavior by excluding legitimate browser subprocesses like utility, crashpad, or gpu processes.
Detects unauthorized access to KeePass database (.kdbx) and VPN configuration (.ovpn) files by processes originating from the C:\ProgramData\ directory. This behavior aligns with the activity of the GIFTEDCROOK information stealer observed during UAC-0226 campaigns, where malicious payloads are executed from staging folders within ProgramData.
Detects the access of VPN configuration files (e.g., .ovpn, .vpn, vpn*.conf) by common Windows command interpreters (powershell, pwsh, cmd, wscript, mshta) or archivers (WinRAR). This behavior is often indicative of automated credential harvesting or malicious configuration exfiltration, as legitimate VPN clients are explicitly excluded from this rule.
This rule detects when a non-standard or unexpected process attempts to access multiple sensitive credential files simultaneously. Specifically, it monitors for file access to Chrome login data, Firefox login and cookie databases, or KeePass database files (.kdbx). By flagging processes that access two or more distinct types of these files, the rule identifies potential credential dumping or harvesting attempts by malicious software not associated with legitimate browser or password manager activity.
This rule detects attempts to acquire Windows credentials by accessing critical registry hives (SAM, SYSTEM, SECURITY) or their shadow copies. It looks for the use of 'reg save' to export hives, as well as direct file access to these hives or their shadow copy variations by non-standard system processes.
Detects instances where non-browser processes (that are not signed by major browser vendors) attempt to access common browser credential files such as 'Login Data' or 'logins.json'. This behavior is characteristic of credential dumping or exfiltration attempts by malicious software trying to steal stored browser passwords.
Detects non-browser processes accessing sensitive browser data files (such as Login Data, Cookies, or key stores) followed by network activity to known suspicious, cryptocurrency, or potential malware-hosting domains. This behavior is indicative of credential theft and exfiltration by information-stealing malware.
Detects the opening of suspected APT28 (Fancy Bear) spearphishing lure documents by Microsoft Office or Outlook. The rule monitors for file access, creation, or renaming events where the filename matches known lure patterns associated with APT28 activities, such as naming conventions containing 'BULLETEN', 'OperInformativ', 'Courses', 'Consultation', 'Weapons', or 'Smuggling' in Word or Outlook processes.
Detects reconnaissance activities associated with the MYRA RAT, specifically the enumeration of network connections by reading /proc/net/tcp and /proc/net/udp, originating from the systemd-userdbd process. This behavior is indicative of malware attempting to map network state via proc filesystem parsing.
Detects the AMOS infostealer attempting to access and enumerate browser extension directories on macOS to harvest cryptocurrency wallet data from Chrome and Firefox profiles.
Detects potential information stealing activity, specifically the Atomic macOS Stealer (AMOS) malware, by monitoring unauthorized processes accessing Safari cookies and Apple Notes databases, excluding legitimate applications.
Page 60 of 76